Maybe unsound in Surface::raw

[lwz23]

hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:

pub struct Surface {
    pub raw: *mut ll::SDL_Surface,
    pub owned: bool
}

impl Surface{
..............................
    pub fn get_width(&self) -> u16 {
        unsafe { (*self.raw).w as u16 }
    }

    pub fn get_height(&self) -> u16 {
        unsafe { (*self.raw).h as u16 }
    }
}

Considering that pub mod video, raw is a pub field, and get_width get_geight........ are also pub function. I assume that users can directly manipulate this field. This potential situation could result in *self.raw being dereference a null pointer, and directly dereferencing it might trigger undefined behavior (UB). For safety reasons, I felt it necessary to report this issue. If you have performed checks elsewhere that ensure this is safe, please don’t take offense at my raising this issue.
If there is no external usage for Surface, I suggest it should not marked as pub, at least its field should not marked as pub.

[lwz23]

ping