The arrow lib should have fuzzing tests for certain input formats, e.g. for reading record batches from streams. Ideally, malformed input must not crash the system but must report a proper error. This could easily be implemented e.g. w/ libfuzzer in combination with address sanitizer (that's already implemented by Arrow's build system).