[R] De-serialization vulnerability?

2024-05-01 Thread Howard, Tim G (DEC) via R-help
All, There seems to be a hullaboo about a vulnerability in R when deserializing untrusted data: https://hiddenlayer.com/research/r-bitrary-code-execution https://nvd.nist.gov/vuln/detail/CVE-2024-27322 https://www.kb.cert.org/vuls/id/238194 Apparently a fix was made for R 4.4.0, but I see no

Re: [R] De-serialization vulnerability?

2024-05-01 Thread Ivan Krylov via R-help
В Wed, 1 May 2024 16:57:18 + "Howard, Tim G \(DEC\) via R-help" пишет: > Is this real? Yes, but with a giant elephant in the room that many are overlooking. It has actually always been much worse. Until R-4.4.0, there used to be a way for readRDS() to return an unevaluated "promise object".

[R] strange behavior in base::as.double

2024-05-01 Thread Carl Witthoft
Hello. I'm running R 4.4.0 on an iMac Venture 13.5.2 . There appears to be a bug in as.double(). Create a string with a numeric digits followed by a single letter a thru f (as tho' it's base 16). for K in (a,b,c,d, and f ) , as.double( '123K') returns NA but as.double('123e') returns 123 --

Re: [R] strange behavior in base::as.double

2024-05-01 Thread Sarah Goslee
Hi Carl, Not that strange: R thinks you're using scientific notation. Also not a Mac bug. > as.double('123e') [1] 123 > as.double('123e+0') [1] 123 > as.double('123e+1') [1] 1230 > as.double('123e-1') [1] 12.3 Can you explain what you're trying to accomplish? Sarah On Wed, May 1, 2024 at 3:24 

Re: [R] strange behavior in base::as.double

2024-05-01 Thread Iris Simmons
This happens because "123e" looks like exponential form. This string has no exponent, so it gets treated as 0 exponent. If you're interested in converting hex numbers, append 0x: as.numeric("0x123a") or use strtoi: strtoi("123a", 16) On Wed, May 1, 2024, 15:24 Carl Witthoft wrote: > Hello. >

Re: [R] strange behavior in base::as.double

2024-05-01 Thread Duncan Murdoch
On 01/05/2024 11:32 a.m., Carl Witthoft wrote: Hello. I'm running R 4.4.0 on an iMac Venture 13.5.2 . There appears to be a bug in as.double(). Create a string with a numeric digits followed by a single letter a thru f (as tho' it's base 16). for K in (a,b,c,d, and f ) , as.double( '123K')

Re: [R] strange behavior in base::as.double

2024-05-01 Thread Ivan Krylov via R-help
В Wed, 1 May 2024 11:32:32 -0400 Carl Witthoft пишет: > but as.double('123e') returns 123 -- or whatever the first digit is. Nicely spotted problem! Prof. Brian D. Ripley has fixed it in R-devel revision 86436 [*]. Now as.double('123e') will also return NA. I think that the fix will become part