pset4 recover - Invalid read and Use of uninitialised value

Question

I don't know what's wrong in my code. Valgrind points to 33 line of my code: while(fread(arr, sizeof(arr), 1, card) == 1)
but I can't see what's isn't right, i had read about some similar problems but didn't find (or didn't saw) solution, here is my code and valgrind's info, please help me find what causes this errors:

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

typedef uint8_t BYTE;

int main(int argc, char* argv[])
{
FILE* card = fopen("card.raw", "r");

if (card == NULL)
{
    printf("Could not open card.raw !");
    return 2;
}

char title[7];
int number = 0;
int WritingJpg = 0;

FILE* jpg = NULL;
BYTE arr[512];

while(fread(arr, sizeof(arr), 1, card) == 1)
{
    if((arr[0] == 0xff && arr[1] == 0xd8 && arr[2] == 0xff) && (arr[3] >= 0xe0 || arr[3] <= 0xef))
    {
        if(WritingJpg == 0)
        {
            sprintf(title, "%03d.jpg", number);
            jpg = fopen(title, "w");
            if(jpg == NULL)
            {
                return 2;
            }
            fwrite(arr, sizeof(arr), 1, jpg);   
            WritingJpg = 1;
        }
        else
        {
            fclose(jpg);
            number++;
            sprintf(title, "%03d.jpg", number);
            jpg = fopen(title, "w");
            if(jpg == NULL)
            {
                return 2;
            }
            fwrite(arr, sizeof(arr), 1, jpg);   
        }
    }
    else
    {
        if(WritingJpg == 1)
        {
            fwrite(arr, sizeof(arr), 1, jpg);
        }
    }
}
fclose(card);
fclose(jpg);

return 0;  

Part of Valgrin's info:

Invalid read of size 4
at 0x51AB8D0: fread (iofread.c:41)
by 0x4007E0: main (recover.c:33)
Address 0x5502000 is not stack'd, malloc'd or (recently) free'd

Use of uninitialised value of size 8
at 0x51B8787: _IO_sgetn (genops.c:495)
by 0x51AB93E: fread (iofread.c:42)
by 0x4007E0: main (recover.c:33)

Invalid read of size 8
at 0x51B8787: _IO_sgetn (genops.c:495)
by 0x51AB93E: fread (iofread.c:42)
by 0x4007E0: main (recover.c:33)
Address 0x40 is not stack'd, malloc'd or (recently) free'd

Process terminating with default action of signal 11 (SIGSEGV)
Access not within mapped region at address 0x40
at 0x51B8787: _IO_sgetn (genops.c:495)
by 0x51AB93E: fread (iofread.c:42)
by 0x4007E0: main (recover.c:33)

Segmentation fault

Answer 1

Look at the following two lines:

char title[7];
...
sprintf(title, "%03d.jpg", number);

When called, sprintf() will write a string to the target char array, including the end of string marker. In this case, that's 8 total characters - a 7 char string plus \0. title is only 7.

Depending on what is stored next to it in memory, this either causes a seg fault at run time (if you're lucky), or overwrites and corrupts adjacent data and doesn't tell you. Sometimes you get a corrupted file name, other times you get unpredictable results.

As a separate side note, your test has a problem. (arr[3] >= 0xe0 || arr[3] <= 0xef) is always true. Basically, this is the same as ( x >= 0 OR x <= 15) Any number is always greater than one number OR less than another, larger number.

If this answers your question, please click on the check mark to accept. Let's keep up on forum maintenance. ;-)