This issue does not affect users with working NumPy installations, the affected code runs only when NumPy initialization fails. It is a defensive hardening opportunity I encountered while chasing a separate memory issue through my project's dependencies.
The affected file is Bio/Align/substitution_matrices/_arraycore.c on the current Biopython master branch.
Expected behaviour
If numpy.ndarray is missing, invalid, or unsuitable as a base type, _arraycore should abort initialization while releasing exactly the temporary references it owns.
Actual behaviour
The initializer decrements the NumPy module reference after retrieving numpy.ndarray, then decrements the same reference again when the attribute is missing or is not a type. Other early returns can retain the temporary numpy.ndarray reference.
This can corrupt or imbalance CPython reference counts during failed module initialization.
Steps to reproduce
Load _arraycore in a fresh CPython process with a stub numpy module where ndarray is either missing or not a type. Both cases exercise the incorrect cleanup paths.
I have a tested fix ready that balances the temporary references and uses PyModule_AddType for the successful ownership transfer. I can open a pull request if the maintainers would like this failure path hardened.
This issue does not affect users with working NumPy installations, the affected code runs only when NumPy initialization fails. It is a defensive hardening opportunity I encountered while chasing a separate memory issue through my project's dependencies.
The affected file is
Bio/Align/substitution_matrices/_arraycore.con the current Biopythonmasterbranch.Expected behaviour
If
numpy.ndarrayis missing, invalid, or unsuitable as a base type,_arraycoreshould abort initialization while releasing exactly the temporary references it owns.Actual behaviour
The initializer decrements the NumPy module reference after retrieving
numpy.ndarray, then decrements the same reference again when the attribute is missing or is not a type. Other early returns can retain the temporarynumpy.ndarrayreference.This can corrupt or imbalance CPython reference counts during failed module initialization.
Steps to reproduce
Load
_arraycorein a fresh CPython process with a stubnumpymodule wherendarrayis either missing or not a type. Both cases exercise the incorrect cleanup paths.I have a tested fix ready that balances the temporary references and uses
PyModule_AddTypefor the successful ownership transfer. I can open a pull request if the maintainers would like this failure path hardened.