Describe the bug, including details regarding any error messages, version, and platform.
Summary
pyarrow.arange(-(1 << 63), 0) terminates Python with SIGSEGV.
This looks like a boundary-check bug, although the requested array size is deliberately extreme.
I would expect a range-size or allocation exception rather than a process crash.
I found this while fuzzing Python C extension modules.
Versions
PyArrow 25.0.1 and 25.0.1, CPython 3.12.3, Ubuntu 24.04.4 x86_64, glibc 2.39.
Reproducer
import pyarrow as pa
pa.arange(-(1 << 63), 0)
Input boundary
The same start value works for a small result: pa.arange(-(1 << 63), -(1 << 63) + 2).to_pylist() returns [-9223372036854775808, -9223372036854775807].
Only the very large requested length changes in the reproducer.
Component(s)
Python
Describe the bug, including details regarding any error messages, version, and platform.
Summary
pyarrow.arange(-(1 << 63), 0)terminates Python with SIGSEGV.This looks like a boundary-check bug, although the requested array size is deliberately extreme.
I would expect a range-size or allocation exception rather than a process crash.
I found this while fuzzing Python C extension modules.
Versions
PyArrow 25.0.1 and 25.0.1, CPython 3.12.3, Ubuntu 24.04.4 x86_64, glibc 2.39.
Reproducer
Input boundary
The same start value works for a small result:
pa.arange(-(1 << 63), -(1 << 63) + 2).to_pylist()returns[-9223372036854775808, -9223372036854775807].Only the very large requested length changes in the reproducer.
Component(s)
Python