[Rd] segmentation fault: formula() with long variable names (PR#3704)

[luke at stat.uiowa.edu]

On Thu, 7 Aug 2003 jerome at hivnet.ubc.ca wrote:

> R version: 1.7.1
> OS: Red Hat Linux 7.2
> 
> In this example, I would expect an error for the overly long variable 
> name. This is always reproducable for me.
> 
> > formula(paste("y~",paste(rep("x",50000),collapse="")))
> Segmentation fault
> 
> Sincerely,
> Jerome Asselin

The problem seems to be in parse, which formula.default calls:

> parse(text=paste(rep("x",50000),collapse=""))
Segmentation fault (core dumped)

We were filling the yytext buffer in gram.y with no overflow checking.
I've added some checking in R-devel, so these now give

> parse(text=paste(rep("x",50000),collapse=""))
Error in parse(text = paste(rep("x", 50000), collapse = "")) : 
	input buffer overflow
> formula(paste("y~",paste(rep("x",50000),collapse="")))
Error in parse(text = x) : input buffer overflow

luke


-- 
Luke Tierney
University of Iowa                  Phone:             319-335-3386
Department of Statistics and        Fax:               319-335-3017
   Actuarial Science
241 Schaeffer Hall                  email:      luke at stat.uiowa.edu
Iowa City, IA 52242                 WWW:  http://www.stat.uiowa.edu