Bug Summary

File:/tmp/pyrefcon/scipy/scipy/special/sf_error.c
Warning:line 93, column 21
PyObject ownership leak with reference count of 1

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name sf_error.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -analyzer-output=html -analyzer-checker=python -analyzer-disable-checker=deadcode -analyzer-config prune-paths=true,suppress-c++-stdlib=true,suppress-null-return-paths=false,crosscheck-with-z3=true,model-path=/opt/pyrefcon/lib/pyrefcon/models/models -analyzer-config experimental-enable-naive-ctu-analysis=true,ctu-dir=/tmp/pyrefcon/scipy/csa-scan,ctu-index-name=/tmp/pyrefcon/scipy/csa-scan/externalDefMap.txt,ctu-invocation-list=/tmp/pyrefcon/scipy/csa-scan/invocations.yaml,display-ctu-progress=false -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -fcoverage-compilation-dir=/tmp/pyrefcon/scipy -resource-dir /opt/pyrefcon/lib/clang/13.0.0 -isystem /opt/pyrefcon/lib/pyrefcon/models/python3.8 -isystem /opt/pyrefcon/lib/pyrefcon/models/python3.8 -D NDEBUG -D _FORTIFY_SOURCE=2 -D NO_ATLAS_INFO=1 -D HAVE_CBLAS -I /tmp/pyrefcon/scipy/scipy/special -I /usr/lib/python3/dist-packages/numpy/core/include -I scipy/_lib -I scipy/_build_utils/src -I /usr/lib/python3/dist-packages/numpy/core/include -I /usr/local/include -I /usr/include -I /usr/lib/python3/dist-packages/numpy/core/include -I /usr/lib/python3/dist-packages/numpy/core/include -internal-isystem /opt/pyrefcon/lib/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-result -Wsign-compare -Wall -Wformat -Werror=format-security -Wformat -Werror=format-security -Wdate-time -std=c99 -fdebug-compilation-dir=/tmp/pyrefcon/scipy -ferror-limit 19 -fwrapv -pthread -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/pyrefcon/scipy/csa-scan/reports -x c scipy/special/sf_error.c

scipy/special/sf_error.c

→
1#include <stdlib.h>
2#include <stdarg.h>
3
4#include <Python.h>
5
6#include "sf_error.h"
7
8const char *sf_error_messages[] = {
9 "no error",
10 "singularity",
11 "underflow",
12 "overflow",
13 "too slow convergence",
14 "loss of precision",
15 "no result obtained",
16 "domain error",
17 "invalid input argument",
18 "other error",
19 NULL((void*)0)
20};
21
22/* If this isn't volatile clang tries to optimize it away */
23static volatile sf_action_t sf_error_actions[] = {
24 SF_ERROR_IGNORE, /* SF_ERROR_OK */
25 SF_ERROR_IGNORE, /* SF_ERROR_SINGULAR */
26 SF_ERROR_IGNORE, /* SF_ERROR_UNDERFLOW */
27 SF_ERROR_IGNORE, /* SF_ERROR_OVERFLOW */
28 SF_ERROR_IGNORE, /* SF_ERROR_SLOW */
29 SF_ERROR_IGNORE, /* SF_ERROR_LOSS */
30 SF_ERROR_IGNORE, /* SF_ERROR_NO_RESULT */
31 SF_ERROR_IGNORE, /* SF_ERROR_DOMAIN */
32 SF_ERROR_IGNORE, /* SF_ERROR_ARG */
33 SF_ERROR_IGNORE, /* SF_ERROR_OTHER */
34 SF_ERROR_IGNORE /* SF_ERROR__LAST */
35};
36
37extern int wrap_PyUFunc_getfperr(void);
38
39
40void sf_error_set_action(sf_error_t code, sf_action_t action)
41{
42 sf_error_actions[(int)code] = action;
43}
44
45
46sf_action_t sf_error_get_action(sf_error_t code)
47{
48 return sf_error_actions[(int)code];
49}
50
51
52void sf_error(const char *func_name, sf_error_t code, const char *fmt, ...)
53{
54 PyGILState_STATE save;
55 PyObject *scipy_special = NULL((void*)0);
56 char msg[2048], info[1024];
57 static PyObject *py_SpecialFunctionWarning = NULL((void*)0);
58 sf_action_t action;
59 va_list ap;
60
61 if ((int)code
0.1
'code' is >= 0
0.1
'code' is >= 0
 < 0 || (int)code >= 10) {
1
Assuming 'code' is < 10
→
2
←
Taking false branch
→
62 code = SF_ERROR_OTHER;
63 }
64 action = sf_error_get_action(code);
65 if (action == SF_ERROR_IGNORE) {
3
←
Assuming 'action' is not equal to SF_ERROR_IGNORE
→
4
←
Taking false branch
→
66 return;
67 }
68
69 if (func_name == NULL((void*)0)) {
5
←
Assuming 'func_name' is not equal to NULL
→
6
←
Taking false branch
→
70 func_name = "?";
71 }
72
73 if (fmt != NULL((void*)0) && fmt[0] != '\0') {
7
←
Assuming 'fmt' is equal to NULL
→
74 va_start(ap, fmt)__builtin_va_start(ap, fmt);
75 PyOS_vsnprintf(info, 1024, fmt, ap);
76 va_end(ap)__builtin_va_end(ap);
77 PyOS_snprintf(msg, 2048, "scipy.special/%s: (%s) %s",
78 func_name, sf_error_messages[(int)code], info);
79 }
80 else {
81 PyOS_snprintf(msg, 2048, "scipy.special/%s: %s",
82 func_name, sf_error_messages[(int)code]);
83 }
84
85#ifdef WITH_THREAD
86 save = PyGILState_Ensure();
87#endif
88
89 if (PyErr_Occurred()) {
8
←
Assuming the condition is false
→
9
←
Taking false branch
→
90 goto skip_warn;
91 }
92
93 scipy_special = PyImport_ImportModule("scipy.special");
10
←
Calling 'PyImport_ImportModule'
→
12
←
Returning from 'PyImport_ImportModule'
→
19
←
PyObject ownership leak with reference count of 1
94 if (scipy_special == NULL((void*)0)) {
13
←
Assuming 'scipy_special' is not equal to NULL
→
14
←
Taking false branch
→
95 PyErr_Clear();
96 goto skip_warn;
97 }
98
99 if (action == SF_ERROR_WARN) {
15
←
Assuming 'action' is not equal to SF_ERROR_WARN
→
16
←
Taking false branch
→
100 py_SpecialFunctionWarning =
101 PyObject_GetAttrString(scipy_special, "SpecialFunctionWarning");
102 }
103 else if (action == SF_ERROR_RAISE) {
17
←
Assuming 'action' is not equal to SF_ERROR_RAISE
→
18
←
Taking false branch
→
104 py_SpecialFunctionWarning =
105 PyObject_GetAttrString(scipy_special, "SpecialFunctionError");
106 }
107 else {
108 /* Sentinel, should never get here */
109 py_SpecialFunctionWarning = NULL((void*)0);
110 }
111 if (py_SpecialFunctionWarning == NULL((void*)0)) {
112 PyErr_Clear();
113 goto skip_warn;
114 }
115
116 if (action == SF_ERROR_WARN) {
117 PyErr_WarnEx(py_SpecialFunctionWarning, msg, 1);
118 /*
119 * For ufuncs the return value is ignored! We rely on the fact
120 * that the Ufunc loop will call PyErr_Occurred() later on.
121 */
122 }
123 else if (action == SF_ERROR_RAISE) {
124 PyErr_SetString(py_SpecialFunctionWarning, msg);
125 }
126 else {
127 goto skip_warn;
128 }
129
130 skip_warn:
131#ifdef WITH_THREAD
132 PyGILState_Release(save);
133#else
134 ;
135#endif
136}
137
138
139#define UFUNC_FPE_DIVIDEBYZERO1 1
140#define UFUNC_FPE_OVERFLOW2 2
141#define UFUNC_FPE_UNDERFLOW4 4
142#define UFUNC_FPE_INVALID8 8
143
144void sf_error_check_fpe(const char *func_name)
145{
146 int status;
147 status = wrap_PyUFunc_getfperr();
148 if (status & UFUNC_FPE_DIVIDEBYZERO1) {
149 sf_error(func_name, SF_ERROR_SINGULAR, "floating point division by zero");
150 }
151 if (status & UFUNC_FPE_UNDERFLOW4) {
152 sf_error(func_name, SF_ERROR_UNDERFLOW, "floating point underflow");
153 }
154 if (status & UFUNC_FPE_OVERFLOW2) {
155 sf_error(func_name, SF_ERROR_OVERFLOW, "floating point overflow");
156 }
157 if (status & UFUNC_FPE_INVALID8) {
158 sf_error(func_name, SF_ERROR_DOMAIN, "floating point invalid value");
159 }
160}
←

/opt/pyrefcon/lib/pyrefcon/models/models/PyImport_ImportModule.model

1#ifndef PyImport_ImportModule
2struct _object;
3typedef struct _object PyObject;
4PyObject* clang_analyzer_PyObject_New_Reference();
5PyObject* PyImport_ImportModule(const char *name) {
6 return clang_analyzer_PyObject_New_Reference();
11
←
Setting reference count to 1
→
7}
8#else
9#warning "API PyImport_ImportModule is defined as a macro."
10#endif