From suharto_anggono at yahoo.com  Mon Nov 14 17:12:22 2016
From: suharto_anggono at yahoo.com (Suharto Anggono Suharto Anggono)
Date: Mon, 14 Nov 2016 16:12:22 +0000 (UTC)
Subject: [Rd] Potential integer overflow in 'do_mapply'
References: <554070662.3822241.1479139942826.ref@mail.yahoo.com>
Message-ID: <554070662.3822241.1479139942826@mail.yahoo.com>

Function 'do_mapply' in mapply.c has the following fragment.
    for (int i = 0; i < longest; i++) {

Variable 'longest' is declared as R_xlen_t. Its value can be larger than the maximum int.

In the fragment, when 'longest' is larger than the maximum int, when 'i' reaches the maximum int, i++ will lead to overflow.



[Rd] Potential integer overflow in 'do_mapply'
Suharto Anggono Suharto Anggono