PyPI / zstandard / 0.25.0

zstandard 0.25.0

Source

https://github.com/indygreg/python-zstandard

Tag scanned

0.25.0

Compared with

0.24.0 (1 signals introduced since)

Files

107 scanned, 20 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 11 info

Scan time

8.3 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 11 of 11 warn and critical signals; 11 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 05:30

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review encoding-hex tests/test_compressor_compress.py:201:15 new in this release

   16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)

               result,
               b"\x28\xb5\x2f\xfd\x23\x27\x42\xfc\x42\x03\x19\x00\x00\x66\x6f\x6f",
           )

   likely benign LLM, confidence 0.90 Expected zstd frame bytes in a compression test.

   Reasoning

   Expected compressed output bytes in a unit test for zstd compression; benign test data.

2. info warn → info by review decoder-decompress-payload bench.py:354:9

   file imports decoder module(s) zlib and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)

           zctx = zstd.ZstdDecompressor(**opts)
           zctx.decompress(chunk)

   likely benign LLM, confidence 0.85 Benchmark code calling zstd decompressor on a data chunk.

   Reasoning

   This is a benchmark script for the zstd library; calling decompress on a chunk is the normal purpose of the code, not hidden payload execution. Decompressing data is the subject matter of the project.

3. info warn → info by review dynamic-execution ci/conda/build.sh:5:1

   command name is a variable (`$PYTHON`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

   
   $PYTHON setup.py install

   likely benign LLM, confidence 0.80 Conda build script invoking the interpreter from the PYTHON env variable.

   Reasoning

   Standard conda build script using $PYTHON, which conda sets in the build environment to select the interpreter. The variable-command pattern is the normal conda convention.

4. info warn → info by review encoding-hex tests/test_compressor_chunker.py:133:19

   16 consecutive `\xNN` escapes (entropy 3.6 bits/byte) (raw pass, confidence 0.65)

               [
                   b"\x28\xb5\x2f\xfd\x00\x58\x8c\x00\x00\x30\x66\x6f\x6f\x62\x61\x72"
                   b"\x02\x00\xfa\x03\xfe\xd0\x9f\xbe\x1b\x02"
               ],

   likely benign LLM, confidence 0.90 Test vector bytes for a zstd compressed frame.

   Reasoning

   A test fixture of a zstd frame with a magic number and a 'foobar' payload; hex escapes encode binary test vectors and are expected in compression tests.

5. info warn → info by review payload-bytes-literal tests/test_compressor_stream_writer.py:539:13

   concatenated bytes literal contains 43 `\xNN` escapes (100% of content) — binary payload shape (ast pass, confidence 0.85)

               # Frame 1.
               b"\x28\xb5\x2f\xfd\x00\x58\x75\x00\x00\x30\x66\x6f\x6f"
               b"\x62\x61\x72\x01\x00\xf7\xbf\xe8\xa5\x08"
               # Frame 2.

   likely benign LLM, confidence 0.88 Multi-frame zstd binary fixture in a stream writer test.

   Reasoning

   Concatenated binary zstd frames used as known test input for a stream writer/decompressor. Expected for this library's test suite.

6. info warn → info by review dynamic-execution tests/test_decompressor_decompress.py:162:14

   `open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)

       def test_max_window_size(self):
           with open(__file__, "rb") as fh:
               source = fh.read()

   likely benign LLM, confidence 0.88 Test reading its own file contents for a window size test.

   Reasoning

   The test reads its own source to check a max window size behavior in a test method; it does not extract a hidden payload or execute anything from the bytes.

7. info warn → info by review identifier-confusable-collision zstd/zstd.c:5587:46

   two identifiers collapse to visual skeleton `to` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

                                              * to preserve host's memory from unreasonable requirements.
                                              * This limit can be overridden using ZSTD_DCtx_setParameter(,ZSTD_d_windowLogMax,).

   dismissed LLM, confidence 0.92 Comment text flagged by confusable-identifier heuristic.

   Reasoning

   Confusable skeleton collision is an artifact of the heuristic on words in a comment ('to' inside prose); no code identifiers are involved. Benign.

8. info warn → info by review identifier-confusable-collision zstd/zstd.c:11333:9

   two identifiers collapse to visual skeleton `do` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

   
           do {
               v1 = XXH32_round(v1, XXH_get32bits(input)); input += 4;
               v2 = XXH32_round(v2, XXH_get32bits(input)); input += 4;

   dismissed LLM, confidence 0.92 Standard do-while loop in xxhash code.

   Reasoning

   'do' is the C keyword; the collision is a false positive from the confusable-skeleton check against another identifier. Standard xxhash loop code.

9. info warn → info by review macro-keyword-override zstd/zstd.c:12005:1

   `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

      || (defined(__wasm_simd128__) && XXH_HAS_INCLUDE(<arm_neon.h>)) /* WASM SIMD128 via SIMDe */
   #    define inline __inline__  /* circumvent a clang bug */
   #    include <arm_neon.h>
   #    undef inline

   likely benign LLM, confidence 0.90 Temporary inline macro redefinition for arm_neon include workaround.

   Reasoning

   This is the known SIMDe/clang workaround in xxhash, temporarily redefining inline around an arm_neon.h include and undefining it afterward. It is a legitimate, well-documented compatibility pattern, though it does rebind a keyword.

10. info warn → info by review identifier-confusable-collision zstd/zstd.c:12890:23

    two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

        XXH_ASSERT(9 <= len && len <= 16);
        {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
            xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
            xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;

    dismissed LLM, confidence 0.90 Ordinary xxhash bitflip variables in hash computation.

    Reasoning

    Variable names bitflip1 and bitflip2 are distinct identifiers; the skeleton collision comes from the normalized-name heuristic and is a false positive in xxhash arithmetic code.

11. info warn → info by review identifier-confusable-collision zstd/zstd.c:24208:27

    two identifiers collapse to visual skeleton `d|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

    {
        ZSTD_localDict* const dl = &cctx->localDict;
        if (dl->dict == NULL) {
            /* No local dictionary. */

    dismissed LLM, confidence 0.90 Local dictionary pointer handling in zstd compressor.

    Reasoning

    Identifier 'dl' and similar short names collide under the skeleton heuristic; the code is ordinary zstd local dictionary handling. False positive.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/indygreg/python-zstandard python-zstandard && cd python-zstandard
git checkout 0.25.0
disclude scan --severity info --diff 0.24.0 .