[R] data.entry segfault

[Peter Dalgaard BSA]

Arne Henningsen <ahenningsen at email.uni-kiel.de> writes:

> Hi,
> there is a similar problem with R Version 1.6.1 on SuSE-Linux 8.0:
> R crashes and I get "Speicherzugriffsfehler" (=~ Memory Access Error) from the 
> console. I think R tries to write something to somewhere where it has no 
> write access. I hope that this could help others to find a solution.
> Arne. 
> 
> On Thu, 12 Dec 2002 17:14:19,  Ted.Harding at nessie.mcc.ac.uk wrote:
> > Hi Folks,
> >
> > With R Version 1.3.0  (2001-06-2) on SuSE-7.2 Linux,
> >
> > starting from scratch, first:
> > > X<-rep(0,1200);X<-matrix(X,ncol=4)
> > > data.entry(X)
> >
> > Up comes the "spreadsheet" window, filled with 0s in
> > a 300x4 array, and the "cursor" in the (1,1) cell.
> >
> > Then I type a "1" to enter it into the cell.
> >
> > Then: Segmentation fault
> >
> > Is this a known problem with R-1.3.0 with/without SuSE?
> >
> > With thanks,
> > Ted.

I get this (with 1.6.0 installed from the CRAN RPM) SuSE too, but *not* on
RedHat. More detailed symptoms are 

Breakpoint 2, doSpreadKey (key=0, event=0xbfffe0e4) at dataentry.c:1172
1172    in dataentry.c
(gdb) s
GetKey (event=0xbfffe0e4) at dataentry.c:1248
1248    in dataentry.c
(gdb)
1249    in dataentry.c
(gdb)
1250    in dataentry.c
(gdb)
doSpreadKey (key=68, event=0x12) at dataentry.c:1173
1173    in dataentry.c
(gdb)
GetCharP (event=0x12) at dataentry.c:1257
1257    in dataentry.c
(gdb)

Program received signal SIGSEGV, Segmentation fault.
0x40290087 in XLookupString () from /usr/X11R6/lib/libX11.so.6
(gdb) bt
#0  0x40290087 in XLookupString () from /usr/X11R6/lib/libX11.so.6
#1  0x4021475b in GetCharP (event=0x12) at dataentry.c:1257
#2  0x402143b3 in doSpreadKey (key=68, event=0x12) at dataentry.c:1173
(gdb)

so it would seem like something in the GetKey call is destroying the
stack. 

It is reproducible with a hand-compiled version and things boil down
to

1243    static KeySym GetKey(DEEvent * event)
1244    {
1245        char text[1];
1246        KeySym iokey;
1247
1248        XLookupString(event, text, 10, &iokey, 0);
1249        return iokey;
1250    }

And the XLookupString call is the culprit. "10" is the buffer length,
but "text" is declared to have length 1, and in practice has at least 2
bytes since "text" is \0-terminated...

Switching to "char text[10];" looks like a likely fix.

        -p


-- 
   O__  ---- Peter Dalgaard             Blegdamsvej 3  
  c/ /'_ --- Dept. of Biostatistics     2200 Cph. N   
 (*) \(*) -- University of Copenhagen   Denmark      Ph: (+45) 35327918
~~~~~~~~~~ - (p.dalgaard at biostat.ku.dk)             FAX: (+45) 35327907