buffer overflow when using attributes on a recursive function

[radfordneal]

buffer overflow when using attributes on a recursive function

[radfordneal]

This is closely related to issue #42, which involved this code:

a <- structure ( c , b = c )
attributes ( a )

so I'll address them both here.

[radfordneal]

There are two issues here. One is what sort of object these "structure" calls create. The other is what happens when you try to print them.

Regarding the first issue, note that "structure" isn't a primitive, so I'll look at the equivalent with "attrib" just to avoid any confusion from the details of "structure" (but I think there's no real difference). It seems that the same sort of object gets created by pqR-2020-07-23 and R-4.0.2. One thing to note is that primitive functions in both pqR-2020-07-23 and R-4.0.2 cannot be copied, so the attribute gets put on all instances of them (which are really the same instance).

Here's an example an with ordinary object (same happens with an ordinary function created with "function"):

> a<-1; attr(a,"fred")<-a; attributes(a)
$fred
[1] 1

The 1 gets duplicated before being attached as an attribute, so the structure is not recursive.

Here's an example with a primitive function (same result in pqR-2020-07-23 and R-4.0.2):

> x <- c; attr(x,"fred") <- 1
> attributes(x)
$fred
[1] 1

> attributes(c)
$fred
[1] 1

Attaching an attribute to x attaches the attribute to c as well, because the primitive function c can't be duplicated.

When you attach c as an attribute to itself, a recursive structure is created, because it can't be copied before being attached. For example:

> attr(c,"fred") <- c

The print representation of this is infinite.

One could argue that it should be possible to duplicate primitive functions, or that attaching attributes to them should not be allowed (as it is not allowed for NULL, which also can't be duplicated). But that's not the way it is in both pqR-2020-07-23 and R-4.0.2. I'd advise against writing code that relies on this behaviour, since it seems possible that it may change (as it did for NULL not too long ago).

So the second question is what happens when you try to print one of these recursive objects with an infinite print representation.

One difference is that pqR doesn't always print the attribute, while R-4.0.2 does. So in pqR-2020-07-23 you get the following:

> attr(c,"fred") <- c
> c
function (..., recursive = FALSE)  .Primitive("c")

pqR didn't attempt to print the attributes on the primitive function c, so the problem doesn't arise. But R-4.0.2 does print the attributes, and starts printing an infinite representation, until it gets a buffer overlow (but doesn't crash).

However, if you explicitly ask for the attributes, pqR will try to print them:

> attr(c,"fred") <- c
>attributes(c)
$fred
function (..., recursive = FALSE)  .Primitive("c")
attr(,"fred")
function (..., recursive = FALSE)  .Primitive("c")
attr(,"fred")attr(,"fred")
function (..., recursive = FALSE)  .Primitive("c")
[ and so forth ]

which goes on until pqR gets buffer overflow (and crashes).

So the only remaining question is why pqR crashes rather than just printing a buffer overflow message and stopping with an error. That's a bug, which I'll try to track down. It may also arise in other contexts where for some reason a really long print representation gets created.