There is unsafety at the FFI boundary. The C functions will deal with pointers, so the Rust side will have to use pointers too. The Rust side will normally thun

There is unsafety at the FFI boundary. The C functions will deal with pointers, so the Rust side will have to use pointers too. The Rust side will normally thunk it into safe Rust (convert pointers to references by introducing lifetimes, wrapping in types with destructors, making sure to add or remove Send / Sync impls as necessary, etc) so that the rest of the Rust code that's not at the boundary can be safe. So if you have a Rust function that receives a pointer and a length representing the array, it will translate that into a Rust slice by trusting the pointer and length. Of course if the C caller gave a garbage pointer or a length that's bigger than the actual C array, then the "safe" Rust code that uses that slice will still be illegal. C++ interop has some additional complexity because of templates, methods, inheritance, etc, that's handled by the cxx Rust library. I don't know much about it.