StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POPossible Buffer Overrun
primarykey
Id
8316189
data
AcceptedAnswerId
8316351
AnswerCount
1
ClosedDate
CommentCount
8
CommunityOwnedDate
CreationDate
2011-11-29T18:57:31.267
FavoriteCount
0
LastActivityDate
2011-11-29T19:33:49.223
LastEditDate
2011-11-29T19:33:49.223
LastEditorUserId
401142
OwnerUserId
401142
ParentId
0
PostTypeId
1
Score
0
ViewCount
301
LastEditorDisplayName
text
Body
I'm having an infuriating issue here where I'm crashing on <code>malloc</code>/<code>calloc</code>/<code>strdup</code> and I'm assuming currently that it's because of a buffer over run somewhere. I'm finding this very difficult to find and I was wondering if any of you can offer me a hand. I'll post code snippets here, and link to full source. File reading and array operations: (common.c) <a href="http://pastebin.com/79wE9hHN" rel="nofollow">Pastebin</a> <pre><code>char * S6_ReadFileBytes(const char* path) FILE * file; long length; char * bytes = NULL; file = fopen(path, "r"); fseek(file, 0, SEEK_END) length = ftell(file); fseek(file, 0, 0); bytes = (char*)calloc(1, (size_t)length + 1); fread(bytes, 1, (size_t)length, file); return bytes; S6_Array * S6_ArrayNew(size_t count, size_t typeSize) S6_Array * a = (S6_Array*)malloc(sizeof(S6_Array)); a->typeSize = typeSize; a->Length = count; void * S6_ArrayGet(S6_Array * a, int idx) return &((char*)a->Data)[idx * a->typeSize]; void S6_ArraySet(S6_Array * a, int idx, void * val) memcpy(&((char*)a->Data)[idx * a->typeSize], val, a->typeSize); void S6_ArrayGrow(S6_Array * a, int amount) void * data; data = realloc(a->Data, (a->Length + amount) * a->typeSize); a->Data = data; a->Length += amount; void S6_ArrayPushBack(S6_Array * a, void* val) S6_ArrayGrow(a, 1); S6_ArraySet(a, a->Length - 1, val); </code></pre> CSV Reading: (CSV.c) <a href="http://pastebin.com/5ecHxQ8m" rel="nofollow">Pastebin</a> <pre><code>void S6_CSV_PushRect(S6_Array ** rectangles, S6_Rectangle * rect) if( !*rectangles ) *rectangles = S6_ArrayNew(1, sizeof(S6_Rectangle*)); S6_ArraySet(*rectangles, 0, &rect); else S6_ArrayPushBack(*rectangles, &rect); int S6_CSV_ReadRects(const char* file, S6_Array ** rectangles) char * bytes = S6_ReadFileBytes(file); char * line; char * nameIndex; size_t nameLength; S6_Rectangle * tempRect; line = strtok( bytes , "\n"); while( line ) nameIndex = strstr(line, ","); tempRect = (S6_Rectangle*)calloc(1, sizeof(S6_Rectangle)); nameLength = (size_t)(nameIndex - line) + 1; strncpy(tempRect->name, line, nameLength-1); tempRect->name[nameLength-1] = '\0'; sscanf(nameIndex, "%*[,]%d%*[,]%d%*[,]%d%*[,]%d", &tempRect->x, &tempRect->y, &tempRect->w, &tempRect->h) S6_CSV_PushRect(rectangles , tempRect); strtok(NULL, "\n"); free(bytes); </code></pre> A function where I modify the array: (BinPacker.c) <a href="http://pastebin.com/zMBxAgbe" rel="nofollow">Pastebin</a> <pre><code>int S6_BinPacker_Pack(S6_Array * rectangles, int binSize) // This sort appears to be working fine. View pastebin for test. qsort(rectangles->Data, rectangles->Length, sizeof(S6_Rectangle*), S6_BinPacker_CompareRects); </code></pre> CSV Writing [CRASH] : (CSV.c) <a href="http://pastebin.com/5ecHxQ8m" rel="nofollow">Pastebin</a> <pre><code>void S6_CSV_WriteRects(const char* file, S6_Array * rectangles) char * bytes = NULL; char buffer[128]; S6_Rectangle * tempRect; size_t i; for( i = 0; i < rectangles->Length; ++i) tempRect = *(S6_Rectangle**)S6_ArrayGet(rectangles, i); memset(buffer, '\0', sizeof(buffer)); sprintf(buffer, "%s,%d,%d,%d,%d\n", tempRect->name, temprect->x, temprect->y, temprect->w, temprect->h); if( bytes ) bytes = strcat(bytes, _strdup(buffer)); else bytes = _strdup(buffer); </code></pre> So I'm crashing here on the <code>strcat(bytes, _strdup(buffer))</code> line. When I separate it out It's still the string duplication or any sort of allocation I've tried. I get the following break dialog from visual studio: <pre><code>Windows has triggered a breakpoint in myapp.exe. This may be due to a corruption of the heap, which indicates a bug in Slant6.Debug.exe or any of the DLLs it has loaded. This may also be due to the user pressing F12 while Slant6.Debug.exe has focus. The output window may have more diagnostic information. </code></pre> And the break point it triggers is in tidtable.c on <pre><code>PFLS_GETVALUE_FUNCTION flsGetValue = FLS_GETVALUE; </code></pre> SOLUTION strdup doesn't do any allocations, and even if it did I would be leaking like crazy. So instead of: <pre><code>bytes = strcat(bytes, _strdup(buffer)); </code></pre> in CSV.c, I replaced it with some manual string concatenation that's easier for me to read (and remember). <pre><code>size_t oldSize = strlen(bytes); size_t bufferSize = strlen(buffer); size_t newSize = oldSize + bufferSize ; char * newMem = (char*)calloc(newSize + 1, 1); memcpy(newMem, bytes, newSize); memcpy(&newMem[oldSize], buffer, bufferSize); free(bytes); bytes = newMem; </code></pre> /SOLUTION
Tags
<c><visual-studio-2010><buffer-overflow>
Title
Possible Buffer Overrun
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USXoorath
UserOwnerUserId
1. USXoorath
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. This table or related slice is empty.
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.