Subject
compact_str is a no_std Rust library that provides CompactString, a
string type implementing the same small-string optimisation (SSO) as String
but storing up to 24 bytes inline on 64-bit targets (12 bytes on 32-bit).
A CompactString occupies exactly size_of::<String>() and is laid out as a
tagged union of three variants — inline buffer, heap buffer, and
&'static str — discriminated by the last byte. The crate also exposes a
specialised ToCompactString trait (zero-cost dispatch for numeric and
boolean primitives via castaway), a CompactStringExt trait (concat_compact,
join_compact), and a format_compact! macro, plus optional integrations
with serde, bytes, rkyv, borsh, diesel, sqlx, markup, arbitrary,
proptest, quickcheck, smallvec, and zeroize.
Methodology
The published .crate contents were compared against the upstream Git
repository at the commit recorded in .cargo_vcs_info.json (70361f7b) using
diff -r. The full source tree was read: src/lib.rs (2662 lines), the
src/repr/ submodules (~3300 lines), src/traits.rs, src/tests.rs
(~2000 lines), src/macros.rs, src/unicode_data.rs, and every
src/features/*.rs adapter. unsafe usage was enumerated with grep -rn "unsafe" contents/src (165 sites), and each unsafe block was paired with
its SAFETY comment in src/repr/. System surface (std::process, std::net,
std::fs, std::env, Command::) was checked with grep; no matches were
found. The Cargo manifest was reviewed for build scripts (build = false),
proc-macros (no [lib] proc-macro entry), and default features (default = ["std"]).
The upstream fuzz/ workspace and .github/workflows/ were inspected to
confirm the test surface (libfuzzer + AFL + honggfuzz harnesses, miri,
proptest with PROPTEST_CASES=10000, MSRV CI, cross-platform CI). Tools used:
diff (FreeBSD), grep (BSD), wc, ls, find, all at default versions
shipped with macOS 25.5.
Results
The published crate contents match the upstream repository byte-for-byte in
all source files; the only differences are cargo's standard Cargo.toml
normalisation and the addition of .cargo_vcs_info.json. No binary
artefacts are shipped (justifying has-binaries). There is no build.rs and
the manifest's [lib] table does not set proc-macro = true, so the crate
performs no compile-time code execution on consumers (justifying
has-build-exec and has-install-exec).
The crate is no_std-by-default with an opt-in std feature. No code path
opens files, sockets, processes, or reads environment variables; the only
system interaction is the global allocator. Justifies uses-network,
uses-filesystem, uses-exec, and uses-environment. There are no
cryptographic primitives, no JIT, and no embedded interpreter
(uses-crypto, uses-jit, uses-interpreter, impl-crypto,
impl-interpreter, impl-jit, impl-protocol, impl-parser). The
implementation is a string data structure (justifying impl-datastructure)
and is not an algorithm in the sense the taxonomy contemplates (impl-algorithm).
The crate declares unsafe impl Send/Sync for the representation but
spawns no threads and uses no concurrency primitives (uses-concurrency,
impl-concurrency).
unsafe is pervasive (165 sites) because the SSO scheme requires
hand-managed memory: a NonNull<u8> heap pointer with capacity packed into
spare bits of the discriminant word, reinterpretation between Repr,
HeapBuffer, InlineBuffer, and StaticStr via mem::transmute, manual
alloc::alloc/realloc/dealloc calls, raw ptr::copy[_nonoverlapping]
in replace_range_*, insert_str, and the integer-to-string fast path
adapted from libcore. Every unsafe block reviewed carries a SAFETY
comment naming the invariant it relies on (length bound, char boundary,
discriminant check, allocator layout). The invariants themselves are
narrow and locally checked: e.g. replace_range calls ensure_range
before the unsafe arms; InlineBuffer::new has debug_assert!(text.len() <= MAX_SIZE) paired with its safety contract; from_string checks the
capacity tag before reusing the String's buffer.
The test surface backs this. src/tests.rs alone defines ~80 functions
mixing test_case, quickcheck, and proptest over Unicode inputs,
random byte slices, and pathological lengths up to 18 MB (justifying
has-unit-tests and has-property-tests). The upstream fuzz/ workspace
defines a single Scenario enum (fuzz/src/actions.rs) covering every
mutating API — push, pop, replace_range, drain, insert, truncate,
split_off, retain, shrink_to, zeroize, repeat — with three harnesses
(libfuzzer, AFL, honggfuzz), justifying has-fuzz-tests. There is no
tests/ directory in the published crate or the upstream workspace; the
exhaustive in-tree suite plays the role of an integration test surface
(justifying has-integration-tests = false). CI runs miri with
-Zmiri-strict-provenance on every PR. Together these justify unsafe-safe,
unsafe-documented, unsafe-minimal, unsafe-tested,
datastructure-impl-safe, datastructure-impl-correct,
datastructure-impl-tested, and datastructure-impl-bounds (growth is the
documented 1.5x amortised; clone is documented O(n); no operation has an
adversarial degenerate case).
The codebase shows no signs of malicious intent — no obfuscation, no
data exfiltration, no telemetry — justifying is-benign.
No findings were raised.
Conclusion
compact_str is a high-quality, heavily-tested implementation of a
non-trivial unsafe data structure. The unsafe surface is large but
each block is small, locally justified, and exercised both by
property-based tests under miri and by three independent fuzzers. The
crate is suitable for production use.