Stack smashing detected: running program with dinamically allocated array of structures - c

Question

I'm writing the following program:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "planes.h"
int main(void)
{
plane* planes=NULL;
int size=0;
readPlanes(&planes, &size);
free(planes);
planes=NULL;
return EXIT_SUCCESS;
}
void readPlanes(plane** planes, int* size)
{
char buffer[100]={'\0'};
int airplaneID, modeli;
float fuel;
char modelc;
int invent=0;
int rettest=0;
do{
printf("Enter the number of planes:\n");
fgets(buffer, 100, stdin);
rettest=sscanf(buffer, "%d", size);
if((*size)<=0)
{
printf("Invalid number of planes: enter a non negative number\n");
rettest=0;
}
}while(rettest!=1);
*planes=(plane*)calloc((*size), sizeof(plane*));
for(invent=0; invent<(*size); invent++)
{
planes[invent]=calloc(1, sizeof(plane));
do{
rettest=0;
printf("Enter the airplaneID:\n");
fgets(buffer, 100, stdin);
rettest=sscanf(buffer, "%d", &airplaneID);
if(airplaneID<0)
{
printf("Invalid airplaneID: enter a positive number\n");
rettest=0;
}
}while(rettest!=1);
planes[invent]->airplaneID=airplaneID;
do{
rettest=0;
printf("Enter the model:\n");
fgets(buffer, 100, stdin);
rettest=sscanf(buffer, "%c %d", &modelc, &modeli);
if(modeli<0 || modelc<'A' || modelc>'Z')
{
printf("Invalid model: enter an uppercase letter followed by a non negative number\n");
rettest=0;
}
}while(rettest!=2);
planes[invent]->planemodel.letter=modelc;
planes[invent]->planemodel.number=modeli;
do{
rettest=0;
printf("Enter the fuel:\n");
fgets(buffer, 100, stdin);
rettest=sscanf(buffer, "%f", &fuel);
if(fuel<0.0f)
{
printf("Invalid fuel: enter a non negative number\n");
rettest=0;
}
}while(rettest!=1);
planes[invent]->fuel=fuel;
}
}
The header file is:
#ifndef PLANES_H_INCLUDED
#define PLANES_H_INCLUDED
typedef struct
{
char letter;
int number;
}model;
typedef struct
{
int airplaneID;
model planemodel;
float fuel;
}plane;
void readPlanes(plane**, int*);
int lowestFuel(plane*, int);
void printID(plane*, int, char*);
#endif // PLANES_H_INCLUDED
Anyway, when I run the program with planes=1 the program runs with no problems. However if I try to run it with 2 or more planes, the following error occurs (at the end of the program, after the user entered all the parameters for all the planes):
stack smashing detected: /home/user/Documents/program/bin/Debug/program terminated
Aborted(core dumped)
I have no idea why this is occurring and where is my problem. Can someone help me?

Answer 1

Given planes declared as a plane **, this allocation is incorrect:
*planes=(plane*)calloc((*size), sizeof(plane*));
You are allocating memory to which a plane * will point; inasmuch as you are considering that memory as the storage for an array, the elements of the array (e.g. (*planes)[0]) must therefore be of type plane. You are not allocating enough space for a *size elements of type plane, however; only enough for that many pointers.
A good form to use for allocations specifies the wanted size in terms of the pointer to which the allocation is being assigned; for example,
mytype *p;
p = calloc(n, sizeof (*p));
Observe that the size of the allocation is defined in terms of the size of the thing to which p points, which is almost always what you want, without hard-coding p's type. That not only reduces the scope for errors, it is also flexible with respect to changes to p's type. (Note also that casting the result of malloc / calloc / realloc in C is not only unnecessary, but is regarded by many as poor form.)
In your case, the pointer for which you are allocating is *planes, so the above form would be realized as
*planes = calloc(*size, sizeof(**planes));
You seem to be confused by the double pointer, however. The only reason for it is to enable readPlanes() to modify its caller's local variable. It does not imply a requirement for multiple levels of allocation. In particular, having allocated memory and recorded a pointer to it in *planes, it makes no sense whatever to subsequently allocate more memory and assign it to planes[0], which is the same thing. It makes even less sense to attempt to assign anything to planes[1], however, because as this function was called, planes points to main's pointer planes, and therefore planes[1] points one plane* past that, to ... what? It's not defined, and your program therefore exhibits undefined behavior. That's your stack smashing.
In fact, you don't need the allocations in the loop at all -- you have already (after the first correction) allocated all the space you need. Because you assigned the pointer to *planes, you'll want to access it via that pointer; that means using expressions of the form (*planes)[n] to reference the nth plane. For example,
(*planes)[invent].airplaneID = airplaneID;