apache / apache/arrow

[Python] `KeyValueMetadata.key()` segfaults on an out-of-range index

Open
#51,019 4 comments 0 reactions 1 assignee Claimed by @waterWang View on GitHub
Component: Python Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

### Summary

`KeyValueMetadata.key(0)` and `KeyValueMetadata.value(0)` cause a segmentation fault when called on an empty `KeyValueMetadata` object.

### Versions

pyarrow 25.0.0, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.

### Reproducer

Each call below reproduces independently.

```python
import pyarrow as pa
pa.KeyValueMetadata().key(0)
```

```python
import pyarrow as pa
pa.KeyValueMetadata().value(0)
```

Running either call produces:

```console
Segmentation fault (core dumped)
```

An UBSan source build reports an out-of-range `std::vector::operator[]` access from `src/arrow/util/key_value_metadata.cc:169` or `:175`.

---

This was found while fuzzing Python C extension modules for a small research project.
It looks like a bug to me, but I would appreciate a check.
I would expect `IndexError` rather than an unchecked native vector access.

### Component(s)

Python

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.