Bug Summary

File:/tmp/pyrefcon/scipy/scipy/ndimage/src/_ctest.c
Warning:line 90, column 9
PyObject ownership leak with reference count of 1

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name _ctest.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -analyzer-output=html -analyzer-checker=python -analyzer-disable-checker=deadcode -analyzer-config prune-paths=true,suppress-c++-stdlib=true,suppress-null-return-paths=false,crosscheck-with-z3=true,model-path=/opt/pyrefcon/lib/pyrefcon/models/models -analyzer-config experimental-enable-naive-ctu-analysis=true,ctu-dir=/tmp/pyrefcon/scipy/csa-scan,ctu-index-name=/tmp/pyrefcon/scipy/csa-scan/externalDefMap.txt,ctu-invocation-list=/tmp/pyrefcon/scipy/csa-scan/invocations.yaml,display-ctu-progress=false -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -fcoverage-compilation-dir=/tmp/pyrefcon/scipy -resource-dir /opt/pyrefcon/lib/clang/13.0.0 -isystem /opt/pyrefcon/lib/pyrefcon/models/python3.8 -D NDEBUG -D _FORTIFY_SOURCE=2 -D NPY_NO_DEPRECATED_API=NPY_1_9_API_VERSION -D NO_ATLAS_INFO=1 -D HAVE_CBLAS -I /usr/lib/python3/dist-packages/numpy/core/include -I /usr/lib/python3/dist-packages/numpy/core/include -internal-isystem /opt/pyrefcon/lib/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-result -Wsign-compare -Wall -Wformat -Werror=format-security -Wformat -Werror=format-security -Wdate-time -fdebug-compilation-dir=/tmp/pyrefcon/scipy -ferror-limit 19 -fwrapv -pthread -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/pyrefcon/scipy/csa-scan/reports -x c scipy/ndimage/src/_ctest.c

scipy/ndimage/src/_ctest.c

→
1#include <Python.h>
2#include <numpy/npy_common.h>
3
4
5static void
6_destructor(PyObject *obj)
7{
8 void *callback_data = PyCapsule_GetContext(obj);
9 PyMem_Free(callback_data);
10}
11
12
13static int
14_filter1d(double *input_line, npy_intp input_length, double *output_line,
15 npy_intp output_length, void *callback_data)
16{
17 npy_intp i, j;
18 npy_intp filter_size = *(npy_intp *)callback_data;
19
20 for (i = 0; i < output_length; i++) {
21 output_line[i] = 0;
22 for (j = 0; j < filter_size; j++) {
23 output_line[i] += input_line[i+j];
24 }
25 output_line[i] /= filter_size;
26 }
27 return 1;
28}
29
30
31static PyObject *
32py_filter1d(PyObject *obj, PyObject *args)
33{
34 npy_intp *callback_data = NULL((void*)0);
35 PyObject *capsule = NULL((void*)0);
36
37 callback_data = PyMem_Malloc(sizeof(npy_intp));
38 if (!callback_data) {
39 PyErr_NoMemory();
40 goto error;
41 }
42 if (!PyArg_ParseTuple(args, "n", callback_data)) goto error;
43
44 capsule = PyCapsule_New(_filter1d, NULL((void*)0), _destructor);
45 if (!capsule) goto error;
46 if (PyCapsule_SetContext(capsule, callback_data) != 0) {
47 Py_DECREF(capsule)_Py_DECREF(((PyObject*)(capsule)));
48 goto error;
49 }
50 return capsule;
51 error:
52 PyMem_Free(callback_data);
53 return NULL((void*)0);
54}
55
56
57static int
58_filter2d(double *buffer, npy_intp filter_size, double *res,
59 void *callback_data)
60{
61 npy_intp i;
62 double *weights = (double *)callback_data;
63
64 *res = 0;
65 for (i = 0; i < filter_size; i++) {
66 *res += weights[i]*buffer[i];
67 }
68 return 1;
69}
70
71
72static PyObject *
73py_filter2d(PyObject *obj, PyObject *args)
74{
75 Py_ssize_t i, size;
76 double *callback_data = NULL((void*)0);
77 PyObject *seq = NULL((void*)0), *item = NULL((void*)0), *capsule = NULL((void*)0);
78
79 if (!PyArg_ParseTuple(args, "O", &seq)) goto error;
1
Assuming the condition is false
→
2
←
Taking false branch
→
80
81 size = PySequence_LengthPySequence_Size(seq);
82 if (size == -1) goto error;
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
83 callback_data = PyMem_Malloc(size*sizeof(double));
84 if (!callback_data) {
5
←
Assuming 'callback_data' is non-null
→
6
←
Taking false branch
→
85 PyErr_NoMemory();
86 goto error;
87 }
88
89 for (i = 0; i < size; i++) {
7
←
Assuming 'i' is < 'size'
→
8
←
Loop condition is true. Entering loop body
→
90 item = PySequence_GetItem(seq, i);
9
←
Calling 'PySequence_GetItem'
→
11
←
Returning from 'PySequence_GetItem'
→
17
←
PyObject ownership leak with reference count of 1
91 if (!item) {
12
←
Assuming 'item' is non-null
→
13
←
Taking false branch
→
92 PyErr_SetString(PyExc_IndexError, "failed to get item");
93 goto error;
94 }
95 callback_data[i] = PyFloat_AsDouble(item);
96 if (PyErr_Occurred()) goto error;
14
←
Assuming the condition is true
→
15
←
Taking true branch
→
16
←
Control jumps to line 107
→
97 }
98
99 capsule = PyCapsule_New(_filter2d, NULL((void*)0), _destructor);
100 if (!capsule) goto error;
101 if (PyCapsule_SetContext(capsule, callback_data) != 0) {
102 Py_DECREF(capsule)_Py_DECREF(((PyObject*)(capsule)));
103 goto error;
104 }
105 return capsule;
106 error:
107 PyMem_Free(callback_data);
108 return NULL((void*)0);
109}
110
111
112static int
113_transform(npy_intp *output_coordinates, double *input_coordinates,
114 npy_intp output_rank, npy_intp input_rank, void *callback_data)
115{
116 npy_intp i;
117 double shift = *(double *)callback_data;
118
119 for (i = 0; i < input_rank; i++) {
120 input_coordinates[i] = output_coordinates[i] - shift;
121 }
122 return 1;
123}
124
125
126static PyObject *
127py_transform(PyObject *obj, PyObject *args)
128{
129 double *callback_data = PyMem_Malloc(sizeof(double));
130 PyObject *capsule = NULL((void*)0);
131
132 if (!callback_data) {
133 PyErr_NoMemory();
134 goto error;
135 }
136 if (!PyArg_ParseTuple(args, "d", callback_data)) goto error;
137
138 capsule = PyCapsule_New(_transform, NULL((void*)0), _destructor);
139 if (!capsule) goto error;
140 if (PyCapsule_SetContext(capsule, callback_data) != 0) {
141 Py_DECREF(capsule)_Py_DECREF(((PyObject*)(capsule)));
142 goto error;
143 }
144 return capsule;
145 error:
146 PyMem_Free(callback_data);
147 return NULL((void*)0);
148}
149
150
151static PyMethodDef _CTestMethods[] = {
152 {"transform", (PyCFunction)py_transform, METH_VARARGS0x0001, ""},
153 {"filter1d", (PyCFunction)py_filter1d, METH_VARARGS0x0001, ""},
154 {"filter2d", (PyCFunction)py_filter2d, METH_VARARGS0x0001, ""},
155 {NULL((void*)0), NULL((void*)0), 0, NULL((void*)0)}
156};
157
158
159/* Initialize the module */
160static struct PyModuleDef _ctest = {
161 PyModuleDef_HEAD_INIT{ { 1, ((void*)0) }, ((void*)0), 0, ((void*)0), },
162 "_ctest",
163 NULL((void*)0),
164 -1,
165 _CTestMethods,
166 NULL((void*)0),
167 NULL((void*)0),
168 NULL((void*)0),
169 NULL((void*)0)
170};
171
172
173PyObject *PyInit__ctest(void)
174{
175 return PyModule_Create(&_ctest)PyModule_Create2(&_ctest, 1013);
176}
←

/opt/pyrefcon/lib/pyrefcon/models/models/PySequence_GetItem.model

1#ifndef PySequence_GetItem
2struct _object;
3typedef struct _object PyObject;
4PyObject* clang_analyzer_PyObject_New_Reference();
5PyObject* PySequence_GetItem(PyObject *o, Py_ssize_t i) {
6 return clang_analyzer_PyObject_New_Reference();
10
←
Setting reference count to 1
→
7}
8#else
9#warning "API PySequence_GetItem is defined as a macro."
10#endif