New Defects reported by Coverity Scan for digiKam
scan-admin at coverity.com
scan-admin at coverity.com
Sun Jul 26 22:51:30 BST 2026
Hi,
Please find the latest report on new defect(s) introduced to digiKam found with Coverity Scan.
130 new defect(s) introduced to digiKam found with Coverity Scan.
1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 20 of 130 defect(s)
** CID 1697260: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/deepseek32.cpp: 114 in llama_model_deepseek32::load_arch_tensors(llama_model_loader &)()
_____________________________________________________________________________________________
*** CID 1697260: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/deepseek32.cpp: 114 in llama_model_deepseek32::load_arch_tensors(llama_model_loader &)()
108
109 // DSA indexer
110 layer.indexer_k_norm = create_tensor(tn(LLM_TENSOR_INDEXER_K_NORM, "weight", i), {hparams.indexer_head_size}, flags);
111 layer.indexer_k_norm_b = create_tensor(tn(LLM_TENSOR_INDEXER_K_NORM, "bias", i), {hparams.indexer_head_size}, flags);
112 layer.indexer_proj = create_tensor(tn(LLM_TENSOR_INDEXER_PROJ, "weight", i), {n_embd, hparams.indexer_n_head}, flags);
113 layer.indexer_attn_k = create_tensor(tn(LLM_TENSOR_INDEXER_ATTN_K, "weight", i), {n_embd, hparams.indexer_head_size}, flags);
>>> CID 1697260: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
>>> Potentially overflowing expression "this->hparams.indexer_n_head * this->hparams.indexer_head_size" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "int64_t const" (64 bits, signed).
114 layer.indexer_attn_q_b = create_tensor(tn(LLM_TENSOR_INDEXER_ATTN_Q_B, "weight", i), {q_lora_rank, hparams.indexer_n_head * hparams.indexer_head_size}, flags);
115 if (i < (int) hparams.n_layer_dense_lead) {
116 layer.ffn_gate = create_tensor(tn(LLM_TENSOR_FFN_GATE, "weight", i), {n_embd, n_ff}, flags);
117 layer.ffn_down = create_tensor(tn(LLM_TENSOR_FFN_DOWN, "weight", i), { n_ff, n_embd}, flags);
118 layer.ffn_up = create_tensor(tn(LLM_TENSOR_FFN_UP, "weight", i), {n_embd, n_ff}, flags);
119 } else {
** CID 1697259: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1313 in ggml_row_size()
_____________________________________________________________________________________________
*** CID 1697259: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1313 in ggml_row_size()
1307 assert(type >= 0);
1308 assert(type < GGML_TYPE_COUNT);
1309 return type_traits[type].type_size;
1310 }
1311
1312 size_t ggml_row_size(enum ggml_type type, int64_t ne) {
>>> CID 1697259: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1313 assert(type >= 0);
1314 assert(type < GGML_TYPE_COUNT);
1315 assert(ne % ggml_blck_size(type) == 0);
1316 return ggml_type_size(type)*ne/ggml_blck_size(type);
1317 }
1318
** CID 1697258: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1307 in ggml_type_size()
_____________________________________________________________________________________________
*** CID 1697258: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1307 in ggml_type_size()
1301 assert(type >= 0);
1302 assert(type < GGML_TYPE_COUNT);
1303 return type_traits[type].blck_size;
1304 }
1305
1306 size_t ggml_type_size(enum ggml_type type) {
>>> CID 1697258: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1307 assert(type >= 0);
1308 assert(type < GGML_TYPE_COUNT);
1309 return type_traits[type].type_size;
1310 }
1311
1312 size_t ggml_row_size(enum ggml_type type, int64_t ne) {
** CID 1697257: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/glm-dsa.cpp: 108 in llama_model_glm_dsa::load_arch_tensors(llama_model_loader &)()
_____________________________________________________________________________________________
*** CID 1697257: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/glm-dsa.cpp: 108 in llama_model_glm_dsa::load_arch_tensors(llama_model_loader &)()
102
103 // DSA indexer
104 layer.indexer_k_norm = create_tensor(tn(LLM_TENSOR_INDEXER_K_NORM, "weight", i), {hparams.indexer_head_size}, flags | TENSOR_NOT_REQUIRED);
105 layer.indexer_k_norm_b = create_tensor(tn(LLM_TENSOR_INDEXER_K_NORM, "bias", i), {hparams.indexer_head_size}, flags | TENSOR_NOT_REQUIRED);
106 layer.indexer_proj = create_tensor(tn(LLM_TENSOR_INDEXER_PROJ, "weight", i), {n_embd, hparams.indexer_n_head}, flags | TENSOR_NOT_REQUIRED);
107 layer.indexer_attn_k = create_tensor(tn(LLM_TENSOR_INDEXER_ATTN_K, "weight", i), {n_embd, hparams.indexer_head_size}, flags | TENSOR_NOT_REQUIRED);
>>> CID 1697257: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
>>> Potentially overflowing expression "this->hparams.indexer_n_head * this->hparams.indexer_head_size" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "int64_t const" (64 bits, signed).
108 layer.indexer_attn_q_b = create_tensor(tn(LLM_TENSOR_INDEXER_ATTN_Q_B, "weight", i), {q_lora_rank, hparams.indexer_n_head * hparams.indexer_head_size}, flags | TENSOR_NOT_REQUIRED);
109 if (i < (int) hparams.n_layer_dense_lead) {
110 layer.ffn_gate = create_tensor(tn(LLM_TENSOR_FFN_GATE, "weight", i), {n_embd, n_ff}, flags);
111 layer.ffn_down = create_tensor(tn(LLM_TENSOR_FFN_DOWN, "weight", i), { n_ff, n_embd}, flags);
112 layer.ffn_up = create_tensor(tn(LLM_TENSOR_FFN_UP, "weight", i), {n_embd, n_ff}, flags);
113 } else {
** CID 1697256: Null pointer dereferences (FORWARD_NULL)
_____________________________________________________________________________________________
*** CID 1697256: Null pointer dereferences (FORWARD_NULL)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama.cpp: 389 in llama_model_load_from_file_impl(gguf_context *, void (*)(ggml_tensor *, void *), void *, const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> &, _IO_FILE *, llama_model_params)()
383 }
384 }
385 return true;
386 };
387 }
388
>>> CID 1697256: Null pointer dereferences (FORWARD_NULL)
>>> Passing null pointer "metadata" to "llama_model_load", which dereferences it.
389 const auto [status, model] = llama_model_load(metadata, set_tensor_data, set_tensor_data_ud, path_model, splits, file, params);
390 GGML_ASSERT(status <= 0);
391 if (status < 0) {
392 if (status == -1) {
393 LLAMA_LOG_ERROR("%s: failed to load model\n", __func__);
394 } else if (status == -2) {
** CID 1697255: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1326 in ggml_type_name()
_____________________________________________________________________________________________
*** CID 1697255: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1326 in ggml_type_name()
1320 assert(type >= 0);
1321 assert(type < GGML_TYPE_COUNT);
1322 return ((double)(type_traits[type].type_size))/type_traits[type].blck_size;
1323 }
1324
1325 const char * ggml_type_name(enum ggml_type type) {
>>> CID 1697255: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1326 assert(type >= 0);
1327 assert(type < GGML_TYPE_COUNT);
1328 return type_traits[type].type_name;
1329 }
1330
1331 bool ggml_is_quantized(enum ggml_type type) {
** CID 1697254: Integer handling issues (INTEGER_OVERFLOW)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/nlsearch/searchllamabackend.cpp: 233 in Digikam::SearchLlamaWorker::slotDoInference(const QString &, int, float)()
_____________________________________________________________________________________________
*** CID 1697254: Integer handling issues (INTEGER_OVERFLOW)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/nlsearch/searchllamabackend.cpp: 233 in Digikam::SearchLlamaWorker::slotDoInference(const QString &, int, float)()
227
228 llama_memory_clear(llama_get_memory(ctx), true);
229
230 // 1. Tokenize the prompt
231 const QByteArray promptUtf8 = prompt.toUtf8();
232
>>> CID 1697254: Integer handling issues (INTEGER_OVERFLOW)
>>> Expression "-llama_tokenize(vocab, promptUtf8.constData(), promptUtf8.size(), NULL, 0, true, true)", where "llama_tokenize(vocab, promptUtf8.constData(), promptUtf8.size(), NULL, 0, true, true)" is known to be equal to -2147483648, overflows the type of "-llama_tokenize(vocab, promptUtf8.constData(), promptUtf8.size(), NULL, 0, true, true)", which is type "int32_t".
233 const int n_prompt = -llama_tokenize(vocab, promptUtf8.constData(), promptUtf8.size(),
234 nullptr, 0, true, true);
235
236 if (n_prompt <= 0)
237 {
238 Q_EMIT signalError(QLatin1String("Failed to tokenize the prompt."));
** CID 1697253: Performance inefficiencies (AUTO_CAUSES_COPY)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model.cpp: 2624 in llama_model_chat_template()
_____________________________________________________________________________________________
*** CID 1697253: Performance inefficiencies (AUTO_CAUSES_COPY)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model.cpp: 2624 in llama_model_chat_template()
2618
2619 uint64_t llama_model_size(const llama_model * model) {
2620 return model->size();
2621 }
2622
2623 const char * llama_model_chat_template(const llama_model * model, const char * name) {
>>> CID 1697253: Performance inefficiencies (AUTO_CAUSES_COPY)
>>> Using the "auto" keyword without an "&" causes the copy of an object of type "std::string".
2624 const auto key = name ? LLM_KV(model->arch, name)(LLM_KV_TOKENIZER_CHAT_TEMPLATE)
2625 : LLM_KV(model->arch)(LLM_KV_TOKENIZER_CHAT_TEMPLATE);
2626 const auto & it = model->gguf_kv.find(key);
2627 if (it == model->gguf_kv.end()) {
2628 // one-off fix for very popular models (so we are not flooded with issues)
2629 // do not extend this list unless absolutely necessary
** CID 1697252: (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/gemma4.cpp: 54 in llama_model_gemma4::load_arch_tensors(llama_model_loader &)()
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/gemma4.cpp: 53 in llama_model_gemma4::load_arch_tensors(llama_model_loader &)()
_____________________________________________________________________________________________
*** CID 1697252: (OVERFLOW_BEFORE_WIDEN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/gemma4.cpp: 54 in llama_model_gemma4::load_arch_tensors(llama_model_loader &)()
48 }
49
50 tok_embd = create_tensor(tn(LLM_TENSOR_TOKEN_EMBD, "weight"), {n_embd, n_vocab}, 0);
51
52 if (n_embd_per_layer > 0) {
53 per_layer_tok_embd = create_tensor(tn(LLM_TENSOR_PER_LAYER_TOKEN_EMBD, "weight"), {n_embd_per_layer * n_layer, n_vocab}, 0);
>>> CID 1697252: (OVERFLOW_BEFORE_WIDEN)
>>> Potentially overflowing expression "n_embd_per_layer * n_layer" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "int64_t const" (64 bits, signed).
54 per_layer_model_proj = create_tensor(tn(LLM_TENSOR_PER_LAYER_MODEL_PROJ, "weight", 0), {n_embd, n_embd_per_layer * n_layer}, 0);
55 per_layer_proj_norm = create_tensor(tn(LLM_TENSOR_PER_LAYER_PROJ_NORM, "weight", 0), {n_embd_per_layer}, 0);
56 }
57
58 output_norm = create_tensor(tn(LLM_TENSOR_OUTPUT_NORM, "weight"), {n_embd}, 0);
59
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/models/gemma4.cpp: 53 in llama_model_gemma4::load_arch_tensors(llama_model_loader &)()
47 output = create_tensor(tn(LLM_TENSOR_TOKEN_EMBD, "weight"), {n_embd, n_vocab}, TENSOR_DUPLICATED);
48 }
49
50 tok_embd = create_tensor(tn(LLM_TENSOR_TOKEN_EMBD, "weight"), {n_embd, n_vocab}, 0);
51
52 if (n_embd_per_layer > 0) {
>>> CID 1697252: (OVERFLOW_BEFORE_WIDEN)
>>> Potentially overflowing expression "n_embd_per_layer * n_layer" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "int64_t const" (64 bits, signed).
53 per_layer_tok_embd = create_tensor(tn(LLM_TENSOR_PER_LAYER_TOKEN_EMBD, "weight"), {n_embd_per_layer * n_layer, n_vocab}, 0);
54 per_layer_model_proj = create_tensor(tn(LLM_TENSOR_PER_LAYER_MODEL_PROJ, "weight", 0), {n_embd, n_embd_per_layer * n_layer}, 0);
55 per_layer_proj_norm = create_tensor(tn(LLM_TENSOR_PER_LAYER_PROJ_NORM, "weight", 0), {n_embd_per_layer}, 0);
56 }
57
58 output_norm = create_tensor(tn(LLM_TENSOR_OUTPUT_NORM, "weight"), {n_embd}, 0);
** CID 1697251: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 930 in ggml_get_type_traits()
_____________________________________________________________________________________________
*** CID 1697251: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 930 in ggml_get_type_traits()
924 .type_size = 0,
925 .is_quantized = false,
926 },
927 };
928
929 const struct ggml_type_traits * ggml_get_type_traits(enum ggml_type type) {
>>> CID 1697251: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
930 assert(type >= 0);
931 assert(type < GGML_TYPE_COUNT);
932 return &type_traits[type];
933 }
934
935 //
** CID 1697250: Control flow issues (UNREACHABLE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml-cpu/llamafile/sgemm.cpp: 4039 in llamafile_sgemm()
_____________________________________________________________________________________________
*** CID 1697250: Control flow issues (UNREACHABLE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml-cpu/llamafile/sgemm.cpp: 4039 in llamafile_sgemm()
4033 }
4034
4035 default:
4036 return false;
4037 }
4038
>>> CID 1697250: Control flow issues (UNREACHABLE)
>>> This code cannot be reached: "(void)params;".
4039 (void)params;
4040 (void)m;
4041 (void)n;
4042 (void)k;
4043 (void)A;
4044 (void)lda;
** CID 1697249: Null pointer dereferences (NULL_RETURNS)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 181 in ggml_print_backtrace()
_____________________________________________________________________________________________
*** CID 1697249: Null pointer dereferences (NULL_RETURNS)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 181 in ggml_print_backtrace()
175 #endif
176 #if defined(__linux__)
177 FILE * f = fopen("/proc/self/status", "r");
178 size_t size = 0;
179 char * line = NULL;
180 ssize_t length = 0;
>>> CID 1697249: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "f" when calling "getline". (The dereference is assumed on the basis of the "nonnull" parameter attribute.)
181 while ((length = getline(&line, &size, f)) > 0) {
182 if (!strncmp(line, "TracerPid:", sizeof("TracerPid:") - 1) &&
183 (length != sizeof("TracerPid:\t0\n") - 1 || line[length - 2] != '0')) {
184 // Already being debugged, and the breakpoint is the later abort()
185 free(line);
186 fclose(f);
** CID 1697248: Performance inefficiencies (PASS_BY_VALUE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/nlsearch/searchqueryengine.cpp: 123 in Digikam::SearchQueryEngine::slotInterpretQuery(const QString &, const QString &)::[lambda() (instance 1)]::operator ()() const()
_____________________________________________________________________________________________
*** CID 1697248: Performance inefficiencies (PASS_BY_VALUE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/nlsearch/searchqueryengine.cpp: 123 in Digikam::SearchQueryEngine::slotInterpretQuery(const QString &, const QString &)::[lambda() (instance 1)]::operator ()() const()
117 if (d->cache)
118 {
119 SearchQueryIntent cached;
120
121 if (d->cache->lookup(d->normalizedQuery, &cached))
122 {
>>> CID 1697248: Performance inefficiencies (PASS_BY_VALUE)
>>> Capturing variable "cached" of type "Digikam::SearchQueryIntent" (size 152 bytes) by value, which exceeds the low threshold of 128 bytes.
123 QTimer::singleShot(0, this, [this, cached]()
124 {
125 Q_EMIT signalIntentReady(cached);
126 }
127 );
128
** CID 1697247: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1320 in ggml_type_sizef()
_____________________________________________________________________________________________
*** CID 1697247: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1320 in ggml_type_sizef()
1314 assert(type < GGML_TYPE_COUNT);
1315 assert(ne % ggml_blck_size(type) == 0);
1316 return ggml_type_size(type)*ne/ggml_blck_size(type);
1317 }
1318
1319 double ggml_type_sizef(enum ggml_type type) {
>>> CID 1697247: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1320 assert(type >= 0);
1321 assert(type < GGML_TYPE_COUNT);
1322 return ((double)(type_traits[type].type_size))/type_traits[type].blck_size;
1323 }
1324
1325 const char * ggml_type_name(enum ggml_type type) {
** CID 1697246: Performance inefficiencies (COPY_INSTEAD_OF_MOVE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-kv-cache-dsv4.cpp: 148 in dsv4_build_raw_write_ubatch(const llama_ubatch &)()
_____________________________________________________________________________________________
*** CID 1697246: Performance inefficiencies (COPY_INSTEAD_OF_MOVE)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-kv-cache-dsv4.cpp: 148 in dsv4_build_raw_write_ubatch(const llama_ubatch &)()
142 /*.pos =*/ data->pos.data(),
143 /*.n_seq_id =*/ data->n_seq_id.data(),
144 /*.seq_id =*/ data->seq_id.data(),
145 /*.seq_id_unq =*/ data->seq_id_unq.data(),
146 /*.seq_idx =*/ data->seq_idx.data(),
147 /*.output =*/ data->output.data(),
>>> CID 1697246: Performance inefficiencies (COPY_INSTEAD_OF_MOVE)
>>> "data" is copied in call to copy constructor for class "std::shared_ptr<llama_ubatch::data_t>", when it could be moved instead.
148 /*.data =*/ data,
149 };
150
151 return res;
152 }
153
** CID 1697245: API usage errors (LOCK)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-quant.cpp: 747 in llama_tensor_quantize_impl(ggml_type, const float *, void *, long, long, long, const float *, std::vector<std::thread, std::allocator<std::thread>> &, int)::[lambda() (instance 1)]::operator ()() const()
_____________________________________________________________________________________________
*** CID 1697245: API usage errors (LOCK)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-quant.cpp: 747 in llama_tensor_quantize_impl(ggml_type, const float *, void *, long, long, long, const float *, std::vector<std::thread, std::allocator<std::thread>> &, int)::[lambda() (instance 1)]::operator ()() const()
741 // validate the quantized data
742 const size_t row_size = ggml_row_size(new_type, n_per_row);
743 void * this_data = (char *) new_data + first_row * row_size;
744 if (!ggml_validate_row_data(new_type, this_data, this_size)) {
745 std::unique_lock<std::mutex> lock(mutex);
746 valid = false;
>>> CID 1697245: API usage errors (LOCK)
>>> "~unique_lock" unlocks "lock" while it is unlocked. [Note: The source code implementation of the function has been overridden by a builtin model.]
747 break;
748 }
749 }
750 };
751 for (int it = 0; it < nthread - 1; ++it) {
752 workers.emplace_back(compute);
** CID 1697244: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1301 in ggml_blck_size()
_____________________________________________________________________________________________
*** CID 1697244: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1301 in ggml_blck_size()
1295
1296 size_t ggml_nbytes_pad(const struct ggml_tensor * tensor) {
1297 return GGML_PAD(ggml_nbytes(tensor), GGML_MEM_ALIGN);
1298 }
1299
1300 int64_t ggml_blck_size(enum ggml_type type) {
>>> CID 1697244: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1301 assert(type >= 0);
1302 assert(type < GGML_TYPE_COUNT);
1303 return type_traits[type].blck_size;
1304 }
1305
1306 size_t ggml_type_size(enum ggml_type type) {
** CID 1697243: (CHECKED_RETURN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model-loader.h: 57 in llama_model_loader::weight_name_comparer::operator ()(const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &, const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &) const()
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model-loader.h: 58 in llama_model_loader::weight_name_comparer::operator ()(const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &, const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &) const()
_____________________________________________________________________________________________
*** CID 1697243: (CHECKED_RETURN)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model-loader.h: 57 in llama_model_loader::weight_name_comparer::operator ()(const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &, const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &) const()
51
52 // custom comparator to sort weights more nicely by layer
53 struct weight_name_comparer {
54 bool operator()(const std::string & a, const std::string & b) const {
55 int a_layer = -1;
56 int b_layer = -1;
>>> CID 1697243: (CHECKED_RETURN)
>>> Calling "sscanf" without checking return value (as is done elsewhere 32 out of 40 times).
57 sscanf(a.c_str(), "blk.%d.", &a_layer);
58 sscanf(b.c_str(), "blk.%d.", &b_layer);
59 if (a_layer != b_layer) {
60 return a_layer < b_layer;
61 }
62 return a < b;
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/src/llama-model-loader.h: 58 in llama_model_loader::weight_name_comparer::operator ()(const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &, const std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> &) const()
52 // custom comparator to sort weights more nicely by layer
53 struct weight_name_comparer {
54 bool operator()(const std::string & a, const std::string & b) const {
55 int a_layer = -1;
56 int b_layer = -1;
57 sscanf(a.c_str(), "blk.%d.", &a_layer);
>>> CID 1697243: (CHECKED_RETURN)
>>> Calling "sscanf" without checking return value (as is done elsewhere 32 out of 40 times).
58 sscanf(b.c_str(), "blk.%d.", &b_layer);
59 if (a_layer != b_layer) {
60 return a_layer < b_layer;
61 }
62 return a < b;
63 }
** CID 1697242: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1332 in ggml_is_quantized()
_____________________________________________________________________________________________
*** CID 1697242: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml.c: 1332 in ggml_is_quantized()
1326 assert(type >= 0);
1327 assert(type < GGML_TYPE_COUNT);
1328 return type_traits[type].type_name;
1329 }
1330
1331 bool ggml_is_quantized(enum ggml_type type) {
>>> CID 1697242: Integer handling issues (CONSTANT_EXPRESSION_RESULT)
>>> "type >= 0" is always true regardless of the values of its operands. This occurs when converting to bool for an argument to a function call.
1332 assert(type >= 0);
1333 assert(type < GGML_TYPE_COUNT);
1334 return type_traits[type].is_quantized;
1335 }
1336
1337 const char * ggml_op_name(enum ggml_op op) {
** CID 1697241: Incorrect expression (COPY_PASTE_ERROR)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml-backend-meta.cpp: 586 in ggml_backend_meta_get_split_state(ggml_backend_meta_simple_tensor_container &, const ggml_tensor *, bool)::[lambda(const std::vector<ggml_backend_meta_split_state, std::allocator<ggml_backend_meta_split_state>> &) (instance 4)]::operator ()(const std::vector<ggml_backend_meta_split_state, std::allocator<ggml_backend_meta_split_state>> &) const()
_____________________________________________________________________________________________
*** CID 1697241: Incorrect expression (COPY_PASTE_ERROR)
/home/gilles/devel/GIT/DK.llm/core/utilities/searchwindow/thirdparty/llama.cpp/ggml/src/ggml-backend-meta.cpp: 586 in ggml_backend_meta_get_split_state(ggml_backend_meta_simple_tensor_container &, const ggml_tensor *, bool)::[lambda(const std::vector<ggml_backend_meta_split_state, std::allocator<ggml_backend_meta_split_state>> &) (instance 4)]::operator ()(const std::vector<ggml_backend_meta_split_state, std::allocator<ggml_backend_meta_split_state>> &) const()
580 ggml_backend_meta_split_state ret = src_ss[0];
581 ret.axis = GGML_BACKEND_SPLIT_AXIS_0;
582 ret.nr[0] = 1;
583 ret.n_segments = 1;
584 return ret;
585 }
>>> CID 1697241: Incorrect expression (COPY_PASTE_ERROR)
>>> "GGML_BACKEND_SPLIT_AXIS_MIRRORED" looks like a copy-paste error.
586 if (src_ss[1].axis == GGML_BACKEND_SPLIT_AXIS_1 && src_ss[0].axis == GGML_BACKEND_SPLIT_AXIS_MIRRORED) {
587 return src_ss[1];
588 }
589 if (src_ss[0].axis == GGML_BACKEND_SPLIT_AXIS_0 && src_ss[1].axis == GGML_BACKEND_SPLIT_AXIS_0) {
590 GGML_ASSERT(split_states_equal(src_ss[0], src_ss[1]));
591 return {assume_sync ? GGML_BACKEND_SPLIT_AXIS_MIRRORED : GGML_BACKEND_SPLIT_AXIS_PARTIAL, {0}, {1}, 1};
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/digikam?tab=overview
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/digikam-devel/attachments/20260726/0660f5f3/attachment-0001.htm>
More information about the Digikam-devel
mailing list