In this case candidate is a pointer into input and can never be out-of-bounds.

The issue currently is, if I mark the function as unsafe, the caller needs to wrap the call with unsafe. There is a normalization layer between safe code and unsafe code, where the call looks the same. So instead:

``` let duplicate_length = count_same_bytes(input, candidate as usize + MINMATCH, &mut cur);

I would need:

let mut duplicate_length = 0;

[cfg(not(feature = "safe-encode"))]

{ duplicate_length = unsafe{count_same_bytes(input, candidate as usize + MINMATCH, &mut cur)}; }

[cfg(feature = "safe-encode")]

{ duplicate_length = count_same_bytes(input, candidate as usize + MINMATCH, &mut cur); }

```

Which seems pretty verbose. In that case it probably would make sense to split the unsafe and safe version in two seperate files. As I understand it this is an api convention to signal the programmer unsafe code and does not cause UB itself, by missing it.