Skip to content

[BUG] Coverity reports out-of-bound-access in C++ code generated by Cython  #5668

@oleksandr-pavlyk

Description

@oleksandr-pavlyk

Describe the bug

Using Cython 3.0.2 and the following source code (named "my_pyx.pyx"):

# distutils: language = c++
# cython: language_level=3
# cython: linetrace=True

cdef class Foo:
    cdef double bar_

    def __cinit__(self, double bar):
        self.bar_ = bar

    cdef double get_bar(self):
        return self.bar_

    def get_square(self):
        return self.bar_ * self.bar_

    @property
    def bar(self):
        return self.get_square()

Generate C++ source file using cython -t -w $(pwd) --cplus my_pyx.pyx. The output is too large to be included verbatim in the ticket.

I built this extension: g++ my_pyx.cpp -fPIC -shared $(python3-config --includes) $(python3-config --ldflags) $(python3-config --libs) -o my_pyx.so.

Coverity scan on such extension flags a "Very high" out-of-bound access issue:

image

Code to reproduce the behaviour:

# distutils: language = c++
# cython: language_level=3
# cython: linetrace=True

cdef class Foo:
    cdef double bar_

    def __cinit__(self, double bar):
        self.bar_ = bar

    cdef double get_bar(self):
        return self.bar_

    def get_square(self):
        return self.bar_ * self.bar_

    @property
    def bar(self):
        return self.get_square()

Expected behaviour

No response

OS

Linux

Python version

No response

Cython version

3.0.2

Additional context

Although Coverity assigns this issue a very high priority, keep in mind it may be a false positive. Even if so, it would be nice to resolve it, since it generates many different hits if many Cython source files are used in the project.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions