apache / apache/arrow

[R] ALTREP crash in base R due to use-after-free

Open
#51,198 5 comments 0 reactions 1 assignee Claimed by @thisisnic View on GitHub
Component: R Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

`arrow::array_string_vector` `Elt()` method returns a newly created `CHARSXP` without keeping it reachable from the source vector, leading to a crash/segfault. Here is a short minimal reproducer: https://gist.github.com/traversc/a5204821451198d457edc38cceda9d90

This is the same class of bug as in vroom https://github.com/tidyverse/vroom/pull/638. vroom's fix is to cache accessed strings on the external pointer's protected slot and reuse that cache on materialize.

I understand when ALTREP became available, it was understood that CHARSXPs did not need to be rooted. But that was never correct and was a latent bug for many years. See here for more details: https://bugs.r-project.org/show_bug.cgi?id=19135

### Component(s)

R

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.