apache / apache/arrow

[Python] `flight` wrappers and `ParquetReader` segfault when used without initialized native state

Open
#51,230 2 comments 0 reactions 0 assignees View on GitHub
Component: Python Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

### Summary

Several exposed `flight` wrapper classes and `pyarrow.parquet.ParquetReader` can be directly constructed without the native state expected by their methods and properties.
The operations listed below terminate the interpreter with `SIGSEGV` when used on those objects.
I grouped these cases because multiple operations across both groups fail in the same uninitialized object state.

I think unsupported direct construction or use before `open()` should raise a Python exception rather than terminate the process.

### Versions

PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36.

### Reproducer

Run each operation independently in a fresh process.

```python
import pyarrow.flight as flight

flight.FlightMetadataReader().read()
flight.FlightStreamReader().read_all()
flight.MetadataRecordBatchReader().read_all()
flight.FlightStreamWriter().done_writing()
flight.MetadataRecordBatchWriter().close()
flight.FlightMetadataWriter().write(b"")
flight.ServerCallContext().peer()
```

```python
import pyarrow.parquet as parquet

parquet.ParquetReader().read_all()
parquet.ParquetReader().read_column(0)
parquet.ParquetReader().read_row_group(0)
parquet.ParquetReader().scan_contents()
parquet.ParquetReader().column_name_idx("name")
parquet.ParquetReader().set_batch_size(1)
parquet.ParquetReader().set_use_threads(True)
parquet.ParquetReader().column_paths
parquet.ParquetReader().num_row_groups
parquet.ParquetReader().schema_arrow
```

Each listed operation was recorded as terminating with:

```console
Segmentation fault (core dumped)
```

---

I found these cases while fuzzing Python C extension modules. If separate reports would be easier to track, I can split them by component.

### Component(s)

Python

Contributor guide

Open the contributing guide

Research direction

Start by running each listed reproducer in a fresh process, then trace the Python entry points for the flight wrapper classes and ParquetReader methods and properties. Done means every operation on an uninitialized object raises a Python exception instead of terminating the interpreter with SIGSEGV.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
backend-api-design, data-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.