For review

arrow-buffer/src/buffer/immutable.rs

@@ -74,14 +74,9 @@ impl Buffer {
     /// Returns the offset, in bytes, of `Self::ptr` to `Self::data`
     ///
     /// self.ptr and self.data can be different after slicing or advancing the buffer.
-    ///
-    /// # Safety
-    ///
-    /// This function is unsafe as it uses unsafe function `offset_from`. Under certain
-    /// conditions, this function can cause undefined behavior. See the documentation of
-    /// `offset_from` for more information.
-    pub unsafe fn ptr_offset(&self) -> usize {
-        self.ptr.offset_from(self.data.ptr().as_ptr()) as usize
+    pub fn ptr_offset(&self) -> usize {
+        // Safety: `ptr` is always in bounds of `data`.
+        unsafe { self.ptr.offset_from(self.data.ptr().as_ptr()) as usize }
     }
 
     /// Returns the pointer to the start of the buffer without the offset.

arrow-data/src/ffi.rs

@@ -139,10 +139,7 @@ impl FFI_ArrowArray {
                 // the consumer to calculate incorrect length of data buffer (buffer 1).
                 // We need to get the offset of the offset buffer and fill it in
                 // the `FFI_ArrowArray` offset field.
-                Some(unsafe {
-                    let b = &data.buffers()[0];
-                    b.ptr_offset() / std::mem::size_of::<i32>()
-                })
+                Some(&data.buffers()[0].ptr_offset() / std::mem::size_of::<i32>())
             }
             DataType::LargeUtf8 | DataType::LargeBinary => {
                 // Offset buffer is possible a slice of the buffer.