Repository navigation
Validate Arrow structures in fromarrow() - #10350
Open
aclark4life wants to merge 9 commits into
Open
aclark4life wants to merge 9 commits into
aclark4life wants to merge 9 commits into
Conversation
Raise ValueError instead of crashing for malformed Arrow C Data Interface structures with a NULL format, buffers or children, or a negative offset. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aclark4life
marked this pull request as ready for review
October 29, 2026 02:21
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
radarhere
reviewed
Nov 3, 2026
|
|
||
| :py:func:`~PIL.Image.fromarrow` now raises a :py:exc:`ValueError` for some | ||
| malformed Arrow structures, such as missing formats, buffers or children, or a | ||
| negative offset, rather than crashing. |
Member
There was a problem hiding this comment.
While this is a helpful change, my feeling would be that it's not a vulnerability, and users with correct code don't need to change their behaviour, so we don't need to tell everyone about it in the release notes?
radarhere
approved these changes
Nov 3, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Image.fromarrow()currently trusts the Arrow C Data Interface structures it is given. If a producer passes NULL pointers, the process crashes with a segfault. This PR adds defensive checks to those cases so they raiseValueErrorinstead of crashing:schema->formatis NULLchildrenorchildren[0]is NULLbuffersorbuffers[1]is NULLoffset+w:4, butchildren[0]or its format is NULL