castrum 0.9.6 → 0.9.8

package/rust/ffi/crypto.rs

@@ -9,7 +9,7 @@ use pbkdf2::pbkdf2_hmac;
 use sha2::Sha256;
 use std::slice;
 
-use super::util::{aead_alg, cstring_return, hmac_key_cached, panic_guard};
+use super::util::{aead_alg, cstring_return, panic_guard, with_hmac_key_cached};
 
 /// HMAC-SHA256 verify → 1/0 (constant-time, hex sig compared after
 /// whitespace-trim — mirrors the napi scalar path).
@@ -32,8 +32,9 @@ pub unsafe extern "C" fn castrum_hmac_sha256_verify(
     let Some(sig_bytes) = crate::util::bytes::hex_decode_32(sig_t) else {
         return 0;
     };
-    let k = hmac_key_cached(slice::from_raw_parts(key, klen));
-    u8::from(hmac::verify(&k, slice::from_raw_parts(data, dlen), &sig_bytes).is_ok())
+    with_hmac_key_cached(slice::from_raw_parts(key, klen), |k| {
+        u8::from(hmac::verify(k, slice::from_raw_parts(data, dlen), &sig_bytes).is_ok())
+    })
 }
 
 /// CSRF constant-time verify → 1/0 (token format `<64-hex>.<64-hex>`).
@@ -50,11 +51,12 @@ pub unsafe extern "C" fn castrum_csrf_verify(
     if token.is_null() || secret.is_null() {
         return 0;
     }
-    let k = hmac_key_cached(slice::from_raw_parts(secret, slen));
-    u8::from(crate::crypto::csrf::csrf_verify_with_key(
-        slice::from_raw_parts(token, tlen),
-        &k,
-    ))
+    with_hmac_key_cached(slice::from_raw_parts(secret, slen), |k| {
+        u8::from(crate::crypto::csrf::csrf_verify_with_key(
+            slice::from_raw_parts(token, tlen),
+            k,
+        ))
+    })
 }
 
 /// Argon2id password verify → 1/0 (constant-time internally).
@@ -71,10 +73,17 @@ pub unsafe extern "C" fn castrum_password_verify(
     if password.is_null() || phc.is_null() {
         return 0;
     }
-    u8::from(crate::crypto::argon2::verify_password(
-        slice::from_raw_parts(password, plen),
-        slice::from_raw_parts(phc, phclen),
-    ))
+    // The argon2 core allocates/derives — a panic must become 0, not unwind
+    // through `extern "C"`.
+    panic_guard(
+        || {
+            u8::from(crate::crypto::argon2::verify_password(
+                slice::from_raw_parts(password, plen),
+                slice::from_raw_parts(phc, phclen),
+            ))
+        },
+        0,
+    )
 }
 
 /// bcrypt password verify → 1/0 (PHC `$2b$` string).
@@ -95,10 +104,15 @@ pub unsafe extern "C" fn castrum_password_verify_bcrypt(
     if password.is_null() || hash.is_null() {
         return 0;
     }
-    let Ok(h) = std::ffi::CStr::from_ptr(hash).to_str() else {
-        return 0;
-    };
-    u8::from(bcrypt::verify(slice::from_raw_parts(password, plen), h).unwrap_or(false))
+    panic_guard(
+        || {
+            let Ok(h) = std::ffi::CStr::from_ptr(hash).to_str() else {
+                return 0;
+            };
+            u8::from(bcrypt::verify(slice::from_raw_parts(password, plen), h).unwrap_or(false))
+        },
+        0,
+    )
 }
 
 /// HMAC-SHA256 hex (64 chars) into `out`.
@@ -117,8 +131,9 @@ pub unsafe extern "C" fn castrum_hmac_sha256(
     if key.is_null() || data.is_null() || out.is_null() || out_cap < 64 {
         return 0;
     }
-    let k = hmac_key_cached(slice::from_raw_parts(key, klen));
-    let tag = hmac::sign(&k, slice::from_raw_parts(data, dlen));
+    let tag = with_hmac_key_cached(slice::from_raw_parts(key, klen), |k| {
+        hmac::sign(k, slice::from_raw_parts(data, dlen))
+    });
     let mut hex = [0u8; 64];
     crate::util::bytes::hex_encode_32(tag.as_ref(), &mut hex);
     slice::from_raw_parts_mut(out, 64).copy_from_slice(&hex);
@@ -141,9 +156,10 @@ pub unsafe extern "C" fn castrum_sign_cookie(
         return std::ptr::null();
     }
     let v = slice::from_raw_parts(value, vlen);
-    let key = hmac_key_cached(slice::from_raw_parts(secret, slen));
     cstring_return(vlen + 65, |out| {
-        crate::crypto::cookie_sign::sign_cookie_into(v, &key, out)
+        with_hmac_key_cached(slice::from_raw_parts(secret, slen), |key| {
+            crate::crypto::cookie_sign::sign_cookie_into(v, key, out)
+        })
     })
 }
 
@@ -173,9 +189,14 @@ pub unsafe extern "C" fn castrum_sign_cookie_into(
         return needed;
     }
     let v = slice::from_raw_parts(value, vlen);
-    let key = hmac_key_cached(slice::from_raw_parts(secret, slen));
-    crate::crypto::cookie_sign::sign_cookie_into(v, &key, slice::from_raw_parts_mut(out, out_cap))
-        .unwrap_or_default()
+    with_hmac_key_cached(slice::from_raw_parts(secret, slen), |key| {
+        crate::crypto::cookie_sign::sign_cookie_into(
+            v,
+            key,
+            slice::from_raw_parts_mut(out, out_cap),
+        )
+    })
+    .unwrap_or_default()
 }
 
 /// Verify a signed cookie → the value without its signature, returned as a
@@ -195,9 +216,10 @@ pub unsafe extern "C" fn castrum_verify_cookie(
         return std::ptr::null();
     }
     let s = slice::from_raw_parts(signed, slen);
-    let key = hmac_key_cached(slice::from_raw_parts(secret, klen));
     cstring_return(slen, |out| {
-        crate::crypto::cookie_sign::verify_cookie_into(s, &key, out)
+        with_hmac_key_cached(slice::from_raw_parts(secret, klen), |key| {
+            crate::crypto::cookie_sign::verify_cookie_into(s, key, out)
+        })
     })
 }
 
@@ -224,7 +246,6 @@ pub unsafe extern "C" fn castrum_verify_cookie_into(
         return 0;
     }
     let s = slice::from_raw_parts(signed, slen);
-    let key = hmac_key_cached(slice::from_raw_parts(secret, klen));
     // The value is a prefix of `signed` (everything before the last `.`), so
     // `slen` is always a sufficient bound — needed-size only differs when the
     // caller passed less.
@@ -237,8 +258,14 @@ pub unsafe extern "C" fn castrum_verify_cookie_into(
         }
         return slen;
     }
-    crate::crypto::cookie_sign::verify_cookie_into(s, &key, slice::from_raw_parts_mut(out, out_cap))
-        .unwrap_or_default()
+    with_hmac_key_cached(slice::from_raw_parts(secret, klen), |key| {
+        crate::crypto::cookie_sign::verify_cookie_into(
+            s,
+            key,
+            slice::from_raw_parts_mut(out, out_cap),
+        )
+    })
+    .unwrap_or_default()
 }
 
 /// CSRF token (`<64-hex(rnd)>.<64-hex(sig)>`, 129 bytes) returned as a
@@ -254,7 +281,6 @@ pub unsafe extern "C" fn castrum_csrf_token(
     if secret.is_null() {
         return std::ptr::null();
     }
-    let k = hmac_key_cached(slice::from_raw_parts(secret, slen));
     let mut rnd = [0u8; 32];
     if getrandom::fill(&mut rnd).is_err() {
         return std::ptr::null();
@@ -262,7 +288,10 @@ pub unsafe extern "C" fn castrum_csrf_token(
     let mut rnd_hex = [0u8; 64];
     crate::util::bytes::hex_encode(&rnd, &mut rnd_hex);
     let mut sig_hex = [0u8; 64];
-    crate::util::bytes::hex_encode(hmac::sign(&k, &rnd_hex).as_ref(), &mut sig_hex);
+    let signed = with_hmac_key_cached(slice::from_raw_parts(secret, slen), |k| {
+        hmac::sign(k, &rnd_hex)
+    });
+    crate::util::bytes::hex_encode(signed.as_ref(), &mut sig_hex);
     cstring_return(129, |out| {
         out[..64].copy_from_slice(&rnd_hex);
         out[64] = b'.';
@@ -291,7 +320,6 @@ pub unsafe extern "C" fn castrum_csrf_token_into(
     if out_cap < 129 {
         return 129;
     }
-    let k = hmac_key_cached(slice::from_raw_parts(secret, slen));
     let mut rnd = [0u8; 32];
     if getrandom::fill(&mut rnd).is_err() {
         return 0;
@@ -299,7 +327,10 @@ pub unsafe extern "C" fn castrum_csrf_token_into(
     let mut rnd_hex = [0u8; 64];
     crate::util::bytes::hex_encode(&rnd, &mut rnd_hex);
     let mut sig_hex = [0u8; 64];
-    crate::util::bytes::hex_encode(hmac::sign(&k, &rnd_hex).as_ref(), &mut sig_hex);
+    let signed = with_hmac_key_cached(slice::from_raw_parts(secret, slen), |k| {
+        hmac::sign(k, &rnd_hex)
+    });
+    crate::util::bytes::hex_encode(signed.as_ref(), &mut sig_hex);
     let o = slice::from_raw_parts_mut(out, 129);
     o[..64].copy_from_slice(&rnd_hex);
     o[64] = b'.';
@@ -625,6 +656,58 @@ pub unsafe extern "C" fn castrum_random_token_into(
 
 // ── Session envelope (fused JSON + HMAC) ────────────────────────────
 
+/// Shared tail of both seal entry points: `None` (empty id/secret, or a panic)
+/// → null pointer, otherwise clone the sealed token into the engine's
+/// per-thread cstring buffer. Extracted so the cstring and byte forms cannot
+/// diverge — the byte form exists only to change how the INPUTS cross.
+fn sealed_to_cstr(sealed: Option<Vec<u8>>) -> *const std::os::raw::c_char {
+    let Some(tok) = sealed else {
+        return std::ptr::null();
+    };
+    super::util::cstring_return(tok.len(), move |buf| {
+        if buf.len() < tok.len() {
+            return None;
+        }
+        buf[..tok.len()].copy_from_slice(&tok);
+        Some(tok.len())
+    })
+}
+
+/// Shared tail of both open entry points: pack the extracted envelope into the
+/// caller's buffer as `[u8 ok=1][i64 exp][u32 idLen][id][u32 dataLen][dataJson]`,
+/// or report the EXACT size required when `out_cap` is too small. `None` (bad
+/// signature / malformed envelope) → `0`. Never returns `0` on a valid call.
+///
+/// # Safety
+/// `out` must be valid for writes up to `out_cap`; the caller null-checks it.
+unsafe fn pack_open_result(
+    opened: Option<(i64, Vec<u8>, Vec<u8>)>,
+    out: *mut u8,
+    out_cap: usize,
+) -> usize {
+    let Some((exp, id, data)) = opened else {
+        return 0;
+    };
+    // Layout size: 1 + 8 + 4+id + 4+data
+    let need = 1 + 8 + 4 + id.len() + 4 + data.len();
+    if need > out_cap {
+        return need;
+    }
+    let o = slice::from_raw_parts_mut(out, need);
+    o[0] = 1;
+    o[1..9].copy_from_slice(&exp.to_le_bytes());
+    let id_len = id.len() as u32;
+    o[9..13].copy_from_slice(&id_len.to_le_bytes());
+    let mut p = 13usize;
+    o[p..p + id.len()].copy_from_slice(&id);
+    p += id.len();
+    let d_len = data.len() as u32;
+    o[p..p + 4].copy_from_slice(&d_len.to_le_bytes());
+    p += 4;
+    o[p..p + data.len()].copy_from_slice(&data);
+    need
+}
+
 /// Seal a session envelope NATIVELY: build
 /// `{"id":"…","data":<data_json>,"exp":exp}` and HMAC-sign it into the
 /// `payload.<64-hex>` cookie token — ONE crossing replaces the JS
@@ -650,16 +733,7 @@ pub unsafe extern "C" fn castrum_session_seal(
         || crate::crypto::session::seal_core(id_b, data_b, exp_secs, sec_b),
         None,
     );
-    let Some(tok) = sealed else {
-        return std::ptr::null();
-    };
-    super::util::cstring_return(tok.len(), move |buf| {
-        if buf.len() < tok.len() {
-            return None;
-        }
-        buf[..tok.len()].copy_from_slice(&tok);
-        Some(tok.len())
-    })
+    sealed_to_cstr(sealed)
 }
 
 /// Open a sealed session token: verify the HMAC and extract the envelope in
@@ -684,25 +758,72 @@ pub unsafe extern "C" fn castrum_session_open(
     let tok = std::ffi::CStr::from_ptr(token).to_bytes();
     let sec = std::ffi::CStr::from_ptr(secret).to_bytes();
     let opened = panic_guard(|| crate::crypto::session::open_core(tok, sec), None);
-    let Some((exp, id, data)) = opened else {
+    pack_open_result(opened, out, out_cap)
+}
+
+/// Byte-arg sibling of `castrum_session_seal`: same core, same wire format, but
+/// every input crosses as `(ptr, len)` instead of a `cstring` ARG.
+///
+/// Per `docs/FFI_BUN_GUIDE.md` §6.1 there are two reasons, and only the second
+/// cannot be worked around:
+/// 1. a `cstring` ARG costs the engine a transcode into a call-scoped
+///    NUL-terminated buffer (~80ns per arg through the public surface vs ~37ns
+///    for the byte path);
+/// 2. an embedded `U+0000` SILENTLY TRUNCATES the value before Rust sees it.
+///    `id` and `data_json` are user-derived (the id is escaped by
+///    `seal_core`, which only makes sense if it may contain arbitrary bytes),
+///    so a session id carrying a NUL would be sealed under its truncated form.
+///    This form carries the exact length and cannot be truncated.
+///
+/// # Safety
+/// `id`/`data_json`/`secret` must be valid for reads of their stated lengths;
+/// null pointers are rejected (→ null).
+#[no_mangle]
+pub unsafe extern "C" fn castrum_session_seal_bytes(
+    id: *const u8,
+    id_len: usize,
+    data_json: *const u8,
+    data_len: usize,
+    exp_secs: i64,
+    secret: *const u8,
+    secret_len: usize,
+) -> *const std::os::raw::c_char {
+    if id.is_null() || data_json.is_null() || secret.is_null() {
+        return std::ptr::null();
+    }
+    let id_b = slice::from_raw_parts(id, id_len);
+    let data_b = slice::from_raw_parts(data_json, data_len);
+    let sec_b = slice::from_raw_parts(secret, secret_len);
+    let sealed = super::util::panic_guard(
+        || crate::crypto::session::seal_core(id_b, data_b, exp_secs, sec_b),
+        None,
+    );
+    sealed_to_cstr(sealed)
+}
+
+/// Byte-arg sibling of `castrum_session_open`: `token`/`secret` cross as
+/// `(ptr, len)`; the output layout and the needed-size convention are identical
+/// to `castrum_session_open` (`0` = bad signature / malformed). Saves the
+/// per-arg transcode and, unlike the `cstring` form, cannot be truncated by an
+/// embedded `U+0000` in the token.
+///
+/// # Safety
+/// `token`/`secret` must be valid for reads of their stated lengths; `out` must
+/// be valid for writes up to `out_cap`. Null pointers → 0.
+#[no_mangle]
+pub unsafe extern "C" fn castrum_session_open_bytes(
+    token: *const u8,
+    token_len: usize,
+    secret: *const u8,
+    secret_len: usize,
+    out: *mut u8,
+    out_cap: usize,
+) -> usize {
+    if token.is_null() || secret.is_null() || out.is_null() {
         return 0;
-    };
-    // Layout size: 1 + 8 + 4+id + 4+data
-    let need = 1 + 8 + 4 + id.len() + 4 + data.len();
-    if need > out_cap {
-        return need;
     }
-    let o = slice::from_raw_parts_mut(out, need);
-    o[0] = 1;
-    o[1..9].copy_from_slice(&exp.to_le_bytes());
-    let id_len = id.len() as u32;
-    o[9..13].copy_from_slice(&id_len.to_le_bytes());
-    let mut p = 13usize;
-    o[p..p + id.len()].copy_from_slice(&id);
-    p += id.len();
-    let d_len = data.len() as u32;
-    o[p..p + 4].copy_from_slice(&d_len.to_le_bytes());
-    p += 4;
-    o[p..p + data.len()].copy_from_slice(&data);
-    need
+    let tok = slice::from_raw_parts(token, token_len);
+    let sec = slice::from_raw_parts(secret, secret_len);
+    let opened = panic_guard(|| crate::crypto::session::open_core(tok, sec), None);
+    pack_open_result(opened, out, out_cap)
 }

package/rust/ffi/hashing.rs

@@ -7,6 +7,8 @@
 use std::ptr;
 use std::slice;
 
+use super::util::panic_guard;
+
 /// CRC32 over `data[0..len]`. Returns the CRC-32 checksum.
 ///
 /// # Safety
@@ -179,19 +181,22 @@ pub unsafe extern "C" fn castrum_json_sum_ids(
     if data.is_null() || out.is_null() {
         return 0;
     }
-    match crate::json::json_ops::json_sum_ids_bytes(slice::from_raw_parts(data, len)) {
-        Ok(sum) if out_len >= 9 => {
-            *out = 1;
-            ptr::copy_nonoverlapping(sum.to_le_bytes().as_ptr(), out.add(1), 8);
-            9
-        }
-        Ok(_) => 9, // too-small buffer → exact required size (growExact)
-        Err(_) if out_len >= 1 => {
-            *out = 0;
-            1
-        }
-        Err(_) => 1, // too-small buffer → exact required size
-    }
+    panic_guard(
+        || match crate::json::json_ops::json_sum_ids_bytes(slice::from_raw_parts(data, len)) {
+            Ok(sum) if out_len >= 9 => {
+                *out = 1;
+                ptr::copy_nonoverlapping(sum.to_le_bytes().as_ptr(), out.add(1), 8);
+                9
+            }
+            Ok(_) => 9, // too-small buffer → exact required size (growExact)
+            Err(_) if out_len >= 1 => {
+                *out = 0;
+                1
+            }
+            Err(_) => 1, // too-small buffer → exact required size
+        },
+        0,
+    )
 }
 
 /// Escape JS-RegExp metacharacters (`\ . * + ? ^ $ { } | ( ) [ ]`) in
@@ -212,13 +217,18 @@ pub unsafe extern "C" fn castrum_regex_escape(
     if data.is_null() || out.is_null() {
         return 0;
     }
-    let input = slice::from_raw_parts(data, len);
-    let needed = crate::util::text::regex_escape_len(input);
-    if needed > out_cap {
-        return needed;
-    }
-    crate::util::text::regex_escape_write(input, slice::from_raw_parts_mut(out, out_cap));
-    needed
+    panic_guard(
+        || {
+            let input = slice::from_raw_parts(data, len);
+            let needed = crate::util::text::regex_escape_len(input);
+            if needed > out_cap {
+                return needed;
+            }
+            crate::util::text::regex_escape_write(input, slice::from_raw_parts_mut(out, out_cap));
+            needed
+        },
+        0,
+    )
 }
 
 /// String-input / string-return sibling of [`castrum_regex_escape`]: the
@@ -269,17 +279,22 @@ pub unsafe extern "C" fn castrum_hex_validate_batch_str(
     if ids.is_null() || out.is_null() {
         return 0;
     }
-    let input = std::ffi::CStr::from_ptr(ids).to_bytes();
-    let needed = crate::util::validation::hex_batch_count(input);
-    if needed > out_cap {
-        return needed;
-    }
-    let mut buf = Vec::with_capacity(needed);
-    match crate::util::validation::hex_batch_valid_into(input, width as usize, &mut buf) {
-        Ok(()) if buf.len() <= out_cap => {
-            slice::from_raw_parts_mut(out, buf.len()).copy_from_slice(&buf);
-            buf.len()
-        }
-        _ => 0,
-    }
+    panic_guard(
+        || {
+            let input = std::ffi::CStr::from_ptr(ids).to_bytes();
+            let needed = crate::util::validation::hex_batch_count(input);
+            if needed > out_cap {
+                return needed;
+            }
+            let mut buf = Vec::with_capacity(needed);
+            match crate::util::validation::hex_batch_valid_into(input, width as usize, &mut buf) {
+                Ok(()) if buf.len() <= out_cap => {
+                    slice::from_raw_parts_mut(out, buf.len()).copy_from_slice(&buf);
+                    buf.len()
+                }
+                _ => 0,
+            }
+        },
+        0,
+    )
 }

package/rust/ffi/http.rs

@@ -446,7 +446,11 @@ pub unsafe extern "C" fn castrum_url_encode_query(
                 return None;
             }
             let count = u32::from_le_bytes([input[0], input[1], input[2], input[3]]) as usize;
-            let mut map = std::collections::BTreeMap::new();
+            // Borrow the keys/values as &str straight from the input slice
+            // instead of .to_string()-copying each into the map — the map is
+            // consumed inside this closure, so the borrows outlive it; the
+            // BTreeMap ordering (byte-lexicographic) is identical for &str.
+            let mut map = std::collections::BTreeMap::<&str, &str>::new();
             let mut off = 4usize;
             for _ in 0..count {
                 if off + 4 > input.len() {
@@ -462,9 +466,7 @@ pub unsafe extern "C" fn castrum_url_encode_query(
                 if off + klen > input.len() {
                     return None;
                 }
-                let key = std::str::from_utf8(&input[off..off + klen])
-                    .ok()?
-                    .to_string();
+                let key = std::str::from_utf8(&input[off..off + klen]).ok()?;
                 off += klen;
                 if off + 4 > input.len() {
                     return None;
@@ -479,9 +481,7 @@ pub unsafe extern "C" fn castrum_url_encode_query(
                 if off + vlen > input.len() {
                     return None;
                 }
-                let val = std::str::from_utf8(&input[off..off + vlen])
-                    .ok()?
-                    .to_string();
+                let val = std::str::from_utf8(&input[off..off + vlen]).ok()?;
                 off += vlen;
                 map.insert(key, val);
             }
@@ -630,11 +630,18 @@ pub unsafe extern "C" fn castrum_http_parse_request_packed(
     if data.is_null() || out.is_null() {
         return 0;
     }
-    crate::http::http_parser::http_parse_request_packed_into_slice(
-        slice::from_raw_parts(data, len),
-        slice::from_raw_parts_mut(out, out_cap),
+    // Attacker-controlled request bytes: a panic must become 0, not unwind
+    // through the C ABI.
+    panic_guard(
+        || {
+            crate::http::http_parser::http_parse_request_packed_into_slice(
+                slice::from_raw_parts(data, len),
+                slice::from_raw_parts_mut(out, out_cap),
+            )
+            .unwrap_or(0)
+        },
+        0,
     )
-    .unwrap_or(0)
 }
 
 /// Query string parse → packed output into `out`.
@@ -657,14 +664,19 @@ pub unsafe extern "C" fn castrum_query_parse_packed(
     if data.is_null() || out.is_null() {
         return 0;
     }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    match crate::http::query_parser::query_parse_packed_into_slice(input, output) {
-        Ok(w) => w,
-        // Too-small OR malformed — the size pass disambiguates: it parses the
-        // same input, so Ok(needed) ⇒ too-small, Err ⇒ malformed (real error).
-        Err(_) => crate::http::query_parser::query_parse_packed_size(input).unwrap_or(0),
-    }
+    panic_guard(
+        || {
+            let input = slice::from_raw_parts(data, len);
+            let output = slice::from_raw_parts_mut(out, out_cap);
+            match crate::http::query_parser::query_parse_packed_into_slice(input, output) {
+                Ok(w) => w,
+                // Too-small OR malformed — the size pass disambiguates: it parses
+                // the same input, so Ok(needed) ⇒ too-small, Err ⇒ malformed.
+                Err(_) => crate::http::query_parser::query_parse_packed_size(input).unwrap_or(0),
+            }
+        },
+        0,
+    )
 }
 
 /// Cookie header parse → packed output into `out`.
@@ -683,12 +695,17 @@ pub unsafe extern "C" fn castrum_cookie_parse_packed(
     if data.is_null() || out.is_null() {
         return 0;
     }
-    let input = slice::from_raw_parts(data, len);
-    let output = slice::from_raw_parts_mut(out, out_cap);
-    match crate::http::cookie_parser::cookie_parse_packed_into_slice(input, output) {
-        Ok(w) => w,
-        Err(_) => crate::http::cookie_parser::cookie_parse_packed_size(input).unwrap_or(0),
-    }
+    panic_guard(
+        || {
+            let input = slice::from_raw_parts(data, len);
+            let output = slice::from_raw_parts_mut(out, out_cap);
+            match crate::http::cookie_parser::cookie_parse_packed_into_slice(input, output) {
+                Ok(w) => w,
+                Err(_) => crate::http::cookie_parser::cookie_parse_packed_size(input).unwrap_or(0),
+            }
+        },
+        0,
+    )
 }
 
 /// Parse an `application/x-www-form-urlencoded` body into packed pairs — the
@@ -730,23 +747,32 @@ pub unsafe extern "C" fn castrum_multipart_parse_packed(
     }
     // Wrap in panic_guard: the parser allocates internally — a panic must not
     // unwind through the C ABI (process crash); it becomes 0 instead.
-    let packed = panic_guard(
+    // Direct write: needed-size first (no partial output), then serialize
+    // straight into the caller's buffer — no intermediate Vec, no final copy.
+    // Two-pass (parse → len check → write) keeps the needed-size convention
+    // without re-parsing: parts are borrowed slices, writable twice cheaply.
+    let parts = panic_guard(
         || {
-            let parts = crate::http::multipart::parse_multipart_limited(
+            crate::http::multipart::parse_multipart_limited(
                 slice::from_raw_parts(body, blen),
                 slice::from_raw_parts(boundary, boundary_len),
                 &Default::default(),
-            );
-            let mut buf = Vec::new();
-            crate::http::multipart::parts_to_packed(&parts, &mut buf);
-            buf
+            )
         },
         Vec::new(),
     );
-    if packed.len() > out_cap {
-        // Needed-size convention (see compress_to_out!): exact retry, no re-run.
-        return packed.len();
+    let needed = panic_guard(|| crate::http::multipart::parts_packed_len(&parts), 0);
+    if needed == 0 || needed > out_cap {
+        return needed;
     }
-    slice::from_raw_parts_mut(out, packed.len()).copy_from_slice(&packed);
-    packed.len()
+    let written = panic_guard(
+        || {
+            crate::http::multipart::parts_to_packed_into(
+                &parts,
+                slice::from_raw_parts_mut(out, out_cap),
+            )
+        },
+        None,
+    );
+    written.unwrap_or(0)
 }

package/rust/ffi/metrics.rs

@@ -19,8 +19,12 @@ pub(crate) const METRICS_DECLARE_ERR: u32 = u32::MAX;
 /// Create an empty metrics registry → opaque handle (`0` = allocation panic).
 #[no_mangle]
 pub extern "C" fn castrum_metrics_create() -> usize {
-    let handle = Box::into_raw(Box::new(crate::metrics::MetricsRegistry::new()));
-    handle as usize
+    // An allocation panic must become the null-handle sentinel, not unwind
+    // through `extern "C"`.
+    panic_guard(
+        || Box::into_raw(Box::new(crate::metrics::MetricsRegistry::new())) as usize,
+        0,
+    )
 }
 
 /// Declare a counter family → series id (`METRICS_DECLARE_ERR` on error).