R devel - Jul 2009 - model.matrix memory problem (PR#13838)

Hi,

`model.matrix' might kill R with a segfault (on a illposed problem, but
anyway):

mydf <- as.data.frame(sapply(1:40, function(i) gl(2, 100)))
f <- as.formula(paste("~ - 1 + ", paste(names(mydf), collapse =
":"), sep = ""))
X <- model.matrix(f, data = mydf)

  *** caught segfault ***
address 0x18, cause 'memory not mapped'
Segmentation fault

Best wishes,
Torsten

--please do not edit the information below--

Version:
  platform = i686-pc-linux-gnu
  arch = i686
  os = linux-gnu
  system = i686, linux-gnu
  status   major = 2
  minor = 9.0
  year = 2009
  month = 04
  day = 17
  svn rev = 48333
  language = R
  version.string = R version 2.9.0 (2009-04-17)

Locale:
LC_CTYPE=en_GB.UTF-8;LC_NUMERIC=C;LC_TIME=en_GB.UTF-8;LC_COLLATE=en_GB.UTF-8;LC_MONETARY=C;LC_MESSAGES=en_GB.UTF-8;LC_PAPER=en_GB.UTF-8;LC_NAME=C;LC_ADDRESS=C;LC_TELEPHONE=C;LC_MEASUREMENT=en_GB.UTF-8;LC_IDENTIFICATION=C

Search Path:
  .GlobalEnv, package:stats, package:graphics, package:grDevices, package:utils,
package:datasets, package:methods, Autoloads, package:base

Hi,

Excerpts from Torsten.Hothorn's message of Thu Jul 16 17:20:10 +0200
2009:
> `model.matrix' might kill R with a segfault (on a illposed problem, but
anyway):
> 
> mydf <- as.data.frame(sapply(1:40, function(i) gl(2, 100)))
> f <- as.formula(paste("~ - 1 + ", paste(names(mydf), collapse
= ":"), sep = ""))
> X <- model.matrix(f, data = mydf)
> 
>   *** caught segfault ***
> address 0x18, cause 'memory not mapped'
> Segmentation fault
I've taken a look at this. The problem lies in lines 1784 - 1798 of
src/main/model.c. What happens is that 'k' overflows (signed
int). That means k is 0 after the loop an nc is set to 0. That means
the allocated model matrix 'x' is too small which results in the
observed segfault. 

I can provide a patch which checks for overflow and throws an error if
that is the desired behaviour.

Greetings,
Olaf Mersmann