LeWrapper is unsound

[qwandor]

Several unsafe zerocopy traits are implemented unconditionally for LeWrapper, without any guarantee that the contents of the wrapper actually fulfils the requirements of these traits. Safe code somewhere else could implement VmediaType for some arbitrary type which isn't safe to convert to bytes (e.g. because it has padding), wrap an instance of the type in LeWrapper and then convert it to bytes with not unsafe block. This allows undefined behaviour in safe code, so is unsound.

The best solution is for LeWrapper<T> to only implement zerocopy traits if T implements the corresponding trait. This may require a change to v4l2r to implement the required traits on its bindgen-generated types. Alternatively VmediaType could be made an unsafe trait, with a safety requirement corresponding to those of the various zerocopy traits. Then it is up to the implementer of VmediaType to guarantee the requirements.

[Gnurou]

Yeah I'm really not happy about LeWrapper. I think making it unsafe is probably the easiest solution short-term. I'd prefer v4l2r types to derive the adequate zerocopy traits directly, but that would impose a specific version of zerocopy that its users might not be ready to use (e.g. 0.8 vs 0.7)...

[qwandor]

I think you'll need to make VmediaType unsafe, as LeWrapper is a struct not a trait.