bit2swaz commented on issue #10253: URL: https://github.com/apache/arrow-rs/issues/10253#issuecomment-5062000279
confirmed. `try_new` is safe but calls `get_stream_schema` which derefs and calls the caller's `get_schema` fn pointer. every field of `FFI_ArrowArrayStream` is public so safe code can pass a stream with garbage callbacks and hit UB without ever writing `unsafe`. the `release.is_none()` check only catches an already-released stream imo the simplest fix is making `try_new` `unsafe` with a `# Safety` note. both `from_raw`s in the same file are already `unsafe` for this exact reason, so this just brings the last door in line. the real callers (arrow-pyarrow) already get their stream from `from_raw` / `_export_to_c` so they only need an `unsafe` block. private fields would work too but that breaks the `#[repr(C)]` ABI that external producers fill for no extra soundness its a breaking change so it wants a major release. @Jefffrey any preference on the fix and which milestone? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
