marinelay opened a new issue, #51044:
URL: https://github.com/apache/arrow/issues/51044
### Describe the bug, including details regarding any error messages,
version, and platform.
### Summary
`BufferReader.readinto()` terminates the interpreter when its destination is
a read-only buffer, including `bytes` and read-only `memoryview` objects.
I found this while fuzzing Python C extension modules.
I would expect a read-only destination to be rejected with `TypeError` or
`BufferError` rather than causing a process crash.
### Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
### Reproducer
```python
import pyarrow as pa
pa.BufferReader(b"x").readinto(b"a")
```
```console
Segmentation fault (core dumped)
```
### UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using UBSan instrumentation.
UBSan reports that `BufferReader.readinto()` passes a null destination
pointer to `memcpy()`:
```text
cpp/src/arrow/io/memory.cc:343:12: runtime error:
null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
#0 arrow::io::BufferReader::DoReadAt(...)
cpp/src/arrow/io/memory.cc:343:5
#1 arrow::io::BufferReader::DoRead(...)
cpp/src/arrow/io/memory.cc:373:3
#2 arrow::io::internal::RandomAccessFileConcurrencyWrapper<
arrow::io::BufferReader>::Read(...)
cpp/src/arrow/io/concurrency.h:181:23
#3 pyarrow.lib.NativeFile.readinto(...)
build/lib.cpp:244518:86
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
cpp/src/arrow/io/memory.cc:343:12
```
### Component(s)
Python
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
