bytes 1.12.1

Source: https://github.com/tokio-rs/bytes
Artifact scanned: bytes-1.12.1.crate (crate · 73.9 KB · SHA-256 fc652a48c352…)
Compared with: bytes-1.12.0.crate (0 signals introduced since)
Files: 34 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 25 info
Scan time: 2.6 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-24 03:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info encoding-hex src/buf/buf_impl.rs:747:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello"[..];
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_u128());
    /// ```

info encoding-hex src/buf/buf_impl.rs:767:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello"[..];
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_u128_le());
    /// ```

info encoding-hex src/buf/buf_impl.rs:788:23

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// let mut buf: &[u8] = match cfg!(target_endian = "big") {
    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };

info encoding-hex src/buf/buf_impl.rs:789:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_u128_ne());

info encoding-hex src/buf/buf_impl.rs:810:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello"[..];
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_i128());
    /// ```

info encoding-hex src/buf/buf_impl.rs:830:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello"[..];
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_i128_le());
    /// ```

info encoding-hex src/buf/buf_impl.rs:851:23

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// let mut buf: &[u8] = match cfg!(target_endian = "big") {
    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };

info encoding-hex src/buf/buf_impl.rs:852:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };
    /// assert_eq!(0x01020304050607080910111213141516, buf.get_i128_ne());

info encoding-hex src/buf/buf_impl.rs:1790:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello"[..];
    /// assert_eq!(Ok(0x01020304050607080910111213141516_u128), buf.try_get_u128());
    /// assert_eq!(6, buf.remaining());

info encoding-hex src/buf/buf_impl.rs:1818:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello"[..];
    /// assert_eq!(Ok(0x01020304050607080910111213141516_u128), buf.try_get_u128_le());
    /// assert_eq!(6, buf.remaining());

info encoding-hex src/buf/buf_impl.rs:1847:23

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// let mut buf: &[u8] = match cfg!(target_endian = "big") {
    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };

info encoding-hex src/buf/buf_impl.rs:1848:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };
    /// assert_eq!(Ok(0x01020304050607080910111213141516_u128), buf.try_get_u128_ne());

info encoding-hex src/buf/buf_impl.rs:1877:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello"[..];
    /// assert_eq!(Ok(0x01020304050607080910111213141516_i128), buf.try_get_i128());
    /// assert_eq!(6, buf.remaining());

info encoding-hex src/buf/buf_impl.rs:1905:26

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///
    /// let mut buf = &b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello"[..];
    /// assert_eq!(Ok(0x01020304050607080910111213141516_i128), buf.try_get_i128_le());
    /// assert_eq!(6, buf.remaining());

info encoding-hex src/buf/buf_impl.rs:1934:23

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// let mut buf: &[u8] = match cfg!(target_endian = "big") {
    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };

info encoding-hex src/buf/buf_impl.rs:1935:24

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    ///     true => b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16 hello",
    ///     false => b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01 hello",
    /// };
    /// assert_eq!(Ok(0x01020304050607080910111213141516_i128), buf.try_get_i128_ne());

info encoding-hex src/buf/buf_mut.rs:808:27

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// buf.put_u128(0x01020304050607080910111213141516);
    /// assert_eq!(buf, b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16");
    /// ```
    ///

info encoding-hex src/buf/buf_mut.rs:831:27

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// buf.put_u128_le(0x01020304050607080910111213141516);
    /// assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");
    /// ```
    ///

info encoding-hex src/buf/buf_mut.rs:855:31

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// if cfg!(target_endian = "big") {
    ///     assert_eq!(buf, b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16");
    /// } else {
    ///     assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");

info encoding-hex src/buf/buf_mut.rs:857:31

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// } else {
    ///     assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");
    /// }
    /// ```

info encoding-hex src/buf/buf_mut.rs:881:27

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// buf.put_i128(0x01020304050607080910111213141516);
    /// assert_eq!(buf, b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16");
    /// ```
    ///

info encoding-hex src/buf/buf_mut.rs:904:27

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// buf.put_i128_le(0x01020304050607080910111213141516);
    /// assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");
    /// ```
    ///

info encoding-hex src/buf/buf_mut.rs:928:31

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// if cfg!(target_endian = "big") {
    ///     assert_eq!(buf, b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x10\x11\x12\x13\x14\x15\x16");
    /// } else {
    ///     assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");

info encoding-hex src/buf/buf_mut.rs:930:31

16 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (in comment) (raw pass, confidence 0.39)

    /// } else {
    ///     assert_eq!(buf, b"\x16\x15\x14\x13\x12\x11\x10\x09\x08\x07\x06\x05\x04\x03\x02\x01");
    /// }
    /// ```

info ~~warn~~ → info by review encoding-base64 tests/test_buf.rs:13:25

base64-like blob (66 bytes, compression ratio 1.17) (raw pass, confidence 0.60)
```
// (testing Sign Extension for `Buf::get_int' and `Buf::get_int_ne`).
const INPUT: &[u8] = b"\xffFqrjrDqPhvTc45vvq33f6bJrUtyHESuTeklWKgYd64xgzxJwvAkpYYnpNJyZSRn";

macro_rules! e {
```
likely benign LLM, confidence 0.93 A base64-looking byte-string literal used as test input for Buf integer sign-extension in a Rust test file.
Reasoning
This is a raw-pass base64-like heuristic hit on a byte-string literal in a test file for the bytes crate's Buf::get_int sign-extension behaviour. The blob is an arbitrary test input with a leading \xff byte chosen to exercise sign extension, not a payload. No decode or execution path is visible, and raw findings carry a higher false-positive rate.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o bytes-1.12.1.crate 'https://static.crates.io/crates/bytes/bytes-1%2E12%2E1.crate'
printf '%s  %s\n' fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04 bytes-1.12.1.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf bytes-1.12.1.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg