commit message

JamesClarke7283 · JamesClarke7283 · commit 83b7ff19fc9c · 2026-05-25T09:28:38.000+01:00
{"subject": "Mark zstd load_dict as unsafe and document invariant", "body": "- Add # Safety docs requiring PyRef&lt;ZstdDict&gt; to outlive the context\n- Wrap calls in load_compressor_dict and load_decompressor_dict with SAFETY comments"}
diff --git a/crates/stdlib/src/zstd.rs b/crates/stdlib/src/zstd.rs
@@ -828,7 +828,13 @@ mod _zstd {
     /// Common path for attaching a dictionary to either context type. Returns
     /// the digested `CDict`/`DDict` (if the caller used digested mode) plus
     /// the `PyRef<ZstdDict>` we hold to keep the bytes alive for `ref_prefix`.
-    fn load_dict<L: DictLoader<'static>>(
+    /// # Safety
+    ///
+    /// The caller must ensure that the returned `PyRef<ZstdDict>` (if any)
+    /// outlives the context `ctx`. In `ref_prefix` mode, libzstd stores a
+    /// raw pointer into the dictionary bytes; the `PyRef` keeps those bytes
+    /// alive for the required lifetime.
+    unsafe fn load_dict<L: DictLoader<'static>>(
         ctx: &mut L,
         dict_obj: Option<PyObjectRef>,
         vm: &VirtualMachine,
@@ -883,15 +889,19 @@ mod _zstd {
         dict_obj: Option<PyObjectRef>,
         vm: &VirtualMachine,
     ) -> DictLoadResult<zstd_safe::CDict<'static>> {
-        load_dict::<CCtx<'static>>(cctx, dict_obj, vm)
+        // SAFETY: The returned `PyRef<ZstdDict>` is stored alongside the
+        // `CCtx` in `CompressorState`, so it outlives the context.
+        unsafe { load_dict::<CCtx<'static>>(cctx, dict_obj, vm) }
     }
 
     fn load_decompressor_dict(
         dctx: &mut DCtx<'static>,
         dict_obj: Option<PyObjectRef>,
         vm: &VirtualMachine,
     ) -> DictLoadResult<zstd_safe::DDict<'static>> {
-        load_dict::<DCtx<'static>>(dctx, dict_obj, vm)
+        // SAFETY: The returned `PyRef<ZstdDict>` is stored alongside the
+        // `DCtx` in `DecompressorState`, so it outlives the context.
+        unsafe { load_dict::<DCtx<'static>>(dctx, dict_obj, vm) }
     }
 
     /// Drive `compress_stream2` until the input is fully consumed and, for
