Function roaring_bitmap_deserialize_safe 

pub unsafe extern "C" fn roaring_bitmap_deserialize_safe(
    buf: *const c_void,
    maxbytes: usize,
) -> *mut roaring_bitmap_t

Load a bitmap from a serialized buffer safely (reading up to maxbytes).

Use with roaring_bitmap_serialize().

(See roaring_bitmap_portable_deserialize_safe() if you want a format that’s compatible with Java and Go implementations).

The difference with roaring_bitmap_deserialize() is that this function is guaranteed to not read beyond the provided buffer. If the buffer is too small, NULL is returned.

The function itself is safe in the sense that it will not cause buffer overflows: it will not read beyond the scope of the provided buffer (buf,maxbytes).

However, for correct operations, it is assumed that the bitmap read was once serialized from a valid bitmap (i.e., it follows the format specification). If you provided an incorrect input (garbage), then the bitmap read may not be in a valid state and following operations may not lead to sensible results (using it may cause crashes, or it may just give incoherent answers). You can call roaring_bitmap_internal_validate to check the validity of the bitmap if the source is untrusted. Only after calling roaring_bitmap_internal_validate is the bitmap considered safe for use.

The returned pointer may be NULL in case of errors.