fix(fspy): keep exec arguments and environment out of libc malloc

Cargo.toml

@@ -142,7 +142,6 @@ fspy_nostd_alloc = { path = "crates/fspy_nostd_alloc" }
 similar = "3.0.0"
 smallvec = "2.0.0-alpha.12"
 static_cell = "2"
-stackalloc = "1.2.1"
 supports-color = "3.0.1"
 syn = "2"
 syscalls = { version = "0.8.0", default-features = false }

crates/fspy/Cargo.toml

@@ -8,7 +8,6 @@ publish = false
 [dependencies]
 allocator-api2 = { workspace = true, features = ["alloc"] }
 wincode = { workspace = true }
-bstr = { workspace = true, features = ["alloc", "std"] }
 bumpalo = { workspace = true, features = ["allocator-api2", "collections"] }
 derive_more = { workspace = true, features = ["debug"] }
 vt_materialized_artifact = { workspace = true }

crates/fspy/src/command.rs

@@ -5,7 +5,9 @@ use std::{
 };
 
 #[cfg(unix)]
-use fspy_shared_unix::exec::Exec;
+use allocator_api2::alloc::Global;
+#[cfg(unix)]
+use fspy_shared_unix::exec::{Exec, to_vec_in};
 use rustc_hash::FxHashMap;
 use tokio::process::Command as TokioCommand;
 use tokio_util::sync::CancellationToken;
@@ -53,44 +55,44 @@ impl Command {
 
     #[cfg(unix)]
     #[must_use]
-    pub(crate) fn get_exec(&self) -> Exec {
-        use std::{
-            iter::once,
-            os::unix::ffi::{OsStrExt, OsStringExt},
-        };
-
-        use bstr::{BString, ByteSlice as _};
-        let arg0 =
-            BString::from(self.arg0.clone().unwrap_or_else(|| self.program.clone()).into_vec());
+    pub(crate) fn get_exec(&self) -> Exec<Global> {
+        use std::{iter::once, os::unix::ffi::OsStrExt};
+
+        let arg0 = self.arg0.as_ref().unwrap_or(&self.program);
         Exec {
-            program: self.program.as_bytes().into(),
+            program: to_vec_in(self.program.as_bytes(), Global),
             args: once(arg0)
-                .chain(self.args.iter().map(|arg| arg.as_bytes().as_bstr().to_owned()))
+                .chain(&self.args)
+                .map(|arg| to_vec_in(arg.as_bytes(), Global))
                 .collect(),
             envs: self
                 .envs
                 .iter()
                 .map(|(name, value)| {
-                    (name.inner().as_bytes().into(), Some(value.as_bytes().into()))
+                    (
+                        to_vec_in(name.inner().as_bytes(), Global),
+                        Some(to_vec_in(value.as_bytes(), Global)),
+                    )
                 })
                 .collect(),
         }
     }
 
     #[cfg(unix)]
-    pub(crate) fn set_exec(&mut self, mut exec: Exec) {
-        use std::os::unix::ffi::OsStringExt;
+    pub(crate) fn set_exec(&mut self, mut exec: Exec<Global>) {
+        use std::os::unix::ffi::OsStrExt;
 
-        self.program = OsString::from_vec(exec.program.into());
-        self.arg0 = Some(OsString::from_vec(exec.args.remove(0).into()));
-        self.args = exec.args.into_iter().map(|arg| OsString::from_vec(arg.into())).collect();
+        let to_os_string = |bytes: &[u8]| OsStr::from_bytes(bytes).to_os_string();
+        self.program = to_os_string(&exec.program);
+        self.arg0 = Some(to_os_string(&exec.args.remove(0)));
+        self.args = exec.args.iter().map(|arg| to_os_string(arg)).collect();
         self.envs = exec
             .envs
-            .into_iter()
+            .iter()
             .map(|(name, value)| {
                 (
-                    EnvName::new(OsString::from_vec(name.into())),
-                    OsString::from_vec(value.unwrap_or_default().into()),
+                    EnvName::new(to_os_string(name)),
+                    to_os_string(value.as_deref().unwrap_or_default()),
                 )
             })
             .collect();

crates/fspy_client_unix/src/lib.rs

@@ -87,32 +87,31 @@ impl<'a> Client<'a> {
         ipc_sender.send(&mode.with_path(path.into()));
     }
 
-    /// Resolves and reports an exec before forwarding its transformed arguments.
+    /// Resolves and reports an exec, returning the transformed arguments to
+    /// forward and what to run before forwarding them.
     ///
     /// # Safety
     ///
     /// `raw_exec` must contain the valid C strings and pointer arrays required
-    /// by [`RawExec::to_exec`]. The callback must not retain pointers from the
-    /// transformed `RawExec` after it returns.
+    /// by [`RawExec::to_exec`]. The returned `RawExec` points into
+    /// `allocator`, and must not be used after `allocator` is dropped.
     ///
     /// # Errors
     ///
-    /// Returns errors from exec resolution, platform preparation, or the
-    /// forwarding callback.
-    pub unsafe fn handle_exec<R>(
+    /// Returns errors from exec resolution or platform preparation.
+    pub unsafe fn handle_exec<A: Allocator>(
         &self,
         config: ExecResolveConfig,
         raw_exec: RawExec,
-        allocator: impl Allocator,
-        f: impl FnOnce(RawExec, Option<PreExec>) -> nix::Result<R>,
-    ) -> nix::Result<R> {
+        allocator: &A,
+    ) -> nix::Result<(RawExec, Option<PreExec>)> {
         // SAFETY: raw_exec contains valid pointers to C strings and
         // null-terminated arrays, as provided by the caller.
-        let mut exec = unsafe { raw_exec.to_exec() };
+        let mut exec = unsafe { raw_exec.to_exec(allocator) };
         let pre_exec = handle_exec(&mut exec, config, &self.encoded_payload, |path| {
             self.send(AccessMode::Read, path);
         })?;
-        RawExec::from_exec(exec, allocator, |raw_command| f(raw_command, pre_exec))
+        Ok((RawExec::from_exec(exec), pre_exec))
     }
 
     /// Resolves and reports one intercepted file access.