oversk7 opened a new issue, #54908:
URL: https://github.com/apache/arrow/issues/54908
### Describe the bug, including details regarding any error messages,
version, and platform.
`Validate()` accepts a non-empty union array whose type ids buffer is null,
or a dense union whose offsets buffer is null. `ValidateFull()` then
dereferences the null buffer and crashes. Validation should instead report such
data as invalid with an error status.
Reproducer (pyarrow 26.0.0 from PyPI, Python 3.12, Windows 11). The process
dies with a segmentation fault:
```python
import struct
import pyarrow as pa
t = pa.dense_union([pa.field("a", pa.int32())])
arr = pa.Array.from_buffers(t, 1, [None, None,
pa.py_buffer(struct.pack("<i", 0))],
children=[pa.array([7], pa.int32())])
arr.validate() # OK
arr.validate(full=True) # segmentation fault
```
The same happens in two other cases:
- a sparse union whose type ids buffer is null (`[None, None]`);
- a dense union that has type ids but whose offsets buffer is null.
Cause:
- `ValidateArrayImpl` skips null buffers when it checks buffer sizes
([validate.cc#L506-L515](https://github.com/apache/arrow/blob/373d64c02cb23663b63c5853099fca43a46c39fc/cpp/src/arrow/array/validate.cc#L506-L515)).
- `Visit(const UnionType&)` does not check that the type ids and offsets
buffers are present.
- The full-validation branch then reads `data.GetValues<int8_t>(1)` and
`data.GetValues<int32_t>(2)` unconditionally
([L367](https://github.com/apache/arrow/blob/373d64c02cb23663b63c5853099fca43a46c39fc/cpp/src/arrow/array/validate.cc#L367),
[L389](https://github.com/apache/arrow/blob/373d64c02cb23663b63c5853099fca43a46c39fc/cpp/src/arrow/array/validate.cc#L389)).
Binary and list types already have a check like this ("Non-empty array but
offsets are null"). A similar presence check for non-empty union arrays would
turn the crash into an error.
This was found with an AI-assisted analysis of the C++ code against the
columnar format specification. The reproducer above was run against pyarrow
26.0.0.
### Component(s)
C++
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
