Evian-Zhang opened a new issue, #10378: URL: https://github.com/apache/arrow-rs/issues/10378
### Describe the bug Split from #10281 Sources are located here: https://github.com/apache/arrow-rs/blob/d9919194eef5ecca7f3b42726359a820825b30e6/arrow-buffer/src/buffer/mutable.rs#L536-L546 If the mutex `self.reservation` was poisoned before, then the `unwrap` will leading to panic. However, The `mem::forget` has not yet been invoked, so both `bytes` and `self`'s drop implementation will be invoked when unwinding, and these two variable owns the same memory region, leading to a double free (both `Bytes` and `MutableBuffer`'s `drop` implementation involves `std::alloc::dealloc`) To fix it, I think we can just use `if let Some` instead of `unwrap` to the mutex. ### To Reproduce ```rust use arrow_buffer::buffer::MutableBuffer; use arrow_buffer::{MemoryPool, MemoryReservation}; use std::panic::{AssertUnwindSafe, catch_unwind}; #[derive(Debug)] struct PanicReservation; impl MemoryReservation for PanicReservation { fn size(&self) -> usize { 0 } fn resize(&mut self, _new_size: usize) { panic!("Issue 1: panic in resize to poison the mutex"); } } #[derive(Debug)] struct PanicPool; impl MemoryPool for PanicPool { fn reserve(&self, _size: usize) -> Box<dyn MemoryReservation> { Box::new(PanicReservation) } fn available(&self) -> isize { isize::MAX } fn used(&self) -> usize { 0 } fn capacity(&self) -> usize { usize::MAX } } fn main() { let pool = PanicPool; let mut buf = MutableBuffer::with_capacity(128); buf.resize(64, 0); buf.claim(&pool); let result = catch_unwind(AssertUnwindSafe(|| { buf.resize(100, 0); })); let _ = catch_unwind(AssertUnwindSafe(|| { let _b: arrow_buffer::Buffer = buf.into(); })); } ``` ### Expected behavior No soundness issue happens ### Additional context _No response_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
