marinelay opened a new issue, #51229:
URL: https://github.com/apache/arrow/issues/51229
### Describe the bug, including details regarding any error messages,
version, and platform.
### Summary
`MemoryMappedFile` can be directly constructed without opening a file, and
`resize()` on that object terminates the interpreter.
I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than
terminate the process.
### Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
### Reproducer
```python
import pyarrow as pa
pa.MemoryMappedFile().resize(0)
```
```console
Segmentation fault (core dumped)
```
### ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan
instrumentation.
UBSan reports a member call on a null `arrow::io::MemoryMappedFile` in the
generated wrapper:
```text
build/lib.cpp:252525:86: runtime error:
member call on null pointer of type 'arrow::io::MemoryMappedFile'
#0 pyarrow.lib.MemoryMappedFile.resize(...)
build/lib.cpp:252525:86
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
build/lib.cpp:252525:86
```
ASan then reports a read from address `0x28` on the same path.
The sanitizer process exits with code 134 after ASan aborts.
### Component(s)
Python
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
