Simplify and harden some libyaml consistency checks

Author: featherbread

src/yaml/chunker/parser.rs

@@ -126,24 +126,22 @@ where
 		const READ_SUCCESS: i32 = 1;
 		const READ_FAILURE: i32 = 0;
 
-		// Let's knock out this particular class of UB across the board.
+		// These should never fail, but let's be extra safe. Ideally we would
+		// panic in cases as degenerate as this, but I want to model a scenario
+		// where we're using the true libyaml through FFI and can't unwind.
 		if read_state.is_null() || buffer.is_null() || size_read.is_null() {
 			return READ_FAILURE;
 		}
+		let Ok(buffer_size) = usize::try_from(buffer_size) else {
+			return READ_FAILURE;
+		};
 
 		// SAFETY: self.read_state_mut() is the only other dereference of the
 		// read_state; see its comment explaining how it's mutually exclusive
 		// with running the parser. The lifetime here lasts through the end of
 		// this function, i.e. before the parser is finished.
 		let read_state = unsafe { &mut *read_state.cast::<ReadState<R>>() };
 
-		// We assume libyaml is implemented correctly, and won't pass a buffer
-		// size larger than can exist in memory. (Since unsafe_libyaml is
-		// actually Rust we could use usize::try_from and unwrap, but panicking
-		// wouldn't be okay in the true FFI scenario I want to model.)
-		#[allow(clippy::cast_possible_truncation)]
-		let buffer_size = buffer_size as usize;
-
 		// libyaml is not guaranteed to initialize its buffer prior to the first
 		// read. It would be instant Undefined Behavior to slice that buffer,
 		// and unsound to expose it to a safe Read impl, so we need to bounce