From alistair.gee at gmail.com  Sat Mar 13 01:37:07 2010
From: alistair.gee at gmail.com (Alistair Gee)
Date: Fri, 12 Mar 2010 16:37:07 -0800
Subject: [Rd] list_files() memory corruption?
Message-ID: <e63850351003121637rc13612et6fbd55fd453757f7@mail.gmail.com>

I am using R-2-10 from subversion.

In the implementation of do_listfiles() in platform.c, it appears to
allocate a vector of length count where count is calculated by
count_files(). It then proceeds to call list_files(), passing in the
vector but not the value of count. Yet list_files() doesn't seem to
check the length of the vector that was allocated.

What happens if a new file was added to the file system between the
call to count_files() and list_files()? Doesn't this write past the
length of the allocated vector?

--



[Rd] list_files() memory corruption?
Alistair Gee