[ARROW-6618] [Python] Reading a zero-size buffer can segfault

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.15.0
• Component/s: Python
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/22973
• Assignee: Antoine Pitrou
• Reporter: Joris Van den Bossche
• Created: 19/Sep/19 09:46
• Updated: 11/Jan/23 07:48
• Resolved: 19/Sep/19 23:54

Description

Simplest reproducible code is:

pa.read_message(b'')

which gives a segfault.

You can easily run into this interactively when eg by accident passing a already-read buffer to it, like:

serialized = pa.schema([('a', pa.int64())]).serialize().to_pybytes()
buffer = pa.BufferReader(serialized)
pa.read_message(buffer)
pa.read_message(buffer)

And for example, if you compare to read_schema, this gives an error on the second time / empty buffer:

>>> pa.read_schema(buffer)
>>> pa.read_schema(buffer)
...
ArrowInvalid: Tried reading schema message, was null or length 0

I know this is not proper usage of Buffer(Reader), but since it is easy to accidentally do this, we should try to protect users from this I think.

Issue Links

• links to: GitHub Pull Request #5437