Bug 16358 - Potential integer overflow in floating point literal parser for exponential notation
Summary: Potential integer overflow in floating point literal parser for exponential n...
Status: CLOSED FIXED
Alias: None
Product: R
Classification: Unclassified
Component: Language (show other bugs)
Version: R 3.2.0
Hardware: All All
: P3 minor
Assignee: R-core
URL:
Depends on:
Blocks:
 
Reported: 2015-04-30 20:05 UTC by Jiahao Chen
Modified: 2015-05-03 16:03 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jiahao Chen 2015-04-30 20:05:49 UTC
Inputting three particular numeric floating point literals in R 3.2.0 release on OSX 10.10.3 currently produces the following results:

> 1e99
[1] 1e+99
> 1e99999999999
[1] Inf
> 1e999999999999
[1] 0

In the third case, I had expected the result to be Inf.

Jonathan Chang at Facebook has kindly identified the potential line where an overflow might occur:

https://github.com/wch/r-source/blob/727df906359677033029ebd42ef4631e1d991750/src/main/util.c#L1708

double R_strtod5(const char *str, char **endptr, char dec,
		 Rboolean NA, int exact)
{
//...
    int n //...
//...
    if (*p == 'e' || *p == 'E') {
//...
	for (n = 0; *p >= '0' && *p <= '9'; p++) n = n * 10 + (*p - '0'); // <---

Thanks to Jake Bolewski at MIT who brought this behavior to my attention.
Comment 1 Martin Maechler 2015-05-01 10:03:39 UTC
Fascinating ...  Bug confirmed on Linux (ubuntu 14.04 LTS, R 3.2.0 patched.

The cutoff seems to be around here:

> 1e10737000000
[1] Inf
> 1e10738000000
[1] 0
Comment 2 Jiahao Chen 2015-05-01 14:07:20 UTC
The parsed result appears to oscillate between 0 and Inf.

> 1e999999999999
[1] 0
> 1e9999999999999
[1] Inf
> 1e99999999999999
[1] Inf
> 1e999999999999999
[1] 0
> 1e9999999999999999
[1] Inf
> 1e99999999999999999
[1] Inf
> 1e999999999999999999
[1] 0
> 1e9999999999999999999
[1] 0
> 1e99999999999999999999
[1] Inf
> 1e999999999999999999999
[1] 0
Comment 3 Duncan Murdoch 2015-05-02 23:04:00 UTC
Fixed in R-devel, soon in R-patched.
Comment 4 Jiahao Chen 2015-05-03 16:03:48 UTC
Thanks!