Stack smashing detected after calling msgrcv function - c

Question

I have written two programs one to send message using msgsnd and other to receive with msgrcv. I have been using these functions for quite a while, but I can't figure out "stack smashing detected" error in receiving file. In that file I try to copy one part of file to one char array and second part into second array. I get stack smashing detected after receiving program completion if msgrcv is ever called in a file. At the end of a file I call printf function to print two arrays. From my point arr1 and arr2 should contain complete message, while only arr1 contains message and arr2 is empty. But the biggest problem is stack smashing detected error. I place code for two files below:
Sending file:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <math.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/shm.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/sem.h>
#include <sys/msg.h>
#include <stdint.h>
typedef struct message {
long type;
char text[128];
} message;
int main (int argc, char **argv) {
if (argc == 3 && strcmp (argv [1], "-m") == 0) {
key_t key = (key_t) atoi (argv[2]);
message msg;
int message_queue_id = msgget (key, IPC_CREAT | 0666);
int semaphore_set_id = semget (key, 1, IPC_CREAT | 0666);
struct semid_ds buf;
struct sembuf sb;
long long buf_address = (long long)&buf;
long long sb_address = (long long)&sb;
// sending message
msg.type = 6;
memset (msg.text, 0, 128);
printf ("%p %p\n", (void*)&buf, (void*)&sb);
sprintf (msg.text, "%lld %lld", buf_address, sb_address);
printf ("msg: %s\n", msg.text);
void* ptr = (void*)buf_address;
printf ("ptr = %p\n", ptr);
msgsnd(message_queue_id, (struct msgbuf*)&msg, sizeof (msg) - 4, 0);
sleep (1000);
}
}
Receiving file (without headers):
typedef struct message {
long type;
char text[128];
} message;
int main (int argc, char **argv) {
if (argc == 3 && strcmp (argv [1], "-m") == 0) {
key_t key = (key_t) atoi (argv[2]);
int message_queue_id = msgget (key, IPC_CREAT | 0666);;
int semaphore_set_id = semget (key, 1, IPC_CREAT | 0666);
message msg;
struct semid_ds buf;
struct sembuf sb;
msgrcv (message_queue_id, (struct msgbuf*)&msg, sizeof(msg) - 4, 6, IPC_NOWAIT);
printf ("msg = %s\n", msg.text);
char arr1[32] = "\0", arr2[32] = "\0";
int i = 0;
while (msg.text[i] != ' ') {
arr1[i] = msg.text[i];
i++;
}
i++;
while (msg.text[i]) {
arr2[i] = msg.text[i];
i++;
}
printf ("arr1 = %s, arr2 = %s\n", arr1, arr2);
printf ("sizeof(long) = %d\n", (int)sizeof(long));
}
}

Answer 1

msgrcv (message_queue_id, (struct msgbuf*)&msg, sizeof(msg) - 4, 6, IPC_NOWAIT);
The third parameter to msgrcv should be the size of the buffer stored in the message structure. When doing the calculation sizeof(msg) - 4, you seem to be assuming that the size of long is always 4, which is incorrect. Instead, you should simply use sizeof(msg.text).
You also have the same error in the sender. Because the size of long in 64-bit linux is 8 bytes and not 4, your code will write past the end of the msg variable, causing a buffer overflow.