[Bug]: count_bboxes_overlapping_bbox() segfaults on a malformed ragged bbox #32261

Bug summary

count_bboxes_overlapping_bbox() terminates the interpreter when passed a malformed ragged bbox.
I found this while fuzzing Python C extension modules.
I realize this is not a realistic input or usage pattern, but I would expect a Python exception rather than a process crash.

Code for reproduction

from matplotlib.transforms import count_bboxes_overlapping_bbox

count_bboxes_overlapping_bbox([[[[None]], None]], None)

Actual outcome

Segmentation fault (core dumped)

Expected outcome

(I would expect this to raise a Python exception rather than crash the process.)

Additional information

I built Matplotlib 3.11.1 and NumPy 2.5.2 from source with Clang 18 using ASan and UBSan instrumentation.
UBSan first reports member access through a null PyArray_Proxy in pybind11::array::ndim():

pybind11/numpy.h:1142:63: runtime error:
member access within null pointer of type 'PyArray_Proxy'

    #0 pybind11::array::ndim() const
       pybind11/numpy.h:1142:63
    #1 pybind11::detail::type_caster<agg::rect_base<double>>::load(...)
       src/py_converters.h:64:26

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
pybind11/numpy.h:1142:63

ASan then reports a read from address 0x18 on the same call path:

AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018
The signal is caused by a READ memory access.
Hint: address points to the zero page.

    #0 pybind11::array::ndim() const
       pybind11/numpy.h:1142:63
    #1 pybind11::detail::type_caster<agg::rect_base<double>>::load(...)
       src/py_converters.h:64:26

SUMMARY: AddressSanitizer: SEGV in pybind11::array::ndim() const

The sanitizer process exits with code 134 after ASan aborts.

Operating system

Debian 12 x86_64

Matplotlib Version

3.11.1

Matplotlib Backend

No response

Python version

3.12.3

Jupyter version

No response

Installation

pip