Wuffs is a memory-safe programming language and toolchain for writing parsers and codecs, with C code generation as its primary output. The system provides a comprehensive library of decoders for image formats (JPEG, PNG, GIF, BMP, WebP, etc.), compression formats (Deflate, Zlib, Gzip, LZMA, XZ, BZip2, etc.), and checksums (CRC32, Adler32, SHA256). It is designed to eliminate buffer overflows, integer overflows, and null pointer dereferences at compile time through formal verification and interval arithmetic, without runtime overhead. The architecture consists of a custom DSL (Wuffs language) with a Go-based compiler (parser, type checker, optimizer), a C code generator that produces a single-file header-only C library, and a set of auxiliary C++ modules for high-level APIs. Key entry points include the `wuffs` CLI tool for managing packages and generating C code, the `wuffs-c` tool for C-specific operations, and the generated `wuffs-unsupported-snapshot.c` file that can be dropped into any C project. External dependencies are minimal: the development toolchain requires Go, but the generated C library has no dependencies beyond standard C. The system is used in production (e.g., GIF decoder in Google Chrome) and is benchmarked as 1.3–6× faster than equivalent C libraries.
hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.
C2Rust is a compiler toolchain that translates C99 code into unsafe Rust, then applies static analysis and refactoring to produce safer, more idiomatic Rust. The pipeline consists of four main stages: transpilation (c2rust-transpile) using a Clang-based AST exporter to produce initial Rust code; static analysis (c2rust-analyze) that infers pointer permissions and rewrites raw pointers to safe references using a Polonius-based borrow checker; refactoring (c2rust-refactor) which applies dozens of AST transformations (e.g., ownership splitting, macro collapsing, control flow reconstruction) to improve code quality; and postprocessing (c2rust-postprocess) that leverages large language models to transfer C comments and align definitions. The project also includes a cross-checking framework that instruments both C and Rust code to compare runtime behavior via hashing, a program dependence graph (PDG) builder for memory safety analysis, and dynamic instrumentation for event logging. It is primarily a CLI tool (c2rust) that orchestrates these components, with extensive integration tests on real-world C projects (nginx, curl, sqlite, ruby, python2, libxml2, zstd, lua). The codebase is substantial and actively maintained, but relies heavily on unstable rustc internal APIs and LLVM/Clang, introducing maintenance risk. Several components exhibit high craftsmanship and are reusable in isolation.