segfault produced on multiple platforms with ftp endpoint

[vjcitn]

We started to see this behavior when transitioning Bioconductor build system to ubuntu 24.04, but now see on other platforms.

library(httr)

url1 <- "https://en.wikipedia.org/wiki/Bioconductor"
response1 <- GET(url1)

url2 <- "ftp://ftp.ensembl.org/pub/release-71/gtf/caenorhabditis_elegans/Caenorhabditis_elegans.WBcel235.71.gtf.gz"
response2a <- GET(url2, write_disk(tempfile()))
response2b <- GET(url2, write_disk(tempfile()))

Event:

 *** caught segfault ***
address 0x33326c656342572e, cause 'invalid permissions'

Traceback:
 1: curl::curl_fetch_disk(url, x$path, handle = handle)
 2: request_fetch.write_disk(req$output, req$url, handle)
 3: request_fetch(req$output, req$url, handle)
 4: request_perform(req, hu$handle$handle)
 5: GET(url2, write_disk(tempfile()))

Platform:

> sessionInfo()
R version 4.4.1 (2024-06-14)
Platform: aarch64-apple-darwin20
Running under: macOS Sonoma 14.7

Matrix products: default
BLAS:   /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRblas.0.dylib 
LAPACK: /Library/Frameworks/R.framework/Versions/4.4-arm64/Resources/lib/libRlapack.dylib;  LAPACK version 3.12.0

locale:
[1] en_US.UTF-8/en_US.UTF-8/en_US.UTF-8/C/en_US.UTF-8/en_US.UTF-8

time zone: America/New_York
tzcode source: internal

attached base packages:
[1] stats     graphics  grDevices utils     datasets  methods   base     

other attached packages:
[1] httr_1.4.7     rmarkdown_2.28

loaded via a namespace (and not attached):
 [1] compiler_4.4.1    startup_0.22.0    R6_2.5.1          fastmap_1.2.0    
 [5] cli_3.6.3         tools_4.4.1       htmltools_0.5.8.1 curl_5.2.3       
 [9] knitr_1.48        xfun_0.47         digest_0.6.37     rlang_1.1.4      
[13] evaluate_1.0.0   

Thanks to @hpages for the reprex.

[hadley]

Related: #755. But as @jeroen reports it's better fixed in curl itself: jeroen/curl#348

[jeroen]

Workaround is on CRAN now in curl 6.0.0. To emphasize, the problem also disappears when your system updates to libcurl 8.8.0 or newer.