@@ -859,6 +859,15 @@ impl FusedIterator for Bytes<'_> {}
859859#[ unstable( feature = "kani" , issue = "none" ) ]
860860mod verify {
861861 use super :: * ;
862+
863+ // Helper function
864+ fn arbitrary_cstr ( slice : & [ u8 ] ) -> & CStr {
865+ let result = CStr :: from_bytes_until_nul ( & slice) ;
866+ kani:: assume ( result. is_ok ( ) ) ;
867+ let c_str = result. unwrap ( ) ;
868+ assert ! ( c_str. is_safe( ) ) ;
869+ c_str
870+ }
862871
863872 // pub const fn from_bytes_until_nul(bytes: &[u8]) -> Result<&CStr, FromBytesUntilNulError>
864873 #[ kani:: proof]
@@ -875,7 +884,8 @@ mod verify {
875884 assert ! ( c_str. is_safe( ) ) ;
876885 }
877886 }
878-
887+
888+ // pub const fn count_bytes(&self) -> usize
879889 #[ kani:: proof]
880890 #[ kani:: unwind( 32 ) ]
881891 fn check_count_bytes ( ) {
@@ -897,5 +907,38 @@ mod verify {
897907 let c_str = CStr :: from_bytes_until_nul ( & bytes) . unwrap ( ) ;
898908 // Verify that count_bytes matches the adjusted length
899909 assert_eq ! ( c_str. count_bytes( ) , len) ;
910+ assert ! ( c_str. is_safe( ) ) ;
911+ }
912+
913+ // pub const fn to_bytes(&self) -> &[u8]
914+ #[ kani:: proof]
915+ #[ kani:: unwind( 32 ) ]
916+ fn check_to_bytes ( ) {
917+ const MAX_SIZE : usize = 32 ;
918+ let string: [ u8 ; MAX_SIZE ] = kani:: any ( ) ;
919+ let slice = kani:: slice:: any_slice_of_array ( & string) ;
920+ let c_str = arbitrary_cstr ( slice) ;
921+
922+ let bytes = c_str. to_bytes ( ) ;
923+ let end_idx = bytes. len ( ) ;
924+ // Comparison does not include the null byte
925+ assert_eq ! ( bytes, & slice[ ..end_idx] ) ;
926+ assert ! ( c_str. is_safe( ) ) ;
927+ }
928+
929+ // pub const fn to_bytes_with_nul(&self) -> &[u8]
930+ #[ kani:: proof]
931+ #[ kani:: unwind( 33 ) ]
932+ fn check_to_bytes_with_nul ( ) {
933+ const MAX_SIZE : usize = 32 ;
934+ let string: [ u8 ; MAX_SIZE ] = kani:: any ( ) ;
935+ let slice = kani:: slice:: any_slice_of_array ( & string) ;
936+ let c_str = arbitrary_cstr ( slice) ;
937+
938+ let bytes = c_str. to_bytes_with_nul ( ) ;
939+ let end_idx = bytes. len ( ) ;
940+ // Comparison includes the null byte
941+ assert_eq ! ( bytes, & slice[ ..end_idx] ) ;
942+ assert ! ( c_str. is_safe( ) ) ;
900943 }
901944}
0 commit comments