Wuffs (Wrangling Untrusted File Formats Safely) is a memory-safe, high-performance library for decoding and encoding a wide range of binary file formats, including images (PNG, JPEG, GIF, BMP, WebP), compression streams (gzip, zlib, bzip2, xz, lzma, deflate), and data formats (JSON, CBOR). Its core innovation is a custom domain-specific language (also called Wuffs) that is transpiled to C. The transpiler performs compile-time safety proofs (bounds checking, integer overflow, null pointers) using interval arithmetic, eliminating entire classes of vulnerabilities without runtime overhead. The library follows a 'Sans I/O' architecture, making it completely hermetic—no syscalls, no memory allocation, and no external dependencies at runtime. In production, Wuffs is deployed in Google Chrome for GIF decoding and is designed for use in security-critical environments like web browsers, operating systems, and firmware. The repository provides a single-file C library (stb-style) that can be easily integrated into any C/C++ project. It also includes a comprehensive set of command-line tools for testing, benchmarking, and code generation, as well as extensive fuzzing harnesses and unit tests for every supported codec. The architecture is divided into three main layers: the language toolchain (written in Go, comprising a parser, type checker, and C code generator), the standard library (written in the Wuffs language, defining the codecs), and the generated C library (the runtime artifact). The code generator produces highly optimized C code, including hand-written SIMD paths for pixel swizzling and CRC computation. The codebase exhibits exceptional craftsmanship. The interval arithmetic library used for compile-time proofs, the DEFLATE stream cutter for random-access compression, and the low-level JPEG encoder operating on DCT coefficients are all standout examples of non-obvious, reusable engineering. The base C library provides a masterclass in writing safe, performant, and portable C99 code without external dependencies.
hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.
C2Rust is a compiler toolchain that translates C99 code into unsafe Rust, then applies static analysis and refactoring to produce safer, more idiomatic Rust. The pipeline consists of four main stages: transpilation (c2rust-transpile) using a Clang-based AST exporter to produce initial Rust code; static analysis (c2rust-analyze) that infers pointer permissions and rewrites raw pointers to safe references using a Polonius-based borrow checker; refactoring (c2rust-refactor) which applies dozens of AST transformations (e.g., ownership splitting, macro collapsing, control flow reconstruction) to improve code quality; and postprocessing (c2rust-postprocess) that leverages large language models to transfer C comments and align definitions. The project also includes a cross-checking framework that instruments both C and Rust code to compare runtime behavior via hashing, a program dependence graph (PDG) builder for memory safety analysis, and dynamic instrumentation for event logging. It is primarily a CLI tool (c2rust) that orchestrates these components, with extensive integration tests on real-world C projects (nginx, curl, sqlite, ruby, python2, libxml2, zstd, lua). The codebase is substantial and actively maintained, but relies heavily on unstable rustc internal APIs and LLVM/Clang, introducing maintenance risk. Several components exhibit high craftsmanship and are reusable in isolation.