[Python] `FunctionOptions.deserialize()` segfaults on non-buffer arguments

[marinelay]

Summary

pyarrow.compute.FunctionOptions.deserialize() terminates the interpreter when passed an object that is not a pyarrow.Buffer.
I found this while fuzzing Python C extension modules.
I realize these are invalid argument types, but I would expect a Python exception rather than a process crash.

Versions

PyArrow 25.0.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36

Reproducer

Each call below reproduces independently in a fresh process.

import pyarrow.compute as pc

pc.FunctionOptions.deserialize(None)
pc.FunctionOptions.deserialize(1)
pc.FunctionOptions.deserialize([])
pc.FunctionOptions.deserialize(b"")

Segmentation fault (core dumped)

ASan/UBSan result

I built PyArrow 25.0.0 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan reports a reference binding to a null arrow::Buffer in std::shared_ptr::operator*():

bits/shared_ptr_base.h:1350:9: runtime error:
reference binding to null pointer of type 'arrow::Buffer'

    #0 std::__shared_ptr_access<arrow::Buffer>::operator*() const
       bits/shared_ptr_base.h:1350:2
    #1 pyarrow.compute.FunctionOptions.deserialize(...)
       build/_compute.cpp:23161:82

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
bits/shared_ptr_base.h:1350:9

ASan then reports a read from address 0x10 in arrow::Buffer::ToString() at cpp/src/arrow/buffer.cc:106.
The sanitizer process exits with code 134 after ASan aborts.

Component(s)

Python

[AlenkaF]

@1fanwang can you comment on this issue so I can assign it to you?

[1fanwang]

@1fanwang can you comment on this issue so I can assign it to you?

thanks @AlenkaF commenting for assignment

[AlenkaF]

Issue resolved by pull request 51129
#51129