Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Inexplicable buffer crash
Top Forums Programming Inexplicable buffer crash Post 302965820 by Corona688 on Wednesday 3rd of February 2016 11:37:07 AM
Old 02-03-2016
Inexplicable buffer crash
I am building a wrapper around fgets, and fighting crashes for no reason I can explain.

I have stripped it down as far as I can and it still crashes.

Code:
#include <stdio.h>
#include <stdlib.h>

typedef struct {
        char buf[4096];
        FILE *fp;
        int type;
} wrap;

wrap *wrap_open(const char *file) {
        wrap *wrap=malloc(sizeof(wrap));
        wrap->fp=fopen(file, "r");
        wrap->type=fgetc(wrap->fp);
        ungetc(wrap->type, wrap->fp);
        return(wrap);
}

int wrap_close(wrap *d) {
        if(d == NULL) return(-1);
        if(d->fp)       fclose(d->fp);
        free(d);
        return(0);
}

int wrap_read(wrap *d) {
        if(fgets(d->buf, 100, d->fp) == NULL)
        {
                perror("EOF");
                return(0);
        }

        return(1);
}

int main(int argc, char *argv[]) {
        int n;
        wrap *d;

        if(argc < 2) return(1);

        d=wrap_open(argv[1]);
        if(d == NULL) return(2);

        for(n=0; n<10; n++)
                if(!wrap_read(d)) break;

        wrap_close(d);
        return(0);
}

The first inexplicable thing happens during fgets(), which fails for no good reason. perror prints "EOF: Success". The loop quits early due to this mysterious failure, and when wrap_free() is called, the program dies with "*** Error in `./a.out': munmap_chunk(): invalid pointer: 0x0000000000c8f030 ***", where c8f030 was a valid pointer to wrap.

This does not happen at all when buf[] doesn't reside inside the structure. Everything is happy in that case. Clearly an overflow is happening, but I have no idea why or where.

I am not overflowing the bounds of the array. I checked that, and 100 bytes can't be overflowing 4K anyway.

I am definitely allocating enough memory. sizeof(wrap) is larger than 4096 bytes.

The values of wrap and wrap->fp are not being corrupted.

No mysterious properties of ungetc are crashing it. It still dies without it.

What obvious thing have I missed?
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Disk Crash

We have a Unix system with two hard drives. When we tried to access it this morning it had frozen, and when we rebooted it couldn't find one of the hard drives, and had quite a few bad data blocks on the other. Of course we fear the worst: that the drive is completely gone, but were not sure how... (1 Reply)
Discussion started by: Kgatliffe
1 Replies

2. UNIX for Dummies Questions & Answers

server crash

Our SUn Solaris Server has crashed second time in 2 days, reason is not known , we are trying to determine what could have gone wrong, any ideas, the power supply seems to be fine, there is no response from keyboard,monitor etc and we had to do a hot boot yesterday.. Any suggestions what could be... (9 Replies)
Discussion started by: knarayan
9 Replies

3. HP-UX

HP-UX system crash help please!!!

Hi, First of all, thanks for your help. I have downloaded freeBSD to study unix I'm here again 'cause my HP-UX 10.x has "broken". It raise this error: ---------------------------------------------------- Diagnostic System warning: = 0x1f005000 is POWERFAILED The diagnostic logging... (1 Reply)
Discussion started by: efrenba
1 Replies

4. HP-UX

crash dump

hi friends, i know that when there is a crash then that memory image is put into /var/adm/crash but if the system hangs up and if i have access to console of that machine then how can i take the crash dump manully. thanks (2 Replies)
Discussion started by: mxms755
2 Replies

5. Solaris

crash of my machine

I installed solaris 5.9 on a machine SunBlade100 512Mo of RAM and 18Go of hard disc, after the installation I have remark that the machine starts again after 10mn with 15 mn of walk, I downloaded and installed the last patchs on the machine but the poblème persists. someone can help me and tell me... (0 Replies)
Discussion started by: toufik
0 Replies

6. Solaris

crash dump

Can anyone of you help me in enabling crash dump on Solaris 5.5.1 (1 Reply)
Discussion started by: csreenivas
1 Replies

7. Filesystems, Disks and Memory

HP-UX Disk crash?

Hi, First post. I am not to experienced in the Unix or HP-UX world but I'm learning. We have some problem with a HP rx4640 server. During boot it states the following: Checking for LVM volume groups and Activating (if any exist) Volume group "/dev/vg00" has been successfully changed. vgchange:... (7 Replies)
Discussion started by: hoff
7 Replies

8. Solaris

crash dump

hi , i have machine that is crashed how i can enable core dump file & how can i find it ? :confused: (4 Replies)
Discussion started by: lid-j-one
4 Replies

9. Solaris

crash dumps

I am supporting a server running Solaris 4.3.The server is not having ddicated system administrator and i am requred to do minor maintenance tasks.l From few days, The server is automatically crashing and i just reboot the server. I also do not see anything in /var/adm/messages that can give an... (1 Reply)
Discussion started by: asalman.qazi
1 Replies

10. SCO

Unixware Crash ...

Hi, I need help, one of our servers is down, and all data in that Server are critical: The Scenario: ------------- I have a computer with the next architecture: architecture=IA32 bus_types=PCI2.10,ISA,PnP1.0 hostname=xxx.xxx.xxx (the real name is hidden) hw_provider=Generic AT... (2 Replies)
Discussion started by: danilosevilla
2 Replies

LEARN ABOUT MOJAVE

reportcrash

ReportCrash(8)						    BSD System Manager's Manual 					    ReportCrash(8)

NAME

     ReportCrash -- Generates crash reports

SYNOPSIS

     ReportCrash

DESCRIPTION

     ReportCrash analyzes crashing processes and saves a crash report to disk.	A crash report contains information that can help a developer
     diagnose the cause of a crash.  ReportCrash also records the identity of the crashing process and the location of the saved crash report in
     the system.log and the ASL log database.

     ReportCrash is invoked automatically by launchd when a crash is detected.	For applications and other processes running in the per-user
     launchd context, ReportCrash runs as a LaunchAgent and saves crash reports in the user's ~/Library/Logs/DiagnosticReports/ directory.  For
     daemons, other processes running in the system launchd context and other privileged processes, ReportCrash runs as a LaunchDaemon and saves
     crash reports in the system's /Library/Logs/DiagnosticReports directory where they are only readable by admin users.  If there are too many
     crash reports saved for a particular process, older reports will automatically be removed in order to conserve disk space.

     launchtl can be used to disable and re-enable crash reporting.  To disable crash reporting:

	   launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
	   sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist

     To re-enable crash reporting:

	   launchctl load -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
	   sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist

     For application crashes (but not background process crashes) ReportCrash will display a dialog notifying the user that the application unex-
     pectedly quit and offering to reopen the application or send the report to Apple.	For developers, the behavior of this dialog can be
     adjusted using /Developer/Applications/Utilities/CrashReporterPrefs.app which is installed as part of the developer tools.

     Crash reports which are sent to Apple are submitted anonymously by the SubmitDiagInfo process.  The reports are used by Apple to improve its
     products.	Users who need support should use http://www.apple.com/support or other authorized support channels.  Developers who are ADC mem-
     bers should report bugs using http://bugreporter.apple.com in order to allow for two way communication between Apple and the bug reporter.

     More information about interpreting the contents of crash reports can be found in Technote 2123: https://developer.apple.com/library/con-
     tent/technotes/tn2004/tn2123.html

SEE ALSO

     launchd(8), launchd.plist(8), launchctl(8), spindump(8), SubmitDiagInfo(8)

Mac OS								   June 1, 2019 							    Mac OS
All times are GMT -4. The time now is 10:46 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy