Fix Coverity OVERRUN false positive in _allocate_result - #364
Merged
Conversation
Declare f_ndim as a C int so that f_ndim * sizeof(npy_intp) is computed as a plain C multiplication instead of being routed through a Python object. The untyped variable caused Cython to generate a __Pyx_PyLong_As_size_t conversion whose (size_t)-1 error sentinel led Coverity to report an out-of-bounds access (OVERRUN, CID 652776/652762) on the PyMem_Malloc/memcpy of f_shape. This mirrors b_ndim in _pad_array, which is already typed and was never flagged.
antonwolfy
marked this pull request as ready for review
August 10, 2026 10:29
antonwolfy
requested review from
jharlow-intel,
ndgrigorian,
vlad-perevezentsev and
xaleryb
as code owners
August 10, 2026 10:29
Collaborator
Author
|
The issue is resolved on the branch: |
vlad-perevezentsev
approved these changes
Aug 10, 2026
vlad-perevezentsev
left a comment
vlad-perevezentsev
left a comment
Collaborator
There was a problem hiding this comment.
LGTM
Thank you @antonwolfy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a Coverity out-of-bounds access (OVERRUN) finding reported in
__pyx_f_7mkl_fft_7_pydfti__allocate_result.The finding is a false positive, but it stems from a real code-quality issue:
f_ndimin_allocate_resultwas left untyped, so it was a Python object rather than a Cint.Root cause
Because
f_ndimwas a Python object, the expressionf_ndim * sizeof(cnp.npy_intp)was compiled as a Python-level multiplication (PyNumber_Multiply) followed by__Pyx_PyLong_As_size_t. That conversion returns the error sentinel(size_t)-1(18446744073709551615) on failure. Coverity explored the path where the sentinel reachesPyMem_Malloc/memcpywithout a Python exception being set, and reported an out-of-bounds write onf_shape.That state is unreachable at runtime —
f_ndimis a NumPy array's number of dimensions (0–64) — but the analyzer cannot prove it once the value is laundered through aPyObject.Tellingly, the structurally identical
memcpyin_pad_arraywas not flagged, because itsb_ndimis already declaredcdef int.Fix
Declare
f_ndimascdef int, matchingb_ndimin_pad_array. The size is then computed as a plain C multiplication, and the__Pyx_PyLong_As_size_tsentinel path disappears entirely from the generated C.