Bug 800075 - Memory leaks and possible crashers found in newt-0.52.14-2.fc17 using gcc-with-cpychecker static analyzer
Memory leaks and possible crashers found in newt-0.52.14-2.fc17 using gcc-wit...
Status: CLOSED UPSTREAM
Product: Fedora
Classification: Fedora
Component: newt (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Lichvar
Fedora Extras Quality Assurance
http://fedorapeople.org/~dmalcolm/gcc...
:
Depends On:
Blocks: cpychecker
  Show dependency treegraph
 
Reported: 2012-03-05 12:19 EST by Dave Malcolm
Modified: 2013-03-21 14:38 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-21 14:38:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dave Malcolm 2012-03-05 12:19:21 EST
Description of problem:
I've been writing an experimental static analysis tool to detect bugs commonly occurring within C Python extension modules:
  https://fedorahosted.org/gcc-python-plugin/
  http://gcc-python-plugin.readthedocs.org/en/latest/cpychecker.html
  http://fedoraproject.org/wiki/Features/StaticAnalysisOfPythonRefcounts

I ran the latest version of the tool (in git master; post 0.9) on
newt-0.52.14-2.fc17.src.rpm, and it reports various errors.

You can see a list of errors here, triaged into categories (from most significant to least significant):
http://fedorapeople.org/~dmalcolm/gcc-python-plugin/2012-03-05/newt-0.52.14-2.fc17/

I've manually reviewed the issues reported by the tool.

Within the category "Reference leaks" the 6 issues reported appear to be genuine memory leaks (although the line numbering seems to be slightly incorrect):  within snackmodule.c:widgetListboxGetSel, "sel" gets allocated twice: with a non-empty selection, every call will leak the first list allocated (at line 1097).  Also the reference to the PyIntObject allocated at PyInt_FromLong((long) selection[i])) will be leaked (since PyList_Append adds a new reference, rather than stealing the one passed in ); if the int is > 256 then this will be a memory leak since a new PyIntObject will be allocated.

The bugs in widgetCheckboxTreeGetSel appear to be analogous to those in widgetListboxGetSel.


Within the category "Reference leak within initialization" the 2 issues reported are inconsequential (this code is called only once, at import).

Within the category "Segfaults within error-handling paths" the 10 issues reported look like genuine bugs, in that crashes could occur here under low-memory conditions (i.e. where an allocation fails, and the indicated call returns a NULL).

Within the category "Returning (PyObject*)NULL without setting an exception" the 1 issue reported may or may not be a genuine bug  (if it is, it's a minor one), depending on whether newtCheckboxTreeGetEntryValue sets an exception when it returns -1.

There may of course be other bugs in my checker tool.

Hope this is helpful; let me know if you need help reading the logs that the tool generates - I know that it could use some improvement.

Version-Release number of selected component (if applicable):
newt-0.52.14-2.fc17
gcc-python-plugin post-0.9 git 11462291a66c8db693c8884cb84b795bb5988ffb running the checker in an *f16* chroot
Comment 1 Miroslav Lichvar 2013-03-21 14:38:30 EDT
All reported problems should be fixed by:
http://git.fedorahosted.org/cgit/newt.git/commit/?id=c104daae027a1835e66d277dd292a1eb21f86baa

Thanks for the report, it's a very nice tool!

Note You need to log in before you can comment on or make changes to this bug.