[Python] `MemoryMappedFile().resize()` segfaults when no file has been opened
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug, including details regarding any error messages, version, and platform.
### Summary
`MemoryMappedFile` can be directly constructed without opening a file, and `resize()` on that object terminates the interpreter.
I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than terminate the process.
### Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
### Reproducer
```python
import pyarrow as pa
pa.MemoryMappedFile().resize(0)
```
```console
Segmentation fault (core dumped)
```
### ASan/UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a member call on a null `arrow::io::MemoryMappedFile` in the generated wrapper:
```text
build/lib.cpp:252525:86: runtime error:
member call on null pointer of type 'arrow::io::MemoryMappedFile'
#0 pyarrow.lib.MemoryMappedFile.resize(...)
build/lib.cpp:252525:86
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
build/lib.cpp:252525:86
```
ASan then reports a read from address `0x28` on the same path.
The sanitizer process exits with code 134 after ASan aborts.
### Component(s)
Python
Contributor guide
Research direction
Start by running the provided Python reproducer for pyarrow.lib.MemoryMappedFile.resize and inspect the generated wrapper path shown in build/lib.cpp:252525. Confirm the no-file state is handled without terminating the interpreter; done means the call raises a Python exception instead of segfaulting, with coverage for this reproducer.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 70/100