[R-pkg-devel] Possible false negative for compiled C++ code in CRAN checks

[Mauricio Vargas Sepulveda]

Dear Developers,

I am writing to ask for insights on how to fix the errors in the Redatam package and get it  back to CRAN.

CRAN reported memory leaks for:

CLAN/ASAN: https://www.stats.ox.ac.uk/pub/bdr/memtests/clang-ASAN/redatam/00check.log
CLANG/UBSAN: https://www.stats.ox.ac.uk/pub/bdr/memtests/gcc-UBSAN/redatam/00check.log

The log reads:

"HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_container_overflow=0.
If you suspect a false positive see also: https://github.com/google/sanitizers/wiki/AddressSanitizerContainerOverflow.
SUMMARY: AddressSanitizer: container-overflow .../src/redatamlib/ByteArrayReader.cpp:170:23 in RedatamLib::ByteArrayReader::ReadByte()"

After asking on Stack Overflow (https://stackoverflow.com/q/79171799/3720258), it was suggested that I set 'CXXFLAGS="-stdlib=libc++"' in 'configure'. The question is very long and provides all the details that I skip here.

After googling and exploring different steps, I managed to run a Docker image that imitates CRAN's clang ASAN/UBSAN test, but adding 'CXXFLAGS' not only made the error persist, but also create a note about overwriting options.

According to a Microsoft thread, the problem is not the Redatam package's code, but the release of 'libc' that comes with the image (see https://github.com/microsoft/DirectXShaderCompiler/issues/5971). They suggest compiling 'libc' yourself instead of using the precompiled version. I would need to explore with a Fedora 36 image with Clang 19 with a compiled libc and explore if there is a difference.

I took a 'computer programming' class where I learned a bit of theory and how to write C++ using GCC and testing with 'valgrind' in the Ubuntu machines from the lab.

I am not an IT expert, and I honestly would like to fix this issue because I already have users emailing me because they use this package for "data archeology" and I use it for the same reason for my research in Political Science.

The alternative is to use old hardware and a point-and-click tool on Windows 98/XP, which is why I keep my old ThinkPad X200 and an external DVD reader. It not feasible to read old census data with modern hardware, which is a problem derived from it being in a closed source format. Even worse, some recent census data comes with an installer that does not work on Windows 10+, and that I was able to restore by using Wine on my main modern laptop.

Best wishes,

_
Mauricio "Pachá" Vargas Sepúlveda
PhD Student, Political Science
University of Toronto