fgetc() and feof() throws segfault with big files - c

Question

I'm trying to write a program that manipulates ppm image files, works fine with relatively small files up to 622x1023 or so, but with a file any bigger the program throws a segfault error.
I have isolated the problem to this function:
void img2list(FILE *fp,int x,int y,int bd,int *resultado,long tamano){
int dimx=x,dimy=y;
int bitDepth=bd;
long numeroPixeles=(dimx*dimy*bitDepth);
int con=0;
int pixels[numeroPixeles];
while (!feof(fp)){
pixels[con]=fgetc(fp);
con++;
}
memcpy(resultado,pixels,tamano);
}
specifically to:
feof(fp)
and
fgetc(fp)
I'm compiling the code with this command:
gcc main.c -o pim
And I'm running Ubuntu 19.04 on a core i7 5820k with 16GB of RAM
Here's the entire code:
#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int * getMeta(FILE *fp){
static int meta[3];
size_t len = 0;
char * line = NULL;
char delim[] = " ";
getline(&line,&len,fp);
getline(&line,&len,fp);
char *ptr1 = strtok(line, delim);
char *ptr2 = strtok(NULL, delim);
sscanf(ptr1, "%d", &meta[0]);
sscanf(ptr2, "%d", &meta[1]);
getline(&line,&len,fp);
char *ptr3 = strtok(line, delim);
sscanf(ptr3, "%d", &meta[2]);
return meta;
}
void img2list(FILE *fp,int x,int y,int bd,int *resultado,long tamano){
int dimx=x,dimy=y;
int bitDepth=bd;
long numeroPixeles=(dimx*dimy*bitDepth);
int con=0;
int pixels[numeroPixeles];
while (!feof(fp)){
pixels[con]=fgetc(fp);
con++;
}
memcpy(resultado,pixels,tamano);
}
void list2file(int *pixeles,int x,int y,int bitDepth, char nombre[]){
int dimx = x, dimy = y;
long numeroPixeles = dimx*dimy*bitDepth;
FILE *archivo = fopen(nombre, "wb"); /* b - binary mode */
(void) fprintf(archivo, "P6\n%d %d\n255\n", dimx, dimy);
for(long i=0;i<numeroPixeles;i++){
(void) fprintf(archivo,"%c",(char)pixeles[i]);
}
(void) fprintf(archivo,"\n");
(void) fclose(archivo);
}
int main(void){
int *meta;
int values,dimx,dimy;
int bitDepth=3;
FILE *fp = fopen("test.ppm","rb");
meta=getMeta(fp); // Dimenciones de la imagen
dimx = meta[0];
dimy = meta[1];
values = meta[2];
printf("dimencion en x: %d\n",dimx);
printf("dimencion en y: %d\n",dimy);
printf("cantidad de valores por pixel: %d\n",values);
long tamano=(dimx*dimy*bitDepth*sizeof(int));
int *pixeles=malloc(tamano);
img2list(fp,dimx,dimy,3,pixeles,tamano);
char nombre[]="pena.ppm";
list2file(pixeles,dimx,dimy,bitDepth,nombre);
(void) fclose(fp);
return EXIT_SUCCESS;
}
Thanks.

Answer 1

This:
int pixels[numeroPixeles];
is a stack overflow unless numeroPixeles is bounded by a small constant. Allocating large objects on the stack admits no way to distinguish success/failure; your program just blows up (and possibly yields code execution under the control of whoever authored the data you're processing). To work with arbitrary-size data like this you need malloc where you can check for success.