marinelay opened a new issue, #51042: URL: https://github.com/apache/arrow/issues/51042
### Describe the bug, including details regarding any error messages, version, and platform. ### Summary Several PyArrow APIs terminate the interpreter when an argument is not the documented Arrow wrapper type. The native crash sites are different, but each case appears to continue after an Arrow object conversion or cast failed. I found these cases while fuzzing Python C extension modules. ### Versions PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36 ### Reproducer Run each command independently in a fresh process. ```console python -c 'import pyarrow.dataset as ds; ds.ParquetReadOptions(binary_type=0)' python -c 'import pyarrow as pa; pa.SparseCOOTensor.from_tensor(0)' python -c 'import pyarrow.substrait as substrait; substrait.serialize_schema(0)' python -c 'import pyarrow.compute as pc; pc.IndexOptions(0).serialize()' ``` ```text ParquetReadOptions SIGSEGV (signal 11) SparseCOOTensor.from_tensor SIGSEGV (signal 11) substrait.serialize_schema SIGSEGV (signal 11) IndexOptions.serialize SIGSEGV (signal 11) ``` ### Input validation behavior I tested `None`, `bool`, `int`, `float`, `complex`, `str`, `bytes`, `bytearray`, `list`, `tuple`, `dict`, `set`, `object()`, and an Arrow object of the wrong wrapper class in separate processes. | API | Accepted input | | --- | --- | | `ParquetReadOptions(binary_type=...)` | `pyarrow.DataType`, `None` | | Sparse `from_tensor()` | `pyarrow.Tensor` | | `substrait.serialize_schema()` | `pyarrow.Schema` | | `IndexOptions(...).serialize()` | `pyarrow.Scalar` | Every tested value not listed as accepted for the corresponding API caused `SIGSEGV`. For `IndexOptions`, the invalid value is accepted during construction and the crash occurs later in `serialize()`. ### ASan/UBSan result I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation. The first sanitizer failures were: | API | First native failure | | --- | --- | | `ParquetReadOptions(binary_type=...)` | member call on a null `arrow::DataType` at `build/_dataset_parquet.cpp:19827` | | Sparse `from_tensor()` | reference binding to a null `arrow::Tensor` in `TensorToSparseCOOTensor()` at `pyarrow/src/arrow/python/numpy_convert.cc:545` | | `substrait.serialize_schema()` | invalid `arrow::Schema` reference in `_serialize_namedstruct_schema()` at `build/_substrait.cpp:11784` | | `IndexOptions(...).serialize()` | member access through a null `arrow::Scalar` at `cpp/src/arrow/scalar.cc:715` | ASan subsequently reports invalid reads on the corresponding native paths and aborts each process with exit code 134. This appears related to #51041, which reports the same kind of failure in `FunctionOptions.deserialize()`. If separate issues are preferred for each API, I would be happy to report them individually. ### Component(s) Python -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
