Bug 16367 - .rowSums(X,m,n), etc., does not check that m*n <= length(X). Can cause wrong answer and crash.
Summary: .rowSums(X,m,n), etc., does not check that m*n <= length(X). Can cause wrong...
Status: CLOSED FIXED
Alias: None
Product: R
Classification: Unclassified
Component: Analyses (show other bugs)
Version: R 3.2.0
Hardware: x86_64/x64/amd64 (64-bit) Linux-Ubuntu
: P5 major
Assignee: R-core
URL:
Depends on:
Blocks:
 
Reported: 2015-05-05 20:23 UTC by Bill Dunlap
Modified: 2015-05-05 23:32 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Bill Dunlap 2015-05-05 20:23:06 UTC
.rowSums(X, m, n) does not check that m*n <= length(X).  If they are not then R either gives a bogus result or crashes with a segfault.

R-3.2.0> .rowSums(1, 3, 3)
[1]  1.000000e+00 5.472677e-315 3.010274e-316
R-3.2.0> z <- .rowSums(1, 1e4, 1e4)

 *** caught segfault ***
address 0x3498000, cause 'memory not mapped'

Traceback:
 1: .rowSums(1, 10000, 10000)

Possible actions:
1: abort (with core dump, if enabled)
2: normal R exit
3: exit R without saving workspace
4: exit R saving workspace

The other .{row,col}{Sums,Means} functions have the same problem.

R-3.2.0> z <- .colMeans(1, 1e3, 1e3)

 *** caught segfault ***
address 0x31a1000, cause 'memory not mapped'

Traceback:
 1: .colMeans(1, 1000, 1000)

Possible actions:
1: abort (with core dump, if enabled)
2: normal R exit
3: exit R without saving workspace
4: exit R saving workspace

It is probably a cheap check to add in the C code.
Comment 1 Duncan Murdoch 2015-05-05 23:32:42 UTC
Yes, there's no check there.  I'll add one to R-patched and R-devel.