apache / apache/arrow

[Python] `MemoryMappedFile().resize()` segfaults when no file has been opened

Open
#51,229 0 comments 0 reactions 0 assignees View on GitHub
Component: Python Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

### Summary

`MemoryMappedFile` can be directly constructed without opening a file, and `resize()` on that object terminates the interpreter.
I found this while fuzzing Python C extension modules.
I think this unsupported state should raise a Python exception rather than terminate the process.

### Versions

PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36

### Reproducer

```python
import pyarrow as pa

pa.MemoryMappedFile().resize(0)
```

```console
Segmentation fault (core dumped)
```

### ASan/UBSan result

I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a member call on a null `arrow::io::MemoryMappedFile` in the generated wrapper:

```text
build/lib.cpp:252525:86: runtime error:
member call on null pointer of type 'arrow::io::MemoryMappedFile'

#0 pyarrow.lib.MemoryMappedFile.resize(...)
build/lib.cpp:252525:86

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
build/lib.cpp:252525:86
```

ASan then reports a read from address `0x28` on the same path.
The sanitizer process exits with code 134 after ASan aborts.

### Component(s)

Python

Contributor guide

Open the contributing guide

Research direction

Start by running the provided Python reproducer for pyarrow.lib.MemoryMappedFile.resize and inspect the generated wrapper path shown in build/lib.cpp:252525. Confirm the no-file state is handled without terminating the interpreter; done means the call raises a Python exception instead of segfaulting, with coverage for this reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.