R devel - Oct 1999 - main/character.c (et.al): dangerous AllocBuffer()

I was hit by ugly crashes of R, when I tried to read big data sets
("volcano").
So I looked into the code and found the following in character.c (triggered by
substr()):

I assume that the helper function AllocBuffer() shall facilitate an economic
memory management. But
the use of realloc() in the else-branch does not conform to ANSI and may hit you
with certain
compilers.

When called with len<0 the code is assumed to re-size buff to MAXELTSIZE:

	realloc(buff, 0);
	buff = (char *) realloc(buff, MAXELTSIZE);
	bufsize = MAXELTSIZE;
	
But in the first call of realloc() it is perfectly legal to return a new pointer
(which is thrown away
here), and then using (a possibly invalid) buff from earlier times may (and did
for me) crash your
program.

Why not use 
	free(buff);
	buff = malloc(MAXELTSIZE);
	bufsize = MAXELTSIZE;
instead? (Or just free(buff); bufsize=0;, you will malloc() the next
round, then).

Most of the UNIX compilers seem to keep the address of buff, so that you get
away with this.

BTW, a check for failing [re,m]alloc may be appropriate.
 		 
I hope this list is the right one for comments of this kind.

Regards,
Thomas. 		 
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
r-help mailing list -- Read http://www.ci.tuwien.ac.at/~hornik/R/R-FAQ.html
Send "info", "help", or "[un]subscribe"
(in the "body", not the subject !)  To: r-help-request at
stat.math.ethz.ch
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._

Thomas Hoffmann <hoffmann at ehmgs2.et.tu-dresden.de> writes:
> 	realloc(buff, 0);
> 	buff = (char *) realloc(buff, MAXELTSIZE);
> 	bufsize = MAXELTSIZE;
> 	
> But in the first call of realloc() it is perfectly legal to return a new
pointer (which is thrown away
> here), and then using (a possibly invalid) buff from earlier times may (and
did for me) crash your
> program.
...
> BTW, a check for failing [re,m]alloc may be appropriate.
>  		 
> I hope this list is the right one for comments of this kind.
Actually, r-devel is better, but thanks anyway...

-- 
   O__  ---- Peter Dalgaard             Blegdamsvej 3  
  c/ /'_ --- Dept. of Biostatistics     2200 Cph. N   
 (*) \(*) -- University of Copenhagen   Denmark      Ph: (+45) 35327918
~~~~~~~~~~ - (p.dalgaard at biostat.ku.dk)             FAX: (+45) 35327907
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
r-help mailing list -- Read http://www.ci.tuwien.ac.at/~hornik/R/R-FAQ.html
Send "info", "help", or "[un]subscribe"
(in the "body", not the subject !)  To: r-help-request at
stat.math.ethz.ch
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._

>>>>> " " == Thomas Hoffmann <hoffmann at
ehmgs2.et.tu-dresden.de> writes:
     > I was hit by ugly crashes of R, when I tried to read big data sets
     > ("volcano").  So I looked into the code and found the
following in
     > character.c (triggered by substr()):

     > I assume that the helper function AllocBuffer() shall facilitate an
     > economic memory management. But the use of realloc() in the
     > else-branch does not conform to ANSI and may hit you with certain
     > compilers.
 (technical stuff deleted)

This seems to explain the seg'faults I got when executing R programs that
manipulate really long strings (I recompiled R with MAXELTSIZE set to
1MEG), using substr and parse.

Thanks for your hints!

--  Dr. Joerg Kindermann             GMD - AiS
            German National Research Center for Information Technology
                Schloss Birlinghoven, D-53754 St. Augustin, Germany
                   phone: +49 02241 142437 fax: +49 02241 142342


-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
r-help mailing list -- Read http://www.ci.tuwien.ac.at/~hornik/R/R-FAQ.html
Send "info", "help", or "[un]subscribe"
(in the "body", not the subject !)  To: r-help-request at
stat.math.ethz.ch
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._

Thomas Hoffmann <hoffmann@ehmgs2.et.tu-dresden.de> writes:
> When called with len<0 the code is assumed to re-size buff to
MAXELTSIZE:
> 
> 	realloc(buff, 0);
> 	buff = (char *) realloc(buff, MAXELTSIZE);
> 	bufsize = MAXELTSIZE;
--etc--

Fixed as suggested (free+malloc)

-- 
   O__  ---- Peter Dalgaard             Blegdamsvej 3  
  c/ /'_ --- Dept. of Biostatistics     2200 Cph. N   
 (*) \(*) -- University of Copenhagen   Denmark      Ph: (+45) 35327918
~~~~~~~~~~ - (p.dalgaard@biostat.ku.dk)             FAX: (+45) 35327907
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
r-devel mailing list -- Read http://www.ci.tuwien.ac.at/~hornik/R/R-FAQ.html
Send "info", "help", or "[un]subscribe"
(in the "body", not the subject !)  To:
r-devel-request@stat.math.ethz.ch
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._