Bug Summary

File:/tmp/pyrefcon/scipy/scipy/sparse/linalg/dsolve/_superlu_utils.c
Warning:line 114, column 11
PyObject ownership leak with reference count of 1

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name dpivotgrowth.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -analyzer-output=html -analyzer-checker=python -analyzer-disable-checker=deadcode -analyzer-config prune-paths=true,suppress-c++-stdlib=true,suppress-null-return-paths=false,crosscheck-with-z3=true,model-path=/opt/pyrefcon/lib/pyrefcon/models/models -analyzer-config experimental-enable-naive-ctu-analysis=true,ctu-dir=/tmp/pyrefcon/scipy/csa-scan,ctu-index-name=/tmp/pyrefcon/scipy/csa-scan/externalDefMap.txt,ctu-invocation-list=/tmp/pyrefcon/scipy/csa-scan/invocations.yaml,display-ctu-progress=false -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debug-info-kind=limited -dwarf-version=4 -debugger-tuning=gdb -fcoverage-compilation-dir=/tmp/pyrefcon/scipy -resource-dir /opt/pyrefcon/lib/clang/13.0.0 -D NDEBUG -D _FORTIFY_SOURCE=2 -D USE_VENDOR_BLAS=1 -I scipy/sparse/linalg/dsolve/SuperLU/SRC -I /usr/lib/python3/dist-packages/numpy/core/include -internal-isystem /opt/pyrefcon/lib/clang/13.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-result -Wsign-compare -Wall -Wformat -Werror=format-security -Wformat -Werror=format-security -Wdate-time -fdebug-compilation-dir=/tmp/pyrefcon/scipy -ferror-limit 19 -fwrapv -pthread -stack-protector 2 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/pyrefcon/scipy/csa-scan/reports -x c scipy/sparse/linalg/dsolve/SuperLU/SRC/dpivotgrowth.c

scipy/sparse/linalg/dsolve/SuperLU/SRC/dpivotgrowth.c

→
1/*! \file
2Copyright (c) 2003, The Regents of the University of California, through
3Lawrence Berkeley National Laboratory (subject to receipt of any required
4approvals from U.S. Dept. of Energy)
5
6All rights reserved.
7
8The source code is distributed under BSD license, see the file License.txt
9at the top-level directory.
10*/
11
12/*! @file dpivotgrowth.c
13 * \brief Computes the reciprocal pivot growth factor
14 *
15 * <pre>
16 * -- SuperLU routine (version 2.0) --
17 * Univ. of California Berkeley, Xerox Palo Alto Research Center,
18 * and Lawrence Berkeley National Lab.
19 * November 15, 1997
20 * </pre>
21 */
22#include <math.h>
23#include "slu_ddefs.h"
24
25/*! \brief
26 *
27 * <pre>
28 * Purpose
29 * =======
30 *
31 * Compute the reciprocal pivot growth factor of the leading ncols columns
32 * of the matrix, using the formula:
33 * min_j ( max_i(abs(A_ij)) / max_i(abs(U_ij)) )
34 *
35 * Arguments
36 * =========
37 *
38 * ncols (input) int
39 * The number of columns of matrices A, L and U.
40 *
41 * A (input) SuperMatrix*
42 * Original matrix A, permuted by columns, of dimension
43 * (A->nrow, A->ncol). The type of A can be:
44 * Stype = NC; Dtype = SLU_D; Mtype = GE.
45 *
46 * L (output) SuperMatrix*
47 * The factor L from the factorization Pr*A=L*U; use compressed row
48 * subscripts storage for supernodes, i.e., L has type:
49 * Stype = SC; Dtype = SLU_D; Mtype = TRLU.
50 *
51 * U (output) SuperMatrix*
52 * The factor U from the factorization Pr*A*Pc=L*U. Use column-wise
53 * storage scheme, i.e., U has types: Stype = NC;
54 * Dtype = SLU_D; Mtype = TRU.
55 * </pre>
56 */
57
58double
59dPivotGrowth(int ncols, SuperMatrix *A, int *perm_c,
60 SuperMatrix *L, SuperMatrix *U)
61{
62
63 NCformat *Astore;
64 SCformat *Lstore;
65 NCformat *Ustore;
66 double *Aval, *Lval, *Uval;
67 int fsupc, nsupr, luptr, nz_in_U;
68 int i, j, k, oldcol;
69 int *inv_perm_c;
70 double rpg, maxaj, maxuj;
71 double smlnum;
72 double *luval;
73
74 /* Get machine constants. */
75 smlnum = dmach("S");
76 rpg = 1. / smlnum;
77
78 Astore = A->Store;
79 Lstore = L->Store;
80 Ustore = U->Store;
81 Aval = Astore->nzval;
82 Lval = Lstore->nzval;
83 Uval = Ustore->nzval;
84
85 inv_perm_c = (int *) SUPERLU_MALLOC(A->ncol*sizeof(int))superlu_python_module_malloc(A->ncol*sizeof(int));
1
Calling 'superlu_python_module_malloc'
→
86 for (j = 0; j < A->ncol; ++j) inv_perm_c[perm_c[j]] = j;
87
88 for (k = 0; k <= Lstore->nsuper; ++k) {
89 fsupc = L_FST_SUPC(k)( Lstore->sup_to_col[k] );
90 nsupr = L_SUB_START(fsupc+1)( Lstore->rowind_colptr[fsupc+1] ) - L_SUB_START(fsupc)( Lstore->rowind_colptr[fsupc] );
91 luptr = L_NZ_START(fsupc)( Lstore->nzval_colptr[fsupc] );
92 luval = &Lval[luptr];
93 nz_in_U = 1;
94
95 for (j = fsupc; j < L_FST_SUPC(k+1)( Lstore->sup_to_col[k+1] ) && j < ncols; ++j) {
96 maxaj = 0.;
97 oldcol = inv_perm_c[j];
98 for (i = Astore->colptr[oldcol]; i < Astore->colptr[oldcol+1]; ++i)
99 maxaj = SUPERLU_MAX( maxaj, fabs(Aval[i]) )( (maxaj) > (fabs(Aval[i])) ? (maxaj) : (fabs(Aval[i])) );
100
101 maxuj = 0.;
102 for (i = Ustore->colptr[j]; i < Ustore->colptr[j+1]; i++)
103 maxuj = SUPERLU_MAX( maxuj, fabs(Uval[i]) )( (maxuj) > (fabs(Uval[i])) ? (maxuj) : (fabs(Uval[i])) );
104
105 /* Supernode */
106 for (i = 0; i < nz_in_U; ++i)
107 maxuj = SUPERLU_MAX( maxuj, fabs(luval[i]) )( (maxuj) > (fabs(luval[i])) ? (maxuj) : (fabs(luval[i])) );
108
109 ++nz_in_U;
110 luval += nsupr;
111
112 if ( maxuj == 0. )
113 rpg = SUPERLU_MIN( rpg, 1.)( (rpg) < (1.) ? (rpg) : (1.) );
114 else
115 rpg = SUPERLU_MIN( rpg, maxaj / maxuj )( (rpg) < (maxaj / maxuj) ? (rpg) : (maxaj / maxuj) );
116 }
117
118 if ( j >= ncols ) break;
119 }
120
121 SUPERLU_FREE(inv_perm_c)superlu_python_module_free(inv_perm_c);
122 return (rpg);
123}
←

/tmp/pyrefcon/scipy/scipy/sparse/linalg/dsolve/_superlu_utils.c

→
1/* Should be imported before Python.h */
2
3#include <Python.h>
4
5#define NO_IMPORT_ARRAY
6#define PY_ARRAY_UNIQUE_SYMBOL _scipy_sparse_superlu_ARRAY_API
7
8#include "_superluobject.h"
9#include <setjmp.h>
10
11
12/* Abort to be used inside the superlu module so that memory allocation
13 errors don't exit Python and memory allocated internal to SuperLU is freed.
14 Calling program should deallocate (using SUPERLU_FREE) all memory that could have
15 been allocated. (It's ok to FREE unallocated memory)---will be ignored.
16*/
17
18#ifndef WITH_THREAD
19static SuperLUGlobalObject superlu_py_global = {0};
20#endif
21
22static SuperLUGlobalObject *get_tls_global(void)
23{
24#ifndef WITH_THREAD
25 if (superlu_py_global.memory_dict == NULL((void*)0)) {
26 superlu_py_global.memory_dict = PyDict_New();
27 }
28 return &superlu_py_global;
29#else
30 PyObject *thread_dict;
31 SuperLUGlobalObject *obj;
32 const char *key = "scipy.sparse.linalg.dsolve._superlu.__global_object";
33
34 thread_dict = PyThreadState_GetDict();
35 if (thread_dict == NULL((void*)0)) {
36 /* Should never happen */
37 PyErr_SetString(PyExc_SystemError, "no thread state obtained");
38 return NULL((void*)0);
39 }
40
41 obj = (SuperLUGlobalObject*)PyDict_GetItemString(thread_dict, key);
42 if (obj && Py_TYPE(obj) == &SuperLUGlobalType) {
43 return obj;
44 }
45
46 obj = (SuperLUGlobalObject*)PyObject_New(SuperLUGlobalObject, &SuperLUGlobalType);
47 if (obj == NULL((void*)0)) {
48 return (SuperLUGlobalObject*)PyErr_NoMemory();
49 }
50 obj->memory_dict = PyDict_New();
51 obj->jmpbuf_valid = 0;
52
53 PyDict_SetItemString(thread_dict, key, (PyObject *)obj);
54
55 return obj;
56#endif
57}
58
59jmp_buf *superlu_python_jmpbuf(void)
60{
61 SuperLUGlobalObject *g;
62
63 g = get_tls_global();
64 if (g == NULL((void*)0)) {
65 abort();
66 }
67 g->jmpbuf_valid = 1;
68 return &g->jmpbuf;
69}
70
71void superlu_python_module_abort(char *msg)
72{
73 SuperLUGlobalObject *g;
74 NPY_ALLOW_C_API_DEF;
75
76 NPY_ALLOW_C_API;
77 g = get_tls_global();
78 if (g == NULL((void*)0)) {
79 /* We have to longjmp (or SEGV results), but the
80 destination is not known --- no choice but abort.
81 However, this should never happen.
82 */
83 abort();
84 }
85 PyErr_SetString(PyExc_RuntimeError, msg);
86
87 if (!g->jmpbuf_valid) {
88 abort();
89 }
90
91 g->jmpbuf_valid = 0;
92 NPY_DISABLE_C_API;
93
94 longjmp(g->jmpbuf, -1);
95}
96
97void *superlu_python_module_malloc(size_t size)
98{
99 SuperLUGlobalObject *g;
100 PyObject *key = NULL((void*)0);
101 void *mem_ptr;
102 NPY_ALLOW_C_API_DEF;
103
104 NPY_ALLOW_C_API;
2
←
Loop condition is false. Exiting loop
→
105 g = get_tls_global();
106 if (g
2.1
'g' is not equal to NULL
2.1
'g' is not equal to NULL
2.1
'g' is not equal to NULL
 == NULL((void*)0)) {
3
←
Taking false branch
→
107 return NULL((void*)0);
108 }
109 mem_ptr = malloc(size);
110 if (mem_ptr == NULL((void*)0)) {
4
←
Assuming 'mem_ptr' is not equal to NULL
→
5
←
Taking false branch
→
111 NPY_DISABLE_C_API;
112 return NULL((void*)0);
113 }
114 key = PyLong_FromVoidPtr(mem_ptr);
6
←
Calling 'PyLong_FromVoidPtr'
→
8
←
Returning from 'PyLong_FromVoidPtr'
→
14
←
PyObject ownership leak with reference count of 1
115 if (key == NULL((void*)0))
9
←
Assuming 'key' is not equal to NULL
→
10
←
Taking false branch
→
116 goto fail;
117 if (PyDict_SetItem(g->memory_dict, key, Py_None))
11
←
Assuming the condition is true
→
12
←
Taking true branch
→
118 goto fail;
13
←
Control jumps to line 125
→
119 Py_DECREF(key);
120 NPY_DISABLE_C_API;
121
122 return mem_ptr;
123
124 fail:
125 Py_XDECREF(key);
126 NPY_DISABLE_C_API;
127 free(mem_ptr);
128 superlu_python_module_abort
129 ("superlu_malloc: Cannot set dictionary key value in malloc.");
130 return NULL((void*)0);
131
132}
133
134void superlu_python_module_free(void *ptr)
135{
136 SuperLUGlobalObject *g;
137 PyObject *key;
138 PyObject *ptype, *pvalue, *ptraceback;
139 NPY_ALLOW_C_API_DEF;
140
141 if (ptr == NULL((void*)0))
142 return;
143
144 NPY_ALLOW_C_API;
145 g = get_tls_global();
146 if (g == NULL((void*)0)) {
147 abort();
148 }
149 PyErr_Fetch(&ptype, &pvalue, &ptraceback);
150 key = PyLong_FromVoidPtr(ptr);
151 /* This will only free the pointer if it could find it in the dictionary
152 * of already allocated pointers --- thus after abort, the module can free all
153 * the memory that "might" have been allocated to avoid memory leaks on abort
154 * calls.
155 */
156 if (!PyDict_DelItem(g->memory_dict, key)) {
157 free(ptr);
158 }
159 Py_DECREF(key);
160 PyErr_Restore(ptype, pvalue, ptraceback);
161 NPY_DISABLE_C_API;
162 return;
163}
164
165
166static void SuperLUGlobal_dealloc(SuperLUGlobalObject *self)
167{
168 PyObject *key, *value;
169 Py_ssize_t pos = 0;
170
171 while (PyDict_Next(self->memory_dict, &pos, &key, &value)) {
172 void *ptr;
173 ptr = PyLong_AsVoidPtr(value);
174 free(ptr);
175 }
176
177 Py_XDECREF(self->memory_dict);
178 PyObject_Del(self);
179}
180
181
182PyTypeObject SuperLUGlobalType = {
183 PyVarObject_HEAD_INIT(NULL((void*)0), 0)
184 "_SuperLUGlobal",
185 sizeof(SuperLUGlobalObject),
186 0,
187 (destructor)SuperLUGlobal_dealloc, /* tp_dealloc */
188 0, /* tp_print */
189 0, /* tp_getattr */
190 0, /* tp_setattr */
191 0, /* tp_compare / tp_reserved */
192 0, /* tp_repr */
193 0, /* tp_as_number */
194 0, /* tp_as_sequence */
195 0, /* tp_as_mapping */
196 0, /* tp_hash */
197 0, /* tp_call */
198 0, /* tp_str */
199 0, /* tp_getattro */
200 0, /* tp_setattro */
201 0, /* tp_as_buffer */
202 Py_TPFLAGS_DEFAULT, /* tp_flags */
203 NULL((void*)0), /* tp_doc */
204 0, /* tp_traverse */
205 0, /* tp_clear */
206 0, /* tp_richcompare */
207 0, /* tp_weaklistoffset */
208 0, /* tp_iter */
209 0, /* tp_iternext */
210 0, /* tp_methods */
211 0, /* tp_members */
212 0, /* tp_getset */
213 0, /* tp_base */
214 0, /* tp_dict */
215 0, /* tp_descr_get */
216 0, /* tp_descr_set */
217 0, /* tp_dictoffset */
218 0, /* tp_init */
219 0, /* tp_alloc */
220 0, /* tp_new */
221 0, /* tp_free */
222 0, /* tp_is_gc */
223 0, /* tp_bases */
224 0, /* tp_mro */
225 0, /* tp_cache */
226 0, /* tp_subclasses */
227 0, /* tp_weaklist */
228 0, /* tp_del */
229 0, /* tp_version_tag */
230};
231
232
233/*
234 * Stub for error handling; does nothing, as we don't want to spew debug output.
235 */
236
237int input_error(char *srname, int *info)
238{
239 return 0;
240}
241
242/*
243 * Stubs for Harwell Subroutine Library functions that SuperLU tries to call.
244 */
245
246void mc64id_(int *a)
247{
248 superlu_python_module_abort("chosen functionality not available");
249}
250
251void mc64ad_(int *a, int *b, int *c, int d[], int e[], double f[],
252 int *g, int h[], int *i, int j[], int *k, double l[],
253 int m[], int n[])
254{
255 superlu_python_module_abort("chosen functionality not available");
256}
←

/opt/pyrefcon/lib/pyrefcon/models/models/PyLong_FromVoidPtr.model

1#ifndef PyLong_FromVoidPtr
2struct _object;
3typedef struct _object PyObject;
4PyObject* clang_analyzer_PyObject_New_Reference();
5PyObject* PyLong_FromVoidPtr(void *p) {
6 return clang_analyzer_PyObject_New_Reference();
7
←
Setting reference count to 1
→
7}
8#else
9#warning "API PyLong_FromVoidPtr is defined as a macro."
10#endif