Segmentation fault (core dumped) after main returns 0

Question

Im getting seg fault after my main functions returns 0, only when I pass lowercase cipher key, Ive run debug50 and the code ran fine, expected output but when it reaches the return statement in the main function it errors out. (the hello test to show it gets to return 0)

Here is good output:

    substitution/ $ ./substitution VCHPRZGJNTLSKFBDQWAXEUYMOI
plaintext: Hello there
ciphertext: Jrssb xjrwr
hello

when I pass a lowercase key I get the error:

    $ ./substitution yukfrnlbavmwzteogxhcipjsqE
plaintext: Hello there
ciphertext: Brwwe cbrxr
hello
Segmentation fault (core dumped)

Here is the code:

#include <cs50.h>
#include <stdio.h>
#include <ctype.h>
#include <string.h>
#include <limits.h>

//functions
int usage(void);
int keyDirections(void);
string niice(char cipher[]);

int main(int argc, string argv[])
{
    // check that the Number Of Arguments Provided is what is expected.
    if ( argc != 2 )
    {
        usage();
        return 1;
    }
    // set argument as ciph
string ciph = argv[1];
    // set the length of string as n
int n = strlen(ciph);
    //check the length of the cipher.
    if ( n != 26 )
    {
        keyDirections();
        return 1;
    }
    // check all letters.

    for ( int i = 0 ; i < n ; i++)
    {
        if ( !isalpha(ciph[i]))
        {
            keyDirections();
            return 1;
        }
    }
    // check for duplicates
    int Seen['Z'-'A'+1] = {0};
    for (int i = 0; i < n; i++)
    {
            unsigned char c = ciph[i];
            //printf ("c is %c\n", c);
            c = toupper(c-'A');
            //printf ("position %i\n", i );
       if (Seen[c] == 1)
       {
            //Seen[c] = 1;
            printf ("%d", Seen[c]);
            keyDirections();
            return 1;
       }
       else
       {
            Seen[c] = 1;
       }
    }
    niice(ciph);
    printf ("hello\n");

    return 0;
}

// usage function called when the incorrect number of arguments is given.
int usage(void)
{
    printf ("Usage: ./substitution key\n");
    return 0;
}
// keyDirections function is called when user fails to give 26 unique alphabetic characters.
int keyDirections(void)
{
    printf ("Key must contain 26 unique characters.\n");
    return 0;
}

string niice(char cipher[])
{
    string messg = get_string("plaintext: ");
    int len = strlen(messg);
    //printf ("%s\n",cipher);
    printf ("ciphertext: ");

       for ( int i = 0 ; i < len ; i++)
    {
            unsigned char c = messg[i];
            if ( !isalpha(c))
        {
            printf ("%c",c);
        }
        if ( islower(c))
        {
             printf ("%c", tolower(cipher[c-'a'] ));
        }
        if ( isupper(c))
        {
            printf ("%c", toupper(cipher[c-'A'] ));
        }
    }
    printf ("\n");
    return messg;
}

Ok i was able to get more info

$ ./substitution yukfrnlbavmwzteogxhcipjsqd
=================================================================
==1735==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffd1f0a094 at pc 0x55845a7192f5 bp 0x7fffd1f09fd0 sp 0x7fffd1f09fc8
READ of size 4 at 0x7fffd1f0a094 thread T0
    #0 0x55845a7192f4 in main (/workspaces/82999730/substitution/substitution+0xdc2f4) (BuildId: 9e0a0075d25184d7d60dee7111e65d3f071b3f26)
    #1 0x7f511b929d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #2 0x7f511b929e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #3 0x55845a65b344 in _start (/workspaces/82999730/substitution/substitution+0x1e344) (BuildId: 9e0a0075d25184d7d60dee7111e65d3f071b3f26)

Address 0x7fffd1f0a094 is located in stack of thread T0 at offset 180 in frame
    #0 0x55845a718eef in main (/workspaces/82999730/substitution/substitution+0xdbeef) (BuildId: 9e0a0075d25184d7d60dee7111e65d3f071b3f26)

  This frame has 1 object(s):
    [32, 136) 'Seen' <== Memory access at offset 180 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/workspaces/82999730/substitution/substitution+0xdc2f4) (BuildId: 9e0a0075d25184d7d60dee7111e65d3f071b3f26) in main
Shadow bytes around the buggy address:
  0x10007a3d93c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d93d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d93e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d93f0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10007a3d9400: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
=>0x10007a3d9410: f3 f3[f3]f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d9420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d9430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d9440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d9450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007a3d9460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1735==ABORTING

it appears the 'Seen' array is at fault but im not sure how to fix this.

Answer 1

It appears to be seg faulting during program exit and memory cleanup/trash collection. I can't explain why. Perhaps the error below is pointing at an invalid or out of bounds memory address, but the source of the problem was simple to find.

Look at this line of code:

        c = toupper(c-'A');

Say that c contains the letter 'a'. This becomes c = toupper('a' - 'A'). Evaluate the subtraction as 97 - 65 = 32. That evaluates to the space character. For non-alpha ASCII values, toupper() just returns the same value. Other ASCII values may or may not produce similar unexpected results.

Is it more likely that you meant to do the following?

        c = toupper(c) - 'A';

Seems like you wanted to convert the letter in c to upper case and then subtract 'A'.