marinelay opened a new issue, #51041:
URL: https://github.com/apache/arrow/issues/51041
### Describe the bug, including details regarding any error messages,
version, and platform.
### Summary
`pyarrow.compute.FunctionOptions.deserialize()` terminates the interpreter
when passed an object that is not a `pyarrow.Buffer`.
I found this while fuzzing Python C extension modules.
I realize these are invalid argument types, but I would expect a Python
exception rather than a process crash.
### Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
### Reproducer
Each call below reproduces independently in a fresh process.
```python
import pyarrow.compute as pc
pc.FunctionOptions.deserialize(None)
pc.FunctionOptions.deserialize(1)
pc.FunctionOptions.deserialize([])
pc.FunctionOptions.deserialize(b"")
```
```console
Segmentation fault (core dumped)
```
### ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan
instrumentation.
UBSan reports a reference binding to a null `arrow::Buffer` in
`std::shared_ptr::operator*()`:
```text
bits/shared_ptr_base.h:1350:9: runtime error:
reference binding to null pointer of type 'arrow::Buffer'
#0 std::__shared_ptr_access<arrow::Buffer>::operator*() const
bits/shared_ptr_base.h:1350:2
#1 pyarrow.compute.FunctionOptions.deserialize(...)
build/_compute.cpp:23161:82
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
bits/shared_ptr_base.h:1350:9
```
ASan then reports a read from address `0x10` in `arrow::Buffer::ToString()`
at `cpp/src/arrow/buffer.cc:106`.
The sanitizer process exits with code 134 after ASan aborts.
### Component(s)
Python
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
