You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "Evian-Zhang (via GitHub)" <gi...@apache.org> on 2026/07/19 03:39:01 UTC

[I] Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free [arrow-rs]

Evian-Zhang opened a new issue, #10378:
URL: https://github.com/apache/arrow-rs/issues/10378

   ### Describe the bug
   
   Split from #10281 
   
   Sources are located here:
   
   https://github.com/apache/arrow-rs/blob/d9919194eef5ecca7f3b42726359a820825b30e6/arrow-buffer/src/buffer/mutable.rs#L536-L546
   
   If the mutex `self.reservation` was poisoned before, then the `unwrap` will leading to panic. However, The `mem::forget` has not yet been invoked, so both `bytes` and `self`'s drop implementation will be invoked when unwinding, and these two variable owns the same memory region, leading to a double free (both `Bytes` and `MutableBuffer`'s `drop` implementation involves `std::alloc::dealloc`)
   
   To fix it, I think we can just use `if let Some` instead of `unwrap` to the mutex.
   
   ### To Reproduce
   
   ```rust
   use arrow_buffer::buffer::MutableBuffer;
   use arrow_buffer::{MemoryPool, MemoryReservation};
   use std::panic::{AssertUnwindSafe, catch_unwind};
   
   #[derive(Debug)]
   struct PanicReservation;
   
   impl MemoryReservation for PanicReservation {
       fn size(&self) -> usize {
           0
       }
   
       fn resize(&mut self, _new_size: usize) {
           panic!("Issue 1: panic in resize to poison the mutex");
       }
   }
   
   #[derive(Debug)]
   struct PanicPool;
   
   impl MemoryPool for PanicPool {
       fn reserve(&self, _size: usize) -> Box<dyn MemoryReservation> {
           Box::new(PanicReservation)
       }
   
       fn available(&self) -> isize {
           isize::MAX
       }
   
       fn used(&self) -> usize {
           0
       }
   
       fn capacity(&self) -> usize {
           usize::MAX
       }
   }
   
   fn main() {
       let pool = PanicPool;
       let mut buf = MutableBuffer::with_capacity(128);
       buf.resize(64, 0);
       buf.claim(&pool);
   
       let result = catch_unwind(AssertUnwindSafe(|| {
           buf.resize(100, 0);
       }));
   
       let _ = catch_unwind(AssertUnwindSafe(|| {
           let _b: arrow_buffer::Buffer = buf.into();
       }));
   }
   ```
   
   ### Expected behavior
   
   No soundness issue happens
   
   ### Additional context
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free [arrow-rs]

Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey closed issue #10378: Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free
URL: https://github.com/apache/arrow-rs/issues/10378


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free [arrow-rs]

Posted by "Rich-T-kid (via GitHub)" <gi...@apache.org>.
Rich-T-kid commented on issue #10378:
URL: https://github.com/apache/arrow-rs/issues/10378#issuecomment-5014172577

   as mentioned in https://github.com/apache/arrow-rs/issues/10281#issuecomment-5014002097, https://github.com/apache/arrow-rs/pull/10301 will close this when merged


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free [arrow-rs]

Posted by "Jefffrey (via GitHub)" <gi...@apache.org>.
Jefffrey commented on issue #10378:
URL: https://github.com/apache/arrow-rs/issues/10378#issuecomment-5503785535

   thanks for confirming @Rich-T-kid 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Panics in `MutableBuffer::into_buffer()` break invariants in `arrow-buffer`, leading to double free [arrow-rs]

Posted by "Rich-T-kid (via GitHub)" <gi...@apache.org>.
Rich-T-kid commented on issue #10378:
URL: https://github.com/apache/arrow-rs/issues/10378#issuecomment-5503694163

   @Jefffrey #10301 also closes this


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org