LLM-Assisted Porting of Security-Critical C Libraries to Idiomatic Rust: A Multi-Model Empirical Study

Abstract

Memory-safety vulnerabilities remain the dominant class of security defects in C/C++ software underpinning Internet infrastructure. Rust offers a structural solution through its ownership system, yet migrating existing codebases remains costly. This paper defines a structured methodology for LLM-assisted porting of security-critical C libraries to idiomatic Rust and applies it to cJSON (∼3200 LOC, 14 CVEs). A manual expert porting serves as the baseline; five LLMs (Claude Opus 4.6, Gemini 3 Pro, GPT-5.4, Kimi K2.7-Code, and Qwen3.5-27B) produce independent portings in agentic mode. Verification uses an end-to-end pipeline: CVE-specific tests, coverage-guided and differential fuzzing (>1.7 billion executions), Miri analysis, and comparative benchmarking. All six portings eliminate all in-scope CVE classes by construction, with zero unsafe blocks and zero memory-safety crashes. In this case study, structural safety holds consistently across all five evaluated models and across all five Kimi repetitions, whereas code quality varies widely (0–9 residual bugs). Because only Kimi was repeated (N=5), its variance bounds run-to-run noise at the 95% confidence level, against which some but not all between-model differences are distinguishable from chance; a single porting attempt costs approximately $3 in API usage. Differential fuzzing reveals complementary bugs in the manual and LLM portings, supporting a hybrid workflow, and we translate these findings into concrete practical guidance for teams planning a similar migration. These results are scoped to one compact, single-threaded C library. The entire codebase and evaluation pipeline are publicly released.