From luke at stat.uiowa.edu  Sat Aug  9 13:18:36 2003
From: luke at stat.uiowa.edu (Luke Tierney)
Date: Sat Aug  9 19:18:16 2003
Subject: [Rd] segmentation fault: formula() with long variable names
	(PR#3680)
In-Reply-To: <200308071832.h77IWoJH013390@pubhealth.ku.dk>
Message-ID: <Pine.LNX.4.44.0308091215130.656-100000@itasca2.stat.uiowa.edu>

On Thu, 7 Aug 2003 jerome@hivnet.ubc.ca wrote:

> R version: 1.7.1
> OS: Red Hat Linux 7.2
> 
> In this example, I would expect an error for the overly long variable 
> name. This is always reproducable for me.
> 
> > formula(paste("y~",paste(rep("x",50000),collapse="")))
> Segmentation fault
> 
> Sincerely,
> Jerome Asselin

The problem seems to be in parse, which formula.default calls:

> parse(text=paste(rep("x",50000),collapse=""))
Segmentation fault (core dumped)

We were filling the yytext buffer in gram.y with no overflow checking.
I've added some checking in R-devel, so these now give

> parse(text=paste(rep("x",50000),collapse=""))
Error in parse(text = paste(rep("x", 50000), collapse = "")) : 
	input buffer overflow
> formula(paste("y~",paste(rep("x",50000),collapse="")))
Error in parse(text = x) : input buffer overflow

luke


-- 
Luke Tierney
University of Iowa                  Phone:             319-335-3386
Department of Statistics and        Fax:               319-335-3017
   Actuarial Science
241 Schaeffer Hall                  email:      luke@stat.uiowa.edu
Iowa City, IA 52242                 WWW:  http://www.stat.uiowa.edu


[Rd] segmentation fault: formula() with long variable names (PR#3680)
Luke Tierney