arima() bug

arima() crashes R (segfault) with Linux R-2.7.0, Solaris R-2.6.0:

Reproduce by:

# 2 years of daily temperature data
set.seed(1); x <- ts(20*sin((1:731)*2*pi/365) + 10 + rnorm(731, 0, 4), freq=365)
arima(x, c(1, 0, 1), c(1, 0, 1))

I put a breakpoint in Rf_allocVector when its length argument
was more than 10 million and it stopped when library/stats/src/arima.c:getQ0
asked for a vector of nrbar=132497980 doubles, a number proportional
to the 4th power of max(length(phi),length(theta)) from the R arima():upARIMA()
function:

SEXP getQ0(SEXP sPhi, SEXP sTheta)
{
    ...
    int  p = LENGTH(sPhi), q = LENGTH(sTheta);
    ...
    int r = max(p, q + 1), np = r * (r + 1) / 2, nrbar = np * (np - 1) / 2;
    ...
    rbar = (double *) R_alloc(nrbar, sizeof(double));

(gdb) print nrbar
$1 = 132497980
(gdb) print np
$2 = 67528
(gdb) print r
$3 = 367
(gdb)  print q
$4 = 366

Trying to recover from running out of memory probably
causes the crash.

rbar is a scratch array.

----------------------------------------------------------------------------
Bill Dunlap
Insightful Corporation
bill at insightful dot com

 "All statements in this message represent the opinions of the author and do
 not necessarily reflect Insightful Corporation policy or position."