Menu

#1371 SWIG R bindings don't check for NULL resulting in R crashing to desktop

None
open
nobody
r (8)
5
2022-03-09
2014-05-26
No

The code generated by SWIG does not check whether S4 elements passed in are valid elements (or contain externalptr's to NULL).

Example: assume we have a class Bar containing 10 instances of Foo, and is asked to return the eleventh. What happens is that we get an S4 object of type _p_Foo, whose external ptr is pointing to NULL.

Now suppose the Foo class had a function string getName(), if we now call the Foo_getName(x) with x the element from before, the R environment is crashing, as the external ptr is not checked.

Unfortunately my R knowledge is quite limited, however as workaround i found it working to change the default typemap in rtype.swg from:

 %typemap(scoercein) SWIGTYPE, SWIGTYPE *, SWIGTYPE *const, SWIGTYPE &  
 %{ 
     if (inherits($input, "ExternalReference")) $input = slot($input,"ref")
 %}

to

%typemap(scoercein) SWIGTYPE, SWIGTYPE *, SWIGTYPE *const, SWIGTYPE &  
%{ 
     if(isS4($input) && .hasSlot($input, "ref"))
     {
      if (length(grep("0x0",capture.output(slot($input, "ref")))) > 0)
      { 
        stop("Input null");
      }
     }
     if (inherits($input, "ExternalReference")) $input = slot($input,"ref")
 %}

Discussion

  • Olly Betts

    Olly Betts - 2022-03-09

    There isn't a testcase here to easily check if this is still the case, but the quoted typemap is still the same so it likely is (unless this got addressed elsewhere).

     
  • Olly Betts

    Olly Betts - 2022-03-09
    • labels: --> r
    • Group: -->
     

Log in to post a comment.