Clippy lint · Restriction · checked with Clippy 0.1.99

clippy::multiple_unsafe_ops_per_block: this `unsafe` block contains 2 unsafe operations, expected only one

What it meansChecks for unsafe blocks that contain more than one unsafe operation. It is in the restriction group and off by default.

What you see

warning: this `unsafe` block contains 2 unsafe operations, expected only one
  --> main.rs:12:5
   |
12 |     unsafe { char::from_u32_unchecked(*ptr.cast::<u32>()) }
   |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |
note: raw pointer dereference occurs here
  --> main.rs:12:39
   |
12 |     unsafe { char::from_u32_unchecked(*ptr.cast::<u32>()) }
   |                                       ^^^^^^^^^^^^^^^^^^
note: unsafe function call occurs here
  --> main.rs:12:14
   |
12 |     unsafe { char::from_u32_unchecked(*ptr.cast::<u32>()) }
   |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   = help: for further information visit https://rust-lang.github.io/rust-clippy/stable/index.html#multiple_unsafe_ops_per_block
   = note: requested on the command line with `-W clippy::multiple-unsafe-ops-per-block`

Real output of Clippy 0.1.99 (Rust 1.99) on the example below. Names and line numbers in yours will differ.

Does it matter?

Combined with undocumented_unsafe_blocks, this lint ensures that each unsafe operation must be independently justified. Combined with unused_unsafe, this lint also ensures elimination of unnecessary unsafe blocks through refactoring.

Lints that forbid language features for specific codebases (no unwrap, no indexing...). Off by default; pick them one by one, never the whole group.

How to fix it

Clippy does not fix this one automatically. Change the code by hand:

Flagged

/// Reads a `char` from the given pointer.
///
/// # Safety
///
/// `ptr` must point to four consecutive, initialized bytes which
/// form a valid `char` when interpreted in the native byte order.
fn read_char(ptr: *const u8) -> char {
    // SAFETY: The caller has guaranteed that the value pointed
    // to by `bytes` is a valid `char`.
    unsafe { char::from_u32_unchecked(*ptr.cast::<u32>()) }
}

Write this instead

/// Reads a `char` from the given pointer.
///
/// # Safety
///
/// - `ptr` must be 4-byte aligned, point to four consecutive
///   initialized bytes, and be valid for reads of 4 bytes.
/// - The bytes pointed to by `ptr` must represent a valid
///   `char` when interpreted in the native byte order.
fn read_char(ptr: *const u8) -> char {
    // SAFETY: `ptr` is 4-byte aligned, points to four consecutive
    // initialized bytes, and is valid for reads of 4 bytes.
    let int_value = unsafe { *ptr.cast::<u32>() };

    // SAFETY: The caller has guaranteed that the four bytes
    // pointed to by `bytes` represent a valid `char`.
    unsafe { char::from_u32_unchecked(int_value) }
}

Turn it off, or on

It is off by default. To use it, set it to warn or deny:

Whole crate (Cargo.toml)

[lints.clippy]
multiple_unsafe_ops_per_block = "warn"

In code

#![warn(clippy::multiple_unsafe_ops_per_block)]

One run

cargo clippy -- -W clippy::multiple-unsafe-ops-per-block

The [lints] table needs Rust 1.74 or newer. In a workspace, put it under [workspace.lints.clippy] and add [lints] workspace = true to each member.

Restrictiongroup

allowdefault level

nofixed by cargo clippy --fix

1.69.0added in Rust

Clippy's own documentation

What it does

Checks for unsafe blocks that contain more than one unsafe operation.

Why restrict this?

Combined with undocumented_unsafe_blocks, this lint ensures that each unsafe operation must be independently justified. Combined with unused_unsafe, this lint also ensures elimination of unnecessary unsafe blocks through refactoring.

Example

/// Reads a `char` from the given pointer.
///
/// # Safety
///
/// `ptr` must point to four consecutive, initialized bytes which
/// form a valid `char` when interpreted in the native byte order.
fn read_char(ptr: *const u8) -> char {
    // SAFETY: The caller has guaranteed that the value pointed
    // to by `bytes` is a valid `char`.
    unsafe { char::from_u32_unchecked(*ptr.cast::<u32>()) }
}

Use instead:

/// Reads a `char` from the given pointer.
///
/// # Safety
///
/// - `ptr` must be 4-byte aligned, point to four consecutive
///   initialized bytes, and be valid for reads of 4 bytes.
/// - The bytes pointed to by `ptr` must represent a valid
///   `char` when interpreted in the native byte order.
fn read_char(ptr: *const u8) -> char {
    // SAFETY: `ptr` is 4-byte aligned, points to four consecutive
    // initialized bytes, and is valid for reads of 4 bytes.
    let int_value = unsafe { *ptr.cast::<u32>() };

    // SAFETY: The caller has guaranteed that the four bytes
    // pointed to by `bytes` represent a valid `char`.
    unsafe { char::from_u32_unchecked(int_value) }
}

Notes

Unsafe operations only count towards the total for the innermost enclosing unsafe block.
Each call to a macro expanding to unsafe operations count for one unsafe operation.
Taking a raw pointer to a union field is always safe and will not be considered unsafe by this lint, even when linting code written with a specified Rust version of 1.91 or earlier (which required using an unsafe block).

From the Clippy lint list (0.1.99), part of the Rust project, MIT or Apache-2.0. Official entry.

Up next

Also worth your time

Did this answer your question?