Fuzzing Crash: Unsupported extension type in Arrow conversion

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-dtype/src/arrow.rs:262 in the to_arrow_dtype function

Error Message:

Unsupported extension type "example.ipv4"

Stack Trace:

   3: to_arrow_dtype
             at ./vortex-dtype/src/arrow.rs:262:21
   4: to_arrow_dtype
             at ./vortex-dtype/src/arrow.rs:234:28
   5: {closure#0}
             at ./vortex-array/src/arrow/compute/to_arrow/canonical.rs:109:46
   ...
  11: into_arrow_preferred
             at ./vortex-array/src/arrow/mod.rs:41:9
  12: arrow_compare
             at ./vortex-array/src/compute/compare.rs:333:36

Root Cause: The fuzzer created an ExtensionArray with a custom extension type "example.ipv4". When the test tries to perform a comparison operation, it attempts to convert the extension type to Arrow format. However, the to_arrow_dtype function only supports known temporal extension types (via is_temporal_ext_type), and bails with an error for any other extension type ID.

The issue is that the fuzzer can generate arbitrary extension type IDs, but the Arrow conversion code doesn't have a fallback strategy for unknown extension types (e.g., converting them to their storage type).

Debug Output

FuzzFileAction {
    array: ListViewArray {
        dtype: List(
            Extension(
                ExtDType {
                    id: ExtID(
                        "example.ipv4",
                    ),
                    storage_dtype: Bool(
                        Nullable,
                    ),
                    metadata: None,
                },
            ),
            Nullable,
        ),
        elements: ExtensionArray {
            dtype: Extension(
                ExtDType {
                    id: ExtID(
                        "example.ipv4",
                    ),
                    storage_dtype: Bool(
                        Nullable,
                    ),
                    metadata: None,
                },
            ),
            storage: BoolArray {
                dtype: Bool(
                    Nullable,
                ),
                bits: BitBuffer {
                    buffer: Buffer<u8> {
                        length: 1,
                        alignment: Alignment(
                            1,
                        ),
                        as_slice: [3],
                    },
                    offset: 0,
                    len: 3,
                },
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        offsets: PrimitiveArray {
            dtype: Primitive(
                U16,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 6,
                alignment: Alignment(
                    2,
                ),
                as_slice: [0, 0, 3, 0, 3, 0],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [
                            (
                                IsSorted,
                                Exact(
                                    ScalarValue(
                                        Bool(
                                            true,
                                        ),
                                    ),
                                ),
                            ),
                        ],
                    },
                },
            },
        },
        sizes: PrimitiveArray {
            dtype: Primitive(
                U16,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 6,
                alignment: Alignment(
                    2,
                ),
                as_slice: [3, 0, 0, 0, 0, 0],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        is_zero_copy_to_list: true,
        validity: AllValid,
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    projection_expr: None,
    filter_expr: None,
    compressor_strategy: Compact,
}

Summary

• Target: file_io
• Crash File: crash-4c9f9437bf8e76457bcc9aaa86d746fa96628f96
• Branch: alpha/ext
• Commit: 0e7ab69
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20531444854/artifacts/4973274592

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/20531444854/artifacts/4973274592
   • Or find io-fuzzing-crash-artifacts at: https://github.com/vortex-data/vortex/actions/runs/20531444854
   • Extract the zip file

2. Reproduce locally:

# The artifact contains file_io/crash-4c9f9437bf8e76457bcc9aaa86d746fa96628f96
cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-4c9f9437bf8e76457bcc9aaa86d746fa96628f96 -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-4c9f9437bf8e76457bcc9aaa86d746fa96628f96 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the file_io target.

Crash Details

Crash Location: vortex-dtype/src/arrow.rs:262 in to_arrow_dtype

Error Message:

Unsupported extension type "vortex.even"

Stack Trace:

   3: to_arrow_dtype
             at ./vortex-dtype/src/arrow.rs:262:21
   4: to_arrow_dtype
             at ./vortex-dtype/src/arrow.rs:234:28
   5: {closure#0}
             at ./vortex-array/src/arrow/compute/to_arrow/canonical.rs:109:46
   6: unwrap_or_else<core::result::Result<arrow_schema::datatype::DataType, vortex_error::VortexError>, vortex_array::arrow::compute::to_arrow::canonical::{impl#0}::invoke::{closure_env#0}>
             at /rustc/56f24e00c62ec2db9a8b407e7aef532caaf71062/library/core/src/option.rs:1067:21
   7: invoke
             at ./vortex-array/src/arrow/compute/to_arrow/canonical.rs:109:14
   8: invoke
             at ./vortex-array/src/arrow/compute/to_arrow/mod.rs:122:42
   9: invoke
             at ./vortex-array/src/compute/mod.rs:149:34
  10: to_arrow_opts
             at ./vortex-array/src/arrow/compute/to_arrow/mod.rs:77:10
  11: into_arrow_preferred
             at ./vortex-array/src/arrow/mod.rs:41:9
  12: arrow_compare
             at ./vortex-array/src/compute/compare.rs:333:36

Similarities to Original Issue:

• Exact same crash location: vortex-dtype/src/arrow.rs:262
• Same function: to_arrow_dtype
• Same error pattern: "Unsupported extension type" (only difference is the extension type ID)
• Same call stack through arrow_compare and to_arrow_dtype

Differences:

• Extension type ID: "vortex.even" (this crash) vs "example.ipv4" (original issue)
• Storage dtype: Primitive(I64, Nullable) vs Bool(Nullable)
• Note: These differences confirm the same root cause - the fuzzer generates arbitrary extension type IDs, and all non-temporal extension types fail in the same way

Debug Output

FuzzFileAction {
    array: ListViewArray {
        dtype: List(
            Extension(
                ExtDType {
                    id: ExtID(
                        "vortex.even",
                    ),
                    storage_dtype: Primitive(
                        I64,
                        Nullable,
                    ),
                    metadata: None,
                },
            ),
            Nullable,
        ),
        elements: ExtensionArray {
            dtype: Extension(
                ExtDType {
                    id: ExtID(
                        "vortex.even",
                    ),
                    storage_dtype: Primitive(
                        I64,
                        Nullable,
                    ),
                    metadata: None,
                },
            ),
            storage: PrimitiveArray {
                dtype: Primitive(
                    I64,
                    Nullable,
                ),
                buffer: Buffer<u8> {
                    length: 0,
                    alignment: Alignment(
                        8,
                    ),
                    as_slice: [],
                },
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        offsets: PrimitiveArray {
            dtype: Primitive(
                U16,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 6,
                alignment: Alignment(
                    2,
                ),
                as_slice: [0, 0, 0, 0, 0, 0],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [
                            (
                                IsSorted,
                                Exact(
                                    ScalarValue(
                                        Bool(
                                            true,
                                        ),
                                    ),
                                ),
                            ),
                        ],
                    },
                },
            },
        },
        sizes: PrimitiveArray {
            dtype: Primitive(
                U16,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 6,
                alignment: Alignment(
                    2,
                ),
                as_slice: [0, 0, 0, 0, 0, 0],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        is_zero_copy_to_list: true,
        validity: Array(
            BoolArray {
                dtype: Bool(
                    NonNullable,
                ),
                bits: BitBuffer {
                    buffer: Buffer<u8> {
                        length: 1,
                        alignment: Alignment(
                            1,
                        ),
                        as_slice: [4],
                    },
                    offset: 0,
                    len: 3,
                },
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ),
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    projection_expr: None,
    filter_expr: None,
    compressor_strategy: Compact,
}

Occurrence Details

• Crash File: crash-7bd9206a6ce80a6d446790a07982845c27dbbb9f
• Branch: alpha/ext
• Commit: 49d26e5
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20608064690/artifacts/4994742901

Reproduction

cargo +nightly fuzz run -D --sanitizer=none file_io file_io/crash-7bd9206a6ce80a6d446790a07982845c27dbbb9f -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[connortsui20]

This issue does not exist on develop, just on #5819