<p dir="auto">After modifying the value of the <code class="notranslate">indices</code> attribute of a <code class="notranslate">csr_matrix</code>, several operations on the matrix produce segfaults. However, other sparse matrix types (<code class="notranslate">lil_matrix</code> and <code class="notranslate">coo_matrix</code>) do not. Therefore, I suspect this is because CSR matrix compresses the row indices.</p>
<p dir="auto">I have not come across any legitimate use case for modifying <code class="notranslate">indices</code> directly. Although I have not dug into the source code, perhaps the easiest fix would be to make <code class="notranslate">indices</code> read-only from outside the <code class="notranslate">_cs_matrix</code> class.</p>
<p dir="auto">I would be happy to open a PR if needed.</p>
<h4 dir="auto">Reproducing code example:</h4>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="from scipy.sparse import csr_matrix
import numpy as np

a = csr_matrix(np.arange(16).reshape((4, 4)))
b = csr_matrix(np.eye(4))

a.indices = [0] # This should not be allowed

# Each of these lines run individually produce segfaults 

# print(a.toarray()) 
# print(np.sum(a))
# print(a @ b)"><pre class="notranslate"><code class="notranslate">from scipy.sparse import csr_matrix
import numpy as np

a = csr_matrix(np.arange(16).reshape((4, 4)))
b = csr_matrix(np.eye(4))

a.indices = [0] # This should not be allowed

# Each of these lines run individually produce segfaults 

# print(a.toarray()) 
# print(np.sum(a))
# print(a @ b)
</code></pre></div>
<p dir="auto">Note that this is not an exhaustive list of operations. There are likely other operations which segfault as well.</p>
<h4 dir="auto">Error message:</h4>

<p dir="auto">This is the backtrace for the first line that segfaults (<code class="notranslate">print(a.toarray())</code>)</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="#0  0x00007fffe7a9373c in ?? ()
   from /home/anag004/.local/lib/python3.6/site-packages/scipy/sparse/_sparsetools.cpython-36m-x86_64-linux-gnu.so
#1  0x00007fffe7a7e77e in ?? ()
   from /home/anag004/.local/lib/python3.6/site-packages/scipy/sparse/_sparsetools.cpython-36m-x86_64-linux-gnu.so
#2  0x000000000050a2bf in ?? ()
#3  0x000000000050bfb4 in _PyEval_EvalFrameDefault ()
#4  0x0000000000507d64 in ?? ()
#5  0x0000000000509a90 in ?? ()
#6  0x000000000050a48d in ?? ()
#7  0x000000000050bfb4 in _PyEval_EvalFrameDefault ()
#8  0x0000000000507d64 in ?? ()
#9  0x000000000050ae13 in PyEval_EvalCode ()
#10 0x0000000000634c82 in ?? ()
#11 0x0000000000634d37 in PyRun_FileExFlags ()
#12 0x00000000006384ef in PyRun_SimpleFileExFlags ()
#13 0x0000000000639091 in Py_Main ()
#14 0x00000000004b0d00 in main ()"><pre class="notranslate"><code class="notranslate">#0  0x00007fffe7a9373c in ?? ()
   from /home/anag004/.local/lib/python3.6/site-packages/scipy/sparse/_sparsetools.cpython-36m-x86_64-linux-gnu.so
#1  0x00007fffe7a7e77e in ?? ()
   from /home/anag004/.local/lib/python3.6/site-packages/scipy/sparse/_sparsetools.cpython-36m-x86_64-linux-gnu.so
#2  0x000000000050a2bf in ?? ()
#3  0x000000000050bfb4 in _PyEval_EvalFrameDefault ()
#4  0x0000000000507d64 in ?? ()
#5  0x0000000000509a90 in ?? ()
#6  0x000000000050a48d in ?? ()
#7  0x000000000050bfb4 in _PyEval_EvalFrameDefault ()
#8  0x0000000000507d64 in ?? ()
#9  0x000000000050ae13 in PyEval_EvalCode ()
#10 0x0000000000634c82 in ?? ()
#11 0x0000000000634d37 in PyRun_FileExFlags ()
#12 0x00000000006384ef in PyRun_SimpleFileExFlags ()
#13 0x0000000000639091 in Py_Main ()
#14 0x00000000004b0d00 in main ()
</code></pre></div>
<h4 dir="auto">Scipy/Numpy/Python version information:</h4>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="1.4.1 1.18.4 sys.version_info(major=3, minor=6, micro=9, releaselevel='final', serial=0)"><pre class="notranslate"><code class="notranslate">1.4.1 1.18.4 sys.version_info(major=3, minor=6, micro=9, releaselevel='final', serial=0)
</code></pre></div>
<p dir="auto">A <code class="notranslate">csr_matrix</code> can be constructed with malformed data (column indices that are out of bounds) without crashing. This can lead to later segfaults when (I guess) out of bounds memory is accessed. In my application, it didn't crash 100% of the time, but was more random, as is common with out-of-bounds memory accesses. I would expect the construction of the <code class="notranslate">csr_matrix</code> to fail, or at least the documentation should reflect that this can lead to undefined behavior if your parameters is incorrect.</p>
<h3 dir="auto">Reproducing code example:</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="from scipy.sparse import csr_matrix

data = [1.0, 1.0]
indices = [1001, 555]
indptr = [0, 1, 2]
shape = (2, 1000)

mat = csr_matrix((data, indices, indptr), shape=shape)
print &quot;constructed csr_matrix&quot;
print mat * mat.T
"><pre class="notranslate"><code class="notranslate">from scipy.sparse import csr_matrix

data = [1.0, 1.0]
indices = [1001, 555]
indptr = [0, 1, 2]
shape = (2, 1000)

mat = csr_matrix((data, indices, indptr), shape=shape)
print "constructed csr_matrix"
print mat * mat.T

</code></pre></div>
<p dir="auto">The matrix has a width of 1000, but the column indices list places something in column 1001, which is out of bounds. The seg fault occurs on the <code class="notranslate">print mat * mat.T</code> line, not the construction of the matrix with the malformed parameters.</p>
<h3 dir="auto">Error message:</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ python test.py
constructed csr_matrix
Segmentation fault (core dumped)"><pre class="notranslate"><code class="notranslate">$ python test.py
constructed csr_matrix
Segmentation fault (core dumped)
</code></pre></div>
<h3 dir="auto">Scipy/Numpy/Python version information:</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="('1.0.0', '1.14.0', sys.version_info(major=2, minor=7, micro=6, releaselevel='final', serial=0))"><pre class="notranslate"><code class="notranslate">('1.0.0', '1.14.0', sys.version_info(major=2, minor=7, micro=6, releaselevel='final', serial=0))
</code></pre></div>
<p dir="auto">I'm running on Ubuntu 14.04 on a 64-bit x86 processor.</p>