R devel - Jan 2008 - %s in filename when opening device causes crash (PR#10571)

Full_Name: Richard Cotton
Version: 2.6.1
OS: Windows XP (32bit)
Submission from: (NULL) (193.119.236.82)


Using %s in a filename when opening a device causes R to crash, e.g.,

pdf("foo%s.pdf")
win.metafile("foo%s.wmf")
postscript("foo%s.ps")

On Mon, 14 Jan 2008, richard.cotton at hsl.gov.uk wrote:
> Full_Name: Richard Cotton
> Version: 2.6.1
> OS: Windows XP (32bit)
> Submission from: (NULL) (193.119.236.82)
>
>
> Using %s in a filename when opening a device causes R to crash, e.g.,
>
> pdf("foo%s.pdf")
> win.metafile("foo%s.wmf")
> postscript("foo%s.ps")
Do you have a workaround for this?  Since that is done at C level, we 
can't easily trap this (especially on Windows), and the list of possible 
errors that might cause a crash is rather long.

It has been considered as a vulnerability, but there seems no simple 
solution.

-- 
Brian D. Ripley,                  ripley at stats.ox.ac.uk
Professor of Applied Statistics,  http://www.stats.ox.ac.uk/~ripley/
University of Oxford,             Tel:  +44 1865 272861 (self)
1 South Parks Road,                     +44 1865 272866 (PA)
Oxford OX1 3TG, UK                Fax:  +44 1865 272595

Same on 2.7.0 Under development (unstable) (2007-12-21 r43753)
using Ubuntu i686 2.6.22-14-generic:

* ~: R
:: R version 2.7.0 Under development (unstable) (2007-12-21 r43753)
pdf> pdf("foo%s.pdf")

  *** caught segfault ***
address 0x1, cause 'memory not mapped'

Traceback:
  1: .External(PDF, file, old$paper, old$family, old$encoding, old$bg, 
    old$fg, old$width, old$height, old$pointsize, onefile, 
old$pagecentre,     old$title, old$fonts, version[1], version[2])
  2: pdf("foo%s.pdf")

Possible actions:
1: abort (with core dump, if enabled)
2: normal R exit
3: exit R without saving workspace
4: exit R saving workspace
Selection: 2
* ~:


richard.cotton at hsl.gov.uk wrote:
> Full_Name: Richard Cotton
> Version: 2.6.1
> OS: Windows XP (32bit)
> Submission from: (NULL) (193.119.236.82)
> 
> 
> Using %s in a filename when opening a device causes R to crash, e.g.,
> 
> pdf("foo%s.pdf")
> win.metafile("foo%s.wmf")
> postscript("foo%s.ps")
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
-- 
Dr Oleg Sklyar * EBI-EMBL, Cambridge CB10 1SD, UK * +44-1223-494466

> > Using %s in a filename when opening a device causes R to crash, e.g.,
> >
> > pdf("foo%s.pdf")
> > win.metafile("foo%s.wmf")
> > postscript("foo%s.ps")
> 
> Do you have a workaround for this?  Since that is done at C level, we 
> can't easily trap this (especially on Windows), and the list of
possible
> errors that might cause a crash is rather long.
> 
> It has been considered as a vulnerability, but there seems no simple 
> solution.
The simplest workaround is probably to check that '%s' isn't
included in
the character string for the file argument to each of the R wrapper 
functions, something like

if(length(grep("%s", file))) stop("using '%s' in a
filename is invalid")

This of course means that we couldn't use '%s' in a file string (is
this a
great loss?), and that users could still cause a crash by calling the 
.External code directly.

Regards,
Richie.

Mathematical Sciences Unit
HSL


------------------------------------------------------------------------
ATTENTION:

This message contains privileged and confidential inform...{{dropped:21}}