Repository navigation
[Python] BufferReader.readinto() segfaults on a read-only destination #51044
Description
Summary
BufferReader.readinto() terminates the interpreter when its destination is a read-only buffer, including bytes and read-only memoryview objects.
I found this while fuzzing Python C extension modules.
I would expect a read-only destination to be rejected with TypeError or BufferError rather than causing a process crash.
Versions
PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36
Reproducer
import pyarrow as pa
pa.BufferReader(b"x").readinto(b"a")Segmentation fault (core dumped)UBSan result
I built PyArrow 25.0.0 from source with Clang 18 using UBSan instrumentation.
UBSan reports that BufferReader.readinto() passes a null destination pointer to memcpy():
cpp/src/arrow/io/memory.cc:343:12: runtime error:
null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:44:28: note: nonnull attribute specified here
#0 arrow::io::BufferReader::DoReadAt(...)
cpp/src/arrow/io/memory.cc:343:5
#1 arrow::io::BufferReader::DoRead(...)
cpp/src/arrow/io/memory.cc:373:3
#2 arrow::io::internal::RandomAccessFileConcurrencyWrapper<
arrow::io::BufferReader>::Read(...)
cpp/src/arrow/io/concurrency.h:181:23
#3 pyarrow.lib.NativeFile.readinto(...)
build/lib.cpp:244518:86
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
cpp/src/arrow/io/memory.cc:343:12
Component(s)
Python
Activity
carrerasdarren-cell commentedon Sep 1, 2026
take
apacheGH-51044: [Python] Group readinto buffer test with buffer tests
GH-51044: [Python] Reject read-only readinto destinations (#51126)
raulcd commentedon Sep 9, 2026
Issue resolved by pull request 51126
#51126