supsmu(periodic=TRUE) can crash R by reading before start of array.
To reproduce:
set.seed(1)
xx <- runif(29000)
yy <- rnorm(29000)
span <- 0.49
i <- 1
while(i < 200){
cat(i,"\n")
int <- supsmu(xx,yy,periodic=T,span=span)
i <-i+1
}
results in:
1
2
3
4
5
6
7
8
9
Program received signal SIGSEGV, Segmentation fault.
smooth_ (n=0xffffeffe, x=0xb6a7f020, y=0xb6993020, w=0xb6921020,
span=0xffffeffe, iper=0xffffeffe, vsmlsq=0xffffeffe, smo=0xb68e8020,
acvr=0x9c7e7c8) at ppr.f:1087
1087 xti=x(j)
Current language: auto; currently fortran
(gdb) list
1082 if (ibw.lt.2) ibw=2
1083 it=2*ibw+1
1084 do 20 i=1,it
1085 j=i
1086 if (jper.eq.2) j=i-ibw-1
-> 1087 xti=x(j)
1088 if (j.ge.1) go to 10
1089 j=n+j
1090 xti=x(j)-1d0
1091 10 wt=w(j)
(gdb) print jper
$1 = 2
(gdb) print j
$2 = -4099
If you use 'R -d valgrind' it stops in the same spot
on the first call to supsmu:
1
==8058== Invalid read of size 8
==8058== at 0x56A65DA: smooth_ (ppr.f:1087)
==8058== by 0x56A64D5: supsmu_ (ppr.f:1028)
==8058== by 0x80B2488: do_dotCode (dotcode.c:1753)
==8058== by 0x80C9405: Rf_eval (eval.c:441)
...
==8058== Address 0x5EFDA80 is 0 bytes after a block of size 232,024 alloc'd
==8058== at 0x401A6EE: malloc (vg_replace_malloc.c:149)
==8058== by 0x80EFBC9: Rf_allocVector (memory.c:1952)
==8058== by 0x807B6CB: do_makevector (builtin.c:558)
==8058== by 0x80F9946: do_internal (names.c:1091)
==8058== by 0x80C9478: Rf_eval (eval.c:424)
Note that it computes x(j) and then, if j is out of
bounds, resets j to be at the end of the x array
and recomputes x(j). It should not compute x(j) if
j is out of bounds.
A fix that keeps this looking like Fortran IV is
to put 'if (j.ge.1)' at the start of line 1087
(in R_HOME/src/library/stats/src/ppr.f). This stops
the crash and makes valgrind happy.
(Splus has the identical problem and fix.)
*** ppr.f~ 2007-02-08 11:31:50.000000000 -0800
--- ppr.f 2007-02-08 11:32:07.000000000 -0800
***************
*** 1084,1090 ****
do 20 i=1,it
j=i
if (jper.eq.2) j=i-ibw-1
! xti=x(j)
if (j.ge.1) go to 10
j=n+j
xti=x(j)-1d0
--- 1084,1090 ----
do 20 i=1,it
j=i
if (jper.eq.2) j=i-ibw-1
! if (j.ge.1) xti=x(j)
if (j.ge.1) go to 10
j=n+j
xti=x(j)-1d0
--please do not edit the information below--
Version:
platform = i686-pc-linux-gnu
arch = i686
os = linux-gnu
system = i686, linux-gnu
status = Under development (unstable)
major = 2
minor = 5.0
year = 2007
month = 02
day = 05
svn rev = 40659
language = R
version.string = R version 2.5.0 Under development (unstable) (2007-02-05
r40659)
Locale:
LC_CTYPE=en_US.UTF-8;LC_NUMERIC=C;LC_TIME=en_US.UTF-8;LC_COLLATE=en_US.UTF-8;LC_MONETARY=en_US.UTF-8;LC_MESSAGES=en_US.UTF-8;LC_PAPER=en_US.UTF-8;LC_NAME=C;LC_ADDRESS=C;LC_TELEPHONE=C;LC_MEASUREMENT=en_US.UTF-8;LC_IDENTIFICATION=C
Search Path:
.GlobalEnv, package:stats, package:graphics, package:grDevices, package:utils,
package:datasets, package:methods, Autoloads, package:base
----------------------------------------------------------------------------
Bill Dunlap
Insightful Corporation
bill at insightful dot com
360-428-8146
"All statements in this message represent the opinions of the author and do
not necessarily reflect Insightful Corporation policy or position."
______________________________________________
R-devel@r-project.org mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
