Skip to content

[Python] KeyValueMetadata.key() segfaults on an out-of-range index #51019

Description

@marinelay

Describe the bug, including details regarding any error messages, version, and platform.

Summary

KeyValueMetadata.key(0) and KeyValueMetadata.value(0) cause a segmentation fault when called on an empty KeyValueMetadata object.

Versions

pyarrow 25.0.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.

Reproducer

Each call below reproduces independently.

import pyarrow as pa
pa.KeyValueMetadata().key(0)
import pyarrow as pa
pa.KeyValueMetadata().value(0)

Running either call produces:

Segmentation fault (core dumped)

An UBSan source build reports an out-of-range std::vector<std::string>::operator[] access from src/arrow/util/key_value_metadata.cc:169 or :175.


This was found while fuzzing Python C extension modules for a small research project.
It looks like a bug to me, but I would appreciate a check.
I would expect IndexError rather than an unchecked native vector access.

Component(s)

Python

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions