Provide an easier-to-use rand API

src/rand.rs

@@ -72,6 +72,7 @@ where
 
 pub(crate) mod sealed {
     use crate::error;
+    use core::{mem, slice};
 
     pub trait SecureRandom: core::fmt::Debug {
         /// Fills `dest` with random bytes.
@@ -83,21 +84,58 @@ pub(crate) mod sealed {
         fn as_mut_bytes(&mut self) -> &mut [u8]; // `AsMut<[u8]>::as_mut`
     }
 
-    macro_rules! impl_random_arrays {
-        [ $($len:expr)+ ] => {
-            $(
-                impl RandomlyConstructable for [u8; $len] {
-                    #[inline]
-                    fn zero() -> Self { [0; $len] }
-
-                    #[inline]
-                    fn as_mut_bytes(&mut self) -> &mut [u8] { &mut self[..] }
-                }
-            )+
+    // Safety: in order for a type to be POD, it must satisfy the following criteria:
+    // - The type must be inhabited (ie not the never type)
+    // - All bit patterns must be valid
+    // - The type must have no padding
+    // - Any fields within the type must also be Pod
+    pub unsafe trait Pod: Sized {
+        #[inline]
+        fn zero() -> Self {
+            // Safe by the safety guarantees on the trait, notably that all bit patterns are valid
+            unsafe { mem::zeroed() }
         }
     }
 
-    impl_random_arrays![4 8 16 32 48 64 128 256];
+    macro_rules! impl_pod {
+        ($($type:ty),*) => {
+            $(
+                unsafe impl Pod for $type {}
+            )*
+        };
+    }
+
+    impl_pod!(i8, u8, i16, u16, i32, u32, i64, u64, i128, u128, isize, usize);
+
+    impl<T: Pod + Copy, const N: usize> RandomlyConstructable for [T; N] {
+        #[inline]
+        fn zero() -> Self {
+            // Note that the Copy bound on T is required in order to initialize this array
+            // without unsafe code.
+            [T::zero(); N]
+        }
+
+        #[inline]
+        fn as_mut_bytes(&mut self) -> &mut [u8] {
+            let data = self.as_mut_ptr();
+            let len = N * mem::size_of::<T>();
+
+            // Safety:
+            // - `data` is valid (aligned, non-null, non-dangling) for reads and writes of size
+            //   `len` bytes
+            //   - The entire memory range of this slice is in a single allocated object because
+            //     it came from another mutable slice
+            //   - `data` is not dangling and properly aligned for all types because, again, it was
+            //     derived from another mutable slice
+            // - Because T is POD, and because `len` is calculated based on the size of T,
+            //   `data` points to `len` initialized u8s
+            // - We co-opt the lifetime of `self`, so no borrow checker rules are broken
+            // - `len` is less than `isize::MAX` since it was derived from the size of `self`
+            unsafe {
+                slice::from_raw_parts_mut(data as *mut u8, len)
+            }
+        }
+    }
 }
 
 /// A type that can be returned by `ring::rand::generate()`.

tests/rand_tests.rs

@@ -66,6 +66,31 @@ fn test_system_random_lengths() {
     }
 }
 
+#[test]
+fn test_randomly_constructable() {
+    // Picked arbitrarily
+    const BY: u8 = 0x5A;
+
+    let rng = test::rand::FixedByteRandom {
+        byte: BY
+    };
+
+    assert!(rand::generate::<[u8; 0]>(&rng).is_ok());
+    assert!(rand::generate::<[u64; 0]>(&rng).is_ok());
+    assert!(rand::generate::<[usize; 0]>(&rng).is_ok());
+
+    let arr: [u8; 256] = rand::generate(&rng)
+        .unwrap()
+        .expose();
+    assert!(arr.iter().all(|&x| x == BY));
+
+    let arr: [u32; 256] = rand::generate(&rng)
+        .unwrap()
+        .expose();
+    // Endianness doesn't matter since all the bytes are the same
+    assert!(arr.iter().all(|&x| x.to_le_bytes() == [BY; 4]));
+}
+
 #[test]
 fn test_system_random_traits() {
     test::compile_time_assert_clone::<rand::SystemRandom>();