title: Is unserializing not-trusted raw vector secure in R?
body: <p>R provides <code>serialize</code> and <code>unserialize</code> functions to convert an arbitrary R object into vector of bytes and back. </p>
  
  <p>I am considering unserializing parts of information that will get transmitted via network, that could (in theory) be tampered with by a malicious user. </p>
  
  <p>I understand, that the malicious user can inject an arbitrary R object that can be full of harmful code. But this is not what I am worrying about, because I can (I think I can) prevent such code from ever executing by careful handling of the received objects.</p>
  
  <p>I worry about a buffer overflow or similar way of executing an arbitrary <em>machine</em> code on the R server by mere fact of  <em>unserializing malformed bytes</em>. Has anyone seen/performed a fuzz testing on it?</p>
  
  <p>I am not a security expert and I have no easy means to perform the analysis myself. But maybe someone else did?</p>