[C++] ValidateFull() crashes on a union array whose type ids or offsets buffer is missing #54908

Describe the bug, including details regarding any error messages, version, and platform.

Validate() accepts a non-empty union array whose type ids buffer is null, or a dense union whose offsets buffer is null. ValidateFull() then dereferences the null buffer and crashes. Validation should instead report such data as invalid with an error status.

Reproducer (pyarrow 26.0.0 from PyPI, Python 3.12, Windows 11). The process dies with a segmentation fault:

import struct
import pyarrow as pa

t = pa.dense_union([pa.field("a", pa.int32())])
arr = pa.Array.from_buffers(t, 1, [None, None, pa.py_buffer(struct.pack("<i", 0))],
                            children=[pa.array([7], pa.int32())])
arr.validate()            # OK
arr.validate(full=True)   # segmentation fault

The same happens in two other cases:

• a sparse union whose type ids buffer is null ([None, None]);
• a dense union that has type ids but whose offsets buffer is null.

Cause:

• ValidateArrayImpl skips null buffers when it checks buffer sizes (validate.cc#L506-L515).
• Visit(const UnionType&) does not check that the type ids and offsets buffers are present.
• The full-validation branch then reads data.GetValues<int8_t>(1) and data.GetValues<int32_t>(2) unconditionally (L367, L389).

Binary and list types already have a check like this ("Non-empty array but offsets are null"). A similar presence check for non-empty union arrays would turn the crash into an error.

This was found with an AI-assisted analysis of the C++ code against the columnar format specification. The reproducer above was run against pyarrow 26.0.0.

Component(s)

C++