refactor(core): safe iface for get_glyph_data

[no changelog]

core/embed/gfx/fonts/fonts.h

@@ -38,7 +38,8 @@ typedef struct {
   const uint8_t *glyph_nonprintable;
 } font_info_t;
 
-/// Font identifiers
+/// Font identifiers. Keep in sync with `enum font` definition in
+/// `core/embed/rust/src/ui/display/font.rs`.
 typedef enum {
   FONT_NORMAL = -1,
   FONT_BOLD = -2,

core/embed/rust/src/translations/blob.rs

@@ -240,7 +240,7 @@ impl<'a> Translations<'a> {
     /// translations object. This is to facilitate safe interface to
     /// flash-based translations. See docs for `flash::get` for details.
     #[allow(clippy::needless_lifetimes)]
-    pub fn font<'b>(&'b self, index: u16) -> Option<Table<'b>> {
+    fn font<'b>(&'b self, index: u16) -> Option<Table<'b>> {
         self.fonts
             .get(index)
             .and_then(|data| Table::new(InputStream::new(data)).ok())
@@ -258,6 +258,20 @@ impl<'a> Translations<'a> {
     pub fn header<'b>(&'b self) -> &'b TranslationsHeader<'b> {
         &self.header
     }
+
+    /// Returns a byte slice of the glyph data for the given UTF-8 codepoint in
+    /// the specified font.
+    ///
+    /// SAFETY: Do not mess with the lifetimes in this signature.
+    ///
+    /// The lifetimes are a useful lie that bind the lifetime of the returned
+    /// string not to the underlying data, but to the _reference_ to the
+    /// translations object. This is to facilitate safe interface to
+    /// flash-based translations. See docs for `flash::get` for details.
+    #[allow(clippy::needless_lifetimes)]
+    pub fn get_utf8_glyph<'b>(&'b self, codepoint: u16, font_index: u16) -> Option<&'b [u8]> {
+        self.font(font_index).and_then(|t| t.get(codepoint))
+    }
 }
 
 pub struct TranslationsHeader<'a> {

core/embed/rust/src/translations/mod.rs

@@ -1,33 +1,12 @@
 mod blob;
-mod flash;
+pub mod flash;
 mod generated;
 #[cfg(feature = "micropython")]
 mod obj;
 mod public_keys;
 mod translated_string;
 
+pub use blob::Translations;
 pub use translated_string::TranslatedString as TR;
 
-use crate::ui::display::Font;
 pub const DEFAULT_LANGUAGE: &str = "en-US";
-
-/// # Safety
-///
-/// Returned pointer will only point to valid font data for as long as
-/// the flash content is not invalidated by `erase()` or `write()`.
-pub unsafe fn get_utf8_glyph(codepoint: u16, font: Font) -> *const u8 {
-    // SAFETY: Reference is discarded at the end of the function.
-    // We do return a _pointer_ to the same memory location, but the pointer is
-    // always valid.
-    let Ok(translations) = flash::get() else {
-        return core::ptr::null();
-    };
-    let Some(tr) = translations.as_ref() else {
-        return core::ptr::null();
-    };
-    if let Some(glyph) = tr.font(font as u16).and_then(|t| t.get(codepoint)) {
-        glyph.as_ptr()
-    } else {
-        core::ptr::null()
-    }
-}