Repository navigation
[Python] FunctionOptions.deserialize() segfaults on non-buffer arguments #51041
Description
Summary
pyarrow.compute.FunctionOptions.deserialize() terminates the interpreter when passed an object that is not a pyarrow.Buffer.
I found this while fuzzing Python C extension modules.
I realize these are invalid argument types, but I would expect a Python exception rather than a process crash.
Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
Reproducer
Each call below reproduces independently in a fresh process.
import pyarrow.compute as pc
pc.FunctionOptions.deserialize(None)
pc.FunctionOptions.deserialize(1)
pc.FunctionOptions.deserialize([])
pc.FunctionOptions.deserialize(b"")Segmentation fault (core dumped)ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a reference binding to a null arrow::Buffer in std::shared_ptr::operator*():
bits/shared_ptr_base.h:1350:9: runtime error:
reference binding to null pointer of type 'arrow::Buffer'
#0 std::__shared_ptr_access<arrow::Buffer>::operator*() const
bits/shared_ptr_base.h:1350:2
#1 pyarrow.compute.FunctionOptions.deserialize(...)
build/_compute.cpp:23161:82
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
bits/shared_ptr_base.h:1350:9
ASan then reports a read from address 0x10 in arrow::Buffer::ToString() at cpp/src/arrow/buffer.cc:106.
The sanitizer process exits with code 134 after ASan aborts.
Component(s)
Python
Activity
[-]`FunctionOptions.deserialize()` segfaults on non-buffer arguments[/-][+][Python] `FunctionOptions.deserialize()` segfaults on non-buffer arguments[/+]apacheGH-51041: [Python] Reject non-Buffer FunctionOptions.deserializ…
AlenkaF commentedon Sep 10, 2026
@1fanwang can you comment on this issue so I can assign it to you?
1fanwang commentedon Sep 10, 2026
thanks @AlenkaF commenting for assignment
GH-51041: [Python] Reject non-Buffer FunctionOptions.deserialize input (
AlenkaF commentedon Sep 10, 2026
Issue resolved by pull request 51129
#51129