marinelay opened a new issue, #51043: URL: https://github.com/apache/arrow/issues/51043
### Describe the bug, including details regarding any error messages, version, and platform. ### Summary Several PyArrow APIs whose signatures require Arrow extension objects reject invalid types with `TypeError`, but accept `None` and then terminate the interpreter. I would expect `None` to be rejected with `TypeError`, like the other invalid types, rather than causing a process crash. I found these cases while fuzzing Python C extension modules. ### Versions PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36 ### Reproducer Run each command independently in a fresh process. ```console python -c 'import pyarrow.parquet as pq; pq.SortingColumn.from_ordering(None, [])' python -c 'import pyarrow as pa; import pyarrow.dataset as ds; ds.FileSystemDataset([None], pa.schema([]), ds.ParquetFileFormat())' python -c 'import pyarrow as pa; dictionary=pa.array([], type=pa.string()); buffers=[None, pa.py_buffer(b"")]; pa.DictionaryArray.from_buffers(None, 0, buffers, dictionary)' ``` ```text SortingColumn.from_ordering SIGSEGV (signal 11) FileSystemDataset SIGSEGV (signal 11) DictionaryArray.from_buffers SIGSEGV (signal 11) ``` ### ASan/UBSan result I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation. The first sanitizer failures were: | API | First native failure | | --- | --- | | `SortingColumn.from_ordering()` | member call on a null `arrow::Schema` in `parquet::arrow::ToParquetSchema()` at `cpp/src/parquet/arrow/schema.cc:1233` | | `FileSystemDataset()` | member access through a null `FileFragment` extension pointer at `build/_dataset.cpp:23011` | | `DictionaryArray.from_buffers()` | member call on a null `arrow::DataType` in `arrow::ArrayData::Make()` at `cpp/src/arrow/array/data.cc:118` | ASan subsequently reports zero-page reads on the corresponding native paths and aborts each process with exit code 134. ### Component(s) Python -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
