From f2051846cb4daf1b95bcb98ea1d4cb0dbf3e20b8 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Mon, 10 Aug 2026 12:18:37 +0200 Subject: [PATCH] Fix Coverity OVERRUN false positive in _allocate_result Declare f_ndim as a C int so that f_ndim * sizeof(npy_intp) is computed as a plain C multiplication instead of being routed through a Python object. The untyped variable caused Cython to generate a __Pyx_PyLong_As_size_t conversion whose (size_t)-1 error sentinel led Coverity to report an out-of-bounds access (OVERRUN, CID 652776/652762) on the PyMem_Malloc/memcpy of f_shape. This mirrors b_ndim in _pad_array, which is already typed and was never flagged. --- CHANGELOG.md | 1 + mkl_fft/_pydfti.pyx | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2541b671..75768efb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed ### Fixed +* Declared `f_ndim` as a C `int` in `_allocate_result` so the buffer size is computed in C rather than through a Python object, resolving a Coverity out-of-bounds (OVERRUN) false positive [gh-364](https://github.com/IntelPython/mkl_fft/pull/364) ## [2.3.2] - 2026-08-04 diff --git a/mkl_fft/_pydfti.pyx b/mkl_fft/_pydfti.pyx index d9158da2..f6b90e28 100644 --- a/mkl_fft/_pydfti.pyx +++ b/mkl_fft/_pydfti.pyx @@ -302,6 +302,7 @@ cdef cnp.ndarray _allocate_result( cdef cnp.npy_intp *f_shape cdef cnp.ndarray f_arr "ff_arrayObject" cdef int x_arr_is_fortran + cdef int f_ndim f_ndim = cnp.PyArray_NDIM(x_arr)