Skip to content

[Python] MemoryMappedFile().resize() segfaults when no file has been opened #51229

Description

@marinelay

Describe the bug, including details regarding any error messages, version, and platform.

Summary

MemoryMappedFile can be directly constructed without opening a file, and resize() on that object terminates the interpreter.
I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than terminate the process.

Versions

PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36

Reproducer

import pyarrow as pa

pa.MemoryMappedFile().resize(0)
Segmentation fault (core dumped)

ASan/UBSan result

I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a member call on a null arrow::io::MemoryMappedFile in the generated wrapper:

build/lib.cpp:252525:86: runtime error:
member call on null pointer of type 'arrow::io::MemoryMappedFile'

    #0 pyarrow.lib.MemoryMappedFile.resize(...)
       build/lib.cpp:252525:86

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
build/lib.cpp:252525:86

ASan then reports a read from address 0x28 on the same path.
The sanitizer process exits with code 134 after ASan aborts.

Component(s)

Python

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions