Evian-Zhang opened a new issue, #10378:
URL: https://github.com/apache/arrow-rs/issues/10378

   ### Describe the bug
   
   Split from #10281 
   
   Sources are located here:
   
   
https://github.com/apache/arrow-rs/blob/d9919194eef5ecca7f3b42726359a820825b30e6/arrow-buffer/src/buffer/mutable.rs#L536-L546
   
   If the mutex `self.reservation` was poisoned before, then the `unwrap` will 
leading to panic. However, The `mem::forget` has not yet been invoked, so both 
`bytes` and `self`'s drop implementation will be invoked when unwinding, and 
these two variable owns the same memory region, leading to a double free (both 
`Bytes` and `MutableBuffer`'s `drop` implementation involves 
`std::alloc::dealloc`)
   
   To fix it, I think we can just use `if let Some` instead of `unwrap` to the 
mutex.
   
   ### To Reproduce
   
   ```rust
   use arrow_buffer::buffer::MutableBuffer;
   use arrow_buffer::{MemoryPool, MemoryReservation};
   use std::panic::{AssertUnwindSafe, catch_unwind};
   
   #[derive(Debug)]
   struct PanicReservation;
   
   impl MemoryReservation for PanicReservation {
       fn size(&self) -> usize {
           0
       }
   
       fn resize(&mut self, _new_size: usize) {
           panic!("Issue 1: panic in resize to poison the mutex");
       }
   }
   
   #[derive(Debug)]
   struct PanicPool;
   
   impl MemoryPool for PanicPool {
       fn reserve(&self, _size: usize) -> Box<dyn MemoryReservation> {
           Box::new(PanicReservation)
       }
   
       fn available(&self) -> isize {
           isize::MAX
       }
   
       fn used(&self) -> usize {
           0
       }
   
       fn capacity(&self) -> usize {
           usize::MAX
       }
   }
   
   fn main() {
       let pool = PanicPool;
       let mut buf = MutableBuffer::with_capacity(128);
       buf.resize(64, 0);
       buf.claim(&pool);
   
       let result = catch_unwind(AssertUnwindSafe(|| {
           buf.resize(100, 0);
       }));
   
       let _ = catch_unwind(AssertUnwindSafe(|| {
           let _b: arrow_buffer::Buffer = buf.into();
       }));
   }
   ```
   
   ### Expected behavior
   
   No soundness issue happens
   
   ### Additional context
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to