Umbrella issue: bottleneck C Extension Analysis Report

[devdanzin]

Below is part of an analysis report created by cext-review-toolkit. It contains segfaults under OOM, memory leaks on error paths (~80 KB per invalid partition/argpartition call), a per-call reference leak in rankdata on non-C-contiguous arrays, systemic missing NULL checks in INIT/INIT_ONE macros affecting ~46 generated functions, and unchecked malloc in mm_new/mm_new_nan. The full report is available at https://gist.github.com/devdanzin/b9ce99c1971afa418b6a24ca575c67c5.

This is meant as an umbrella issue from which specific sub issues can be created.

bottleneck C Extension Analysis Report

Findings by Priority

FIX

• move_median MEMORY_ERR without return — segfault under OOM #519
• partition/argpartition leak ~80 KB per invalid-kth error #520
• rankdata/nanrankdata leak 1 reference per call on non-C-contiguous arrays #521
• nonreducer_axis RUNTIME_ERR without return — falls through to NULL dereference #522
• rankdata/nanrankdata: unchecked PyArray_ArgSort and PyArray_EMPTY — NULL dereference #523
• push: unchecked PyArray_Copy — NULL dereference on OOM #524
• INIT and INIT_ONE macros: unchecked PyArray_EMPTY — NULL dereference in ~46 functions #525
• mm_new/mm_new_nan: three unchecked malloc calls — segfault on OOM #526
• Missing pystr_kth in intern_strings return check #527

CONSIDER

• PyArray_Ravel unchecked in iterators.h init_iter_all — NULL dereference and ref leak #528
• BUFFER_NEW macro: unchecked malloc inside GIL-released region #529
• Module object leaked on import_array/intern_strings failure in all PyInit functions #530
• error_converting + TYPE_ERR clobbers original exception (~15 sites) #531
• Py_MOD_GIL_NOT_USED declared but global state unprotected for free-threading #532

---

Summary Table

#	Finding	Classification	Confidence
1-2	#519 move_median MEMORY_ERR segfault	FIX	HIGH
3-4	#520 partition/argpartition ~80 KB leak on error	FIX	HIGH
5	#521 nonreducer_axis Ravel reference leak + NULL	FIX	HIGH
6	#522 nonreducer_axis RUNTIME_ERR without return	FIX	HIGH
7-8	#523 rankdata/nanrankdata unchecked ArgSort+EMPTY	FIX	HIGH
9	#524 push unchecked PyArray_Copy	FIX	HIGH
10-11	#525 INIT/INIT_ONE macro unchecked EMPTY (~46 functions)	FIX	HIGH
12-14	#526 mm_new/mm_new_nan unchecked malloc + mm_free on NULL	FIX	HIGH
15	#527 Missing pystr_kth check	FIX	HIGH
16	#528 iterators.h Ravel unchecked	CONSIDER	HIGH
17	#529 BUFFER_NEW unchecked malloc	CONSIDER	HIGH
18	#530 Module leak on init failure	CONSIDER	MEDIUM
19	#531 Exception clobbering (~15 sites)	CONSIDER	MEDIUM
20	#532 Free-threading global state	CONSIDER	HIGH

[rgommers]

Hi @devdanzin, I've seen your work on cext-review-toolkit before and think it's quite useful, so I appreciate this issue and the linked bug reports. That said, I recommend on other projects to not open many issues at once, it might get you banned given that many OSS projects struggle with "AI slop" spam.

I assume you validated all the linked bug reports, and they're real and need fixing?