pedrobtz opened a new pull request, #1006: URL: https://github.com/apache/arrow-nanoarrow/pull/1006
When `ArrowMalloc()` fails for the arrays, `ArrowBasicArrayStreamInit()` calls `ArrowBasicArrayStreamRelease(array_stream)` before it has set any of `array_stream`'s fields. The release callback then reads the caller's uninitialized `release` and `private_data`: if `release` happens to be non-NULL it dereferences an unset `private_data`, and if it is NULL nothing is released. Either way the schema, already moved into the private data, leaks. The fix moves the schema back to the caller and frees the private data. That matches the first allocation failure, which returns `ENOMEM` before taking the schema. The documentation now says that the caller keeps the schema when the function fails. The new `ArrayStreamTestInitError` test asks for `INT64_MAX / sizeof(struct ArrowArray)` arrays, so the second allocation fails. It expects `ENOMEM`, an untouched stream and a schema the caller still owns. Without the fix, the schema's `release` is NULL and the test fails. Like the other huge-allocation tests, it is skipped under `__SANITIZE_ADDRESS__`. This came up while reviewing nanoarrow for the [zuarrow](https://github.com/pedrobtz/zuarrow) R package, which vendors it. `ctest` passes in a plain build and with ASan and UBSan (411 tests; the sanitizer run needs `ASAN_OPTIONS=allocator_may_return_null=1` where the compiler does not define `__SANITIZE_ADDRESS__`, as for the existing huge-allocation tests). The changed files are formatted with the pinned clang-format 16.0.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
