In what cases would fscanf overflow memory? - c

Question

I have a linked list I implemented that works fine for various file inputs (it reads them line by line and inserts them.)
void insert_words(FILE* file, node_type* list)
{
char buffer[12];
int length = 0;
while (!feof(file)){
fscanf(file, "%s", buffer);//buffer contains the string/name
length = strlen(buffer);
if (length != 0) {
insert_sorted(list, buffer);
}
} //while
}
Given this code, I'm seeing issues which when fscanf is executed with the given sample input after reading in 'fff', things seem to go sour.
one
two
three ee
fff
ee
As ee is being parsed:
list = 0x009dfac0 {name=0x009dfac0 "one" next=0x00c98c08 {name=0x00c98c08 "three" next=0x00c98ba0 {name=0x00c98ba0 "two" ...} } }
After the next token:
list = 0x009dfac0 {name=0x009dfac0 "ee" next=0x009df068 {name=0x009df068 "È”ü\xf\x1" next=0x0ff7caa0 {msvcr110d.dll!_except_handler4(_EXCEPTION_RECORD *, _EXCEPTION_REGISTRATION_RECORD *, _CONTEXT *, void *)} {...} }
When examining my list, the 'next' pointer is corrupted immediately after fscanf is fired off. What are the potential causes?
Inserted sort upon request:
void insert_sorted(node_type* list, char* value)
{
// Copy our pointer so we can move around
node_type *n = (node_type*) malloc(sizeof *n);
node_type *loc = NULL;
node_type *tmp;
node_type dat;
node_type* prev = list;
node_type* head = list;
n->next = NULL;
strcpy(n->name, value);
// First element, assign immediately
if( strcmp(list->name, "") == 0 )
{
*list = *n;
return;
}
while(head != NULL)
{
// We should do a comparison to see if one is greater than another
int cmp_result = strcmp(value, head->name);
// If the value is bigger, this means the value needs to be inserted after
if(cmp_result > 0)
{
loc = head;
}
else if (cmp_result < 0) // this needs to be ahead
{
if(prev == head)
{
dat = *head;
*head = *n;
head->next = &dat;
return;
}
prev->next = n;
n->next = head;
return;
}
else if(cmp_result == 0)
{
free(n);
return; // duplicate, die
}
// Advance to the next pointer
prev = head;
head = head->next;
}
// You've reached the end, that must mean you've succesfully reached the point to insert
tmp = loc->next; // get the value we're going to end up detaching
n->next = tmp; // link the two together
loc->next = n;
}

Answer 1

Modify the loop into
while (fscanf(file, "%s", buffer) == 1) {
length = strlen(buffer);
// ...
}
Because feof(file) still returns 0 after the last successful fscanf(). It returns non-0 after the first failed fscanf().
Regarding insert_sorted(), look at the following lines:
head->next = &dat;
return;
Since dat is a local object, saving its address leads to invalid address once the function returns.

Answer 2

You're not testing for end of file correctly. In general, it's not correct to use feof, but instead to test the return value of the function with which you read from the file.
fscanf returns the number of entities that it was able to read. So in your case you would test that it returned 1, which would indicate a successful read. And to avoid buffer overflow, you can put a limit on the number of characters to read with a number between the % and the s.
And there's no reason to be so stingy with your buffer size.
So:
void insert_words(FILE* file, node_type* list)
{
char buffer[128];
while (fscanf(file, "%127s", buffer) == 1) {
insert_sorted(list, buffer);
}
}
BTW, you're not reading "line by line" but "space-delimited string by space-delimited string". To read the file line-by-line you could use fgets.
And before you say "that's not the problem", try it first. These are the only problems that could come from this function.