From ripley at stats.ox.ac.uk  Wed Jan 16 12:19:30 2008
From: ripley at stats.ox.ac.uk (Prof Brian Ripley)
Date: Wed, 16 Jan 2008 11:19:30 +0000 (GMT)
Subject: [Rd] %s in filename when opening device causes crash (PR#10571)
In-Reply-To: <14877649.post@talk.nabble.com>
References: <20080114145006.C745B2834629@mail.pubhealth.ku.dk>
	<20080114175023.B5B242834612@mail.pubhealth.ku.dk>
	<478BA787.8060806@biostat.ku.dk>
	<Pine.LNX.4.64.0801141824520.12548@gannet.stats.ox.ac.uk>
	<14877649.post@talk.nabble.com>
Message-ID: <Pine.LNX.4.64.0801161042080.3928@gannet.stats.ox.ac.uk>

On Wed, 16 Jan 2008, Richard Cotton wrote:

>
>
>
> Prof Brian Ripley wrote:
>>
>>> Yes. The problem is of course that we do want a sprintf() format there
>>> for "Rplot%03d.pdf" et al. One  option would be to escape "%" except
>>> when in (regexp) "%[0-9]*d", which seems nontrivial, but not impossible.
>>
>> But there are other integer formats (%i, %u, %x, %X), and other flags (#
>> might be useful).  So the list of valid inputs is also rather long.  It
>> would be tedious to do at C level, but a check in the R-level wrapper
>> would be easier (if not 'simple').
>>
>
> Having just worked my way through the alphabet, I can say that it is only
> the letters 's' and 'n' that cause any problems.  Thus, if you do decide to
> handle the error in the R wrapper functions, the regex for bad inputs is
> fairly straightforward "%[#[:blank:]\\+\\-]*[[:digit:]]*[sn]".

Thanks: but %% (escaped %) should be allowed (and only ASCII blank is 
allowed as a flag, and only ASCII digits).

We decided to do the opposite and test for an allowed format
(you are only allowed to have one).  So the current check is

### Check for a single valid integer format
checkIntFormat <- function(s)
{
     ## OK if no unescaped %, so first remove those
     s <- gsub("%%", "", s)
     if(length(grep("%", s)) == 0) return(TRUE)
     ## now remove at most one valid(ish) integer format
     s <- sub("%[#0 +-]*[0-9.]*[diouxX]", "", s)
     length(grep("%", s)) == 0
}

The set of flags is debatable, and not yet final.  Not all strings that 
pass that test are valid formats, but hopefully the exceptions are

- rare
- will not crash R.

Empirical testing of crashing is not comprehensive and machine-dependent 
even if you use a tool like valgrind to detect violations (32- vs 64-bit 
issues, for example).

Unfortunately there *is* a C-level call to the postscript driver, so some 
C-level checking is needed.

-- 
Brian D. Ripley,                  ripley at stats.ox.ac.uk
Professor of Applied Statistics,  http://www.stats.ox.ac.uk/~ripley/
University of Oxford,             Tel:  +44 1865 272861 (self)
1 South Parks Road,                     +44 1865 272866 (PA)
Oxford OX1 3TG, UK                Fax:  +44 1865 272595



[Rd] %s in filename when opening device causes crash (PR#10571)
Prof Brian Ripley