R devel - Aug 2003 - segmentation fault: formula() with long variable names (PR#3680)

R version: 1.7.1
OS: Red Hat Linux 7.2

In this example, I would expect an error for the overly long variable 
name. This is always reproducable for me.
>
formula(paste("y~",paste(rep("x",50000),collapse="")))
Segmentation fault

Sincerely,
Jerome Asselin

-- 

Jerome Asselin (Jérôme), Statistical Analyst
British Columbia Centre for Excellence in HIV/AIDS
St. Paul's Hospital, 608 - 1081 Burrard Street
Vancouver, British Columbia, CANADA V6Z 1Y6
Email: jerome@hivnet.ubc.ca
Phone: 604 806-9112   Fax: 604 806-9044

jerome@hivnet.ubc.ca writes:
> R version: 1.7.1
> OS: Red Hat Linux 7.2
> 
> In this example, I would expect an error for the overly long variable 
> name. This is always reproducable for me.
> 
> >
formula(paste("y~",paste(rep("x",50000),collapse="")))
> Segmentation fault
Also in (reasonably) current r-devel. But why would you want to do
that?

The cause of the crash is that R_GlobalContext is getting clobbered by
the x's, leading to

Program received signal SIGSEGV, Segmentation fault.
0x0809f491 in Rf_error (format=0x817d7ef "symbol print-name too long")
    at ../../../R/src/main/errors.c:520


-- 
   O__  ---- Peter Dalgaard             Blegdamsvej 3  
  c/ /'_ --- Dept. of Biostatistics     2200 Cph. N   
 (*) \(*) -- University of Copenhagen   Denmark      Ph: (+45) 35327918
~~~~~~~~~~ - (p.dalgaard@biostat.ku.dk)             FAX: (+45) 35327907

On Thu, 7 Aug 2003 jerome@hivnet.ubc.ca wrote:
> R version: 1.7.1
> OS: Red Hat Linux 7.2
> 
> In this example, I would expect an error for the overly long variable 
> name. This is always reproducable for me.
> 
> >
formula(paste("y~",paste(rep("x",50000),collapse="")))
> Segmentation fault
> 
> Sincerely,
> Jerome Asselin
The problem seems to be in parse, which formula.default calls:
> parse(text=paste(rep("x",50000),collapse=""))
Segmentation fault (core dumped)

We were filling the yytext buffer in gram.y with no overflow checking.
I've added some checking in R-devel, so these now give
> parse(text=paste(rep("x",50000),collapse=""))
Error in parse(text = paste(rep("x", 50000), collapse = ""))
:
	input buffer overflow
>
formula(paste("y~",paste(rep("x",50000),collapse="")))
Error in parse(text = x) : input buffer overflow

luke


-- 
Luke Tierney
University of Iowa                  Phone:             319-335-3386
Department of Statistics and        Fax:               319-335-3017
   Actuarial Science
241 Schaeffer Hall                  email:      luke@stat.uiowa.edu
Iowa City, IA 52242                 WWW:  http://www.stat.uiowa.edu