Describe the bug, including details regarding any error messages, version, and platform.
Summary
MemoryMappedFile can be directly constructed without opening a file, and resize() on that object terminates the interpreter.
I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than terminate the process.
Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
Reproducer
import pyarrow as pa
pa.MemoryMappedFile().resize(0)
Segmentation fault (core dumped)
ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a member call on a null arrow::io::MemoryMappedFile in the generated wrapper:
build/lib.cpp:252525:86: runtime error:
member call on null pointer of type 'arrow::io::MemoryMappedFile'
#0 pyarrow.lib.MemoryMappedFile.resize(...)
build/lib.cpp:252525:86
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
build/lib.cpp:252525:86
ASan then reports a read from address 0x28 on the same path.
The sanitizer process exits with code 134 after ASan aborts.
Component(s)
Python
Describe the bug, including details regarding any error messages, version, and platform.
Summary
MemoryMappedFilecan be directly constructed without opening a file, andresize()on that object terminates the interpreter.I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than terminate the process.
Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
Reproducer
Segmentation fault (core dumped)ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a member call on a null
arrow::io::MemoryMappedFilein the generated wrapper:ASan then reports a read from address
0x28on the same path.The sanitizer process exits with code 134 after ASan aborts.
Component(s)
Python