Trouble debugging seg fault when using fscanf - c

Question

I get a segmentation fault on the fscanf line below. I added the character width for each variable to try and fix it so I don't understand why it would seg fault.
I read from a CSV file into an array of structs.
The struct is:
typedef struct Person
{
int ID;
int salary;
int deleted;
char salutation[4];
char firstName[21];
char surName[31];
char job[16];
} Person;
I declare the array of structs:
Person* persons;
persons = (Person*)malloc(SIZE * sizeof(Person));
And then use this while loop to read the CSV file into the values:
(i is initialised at 0)
while(fscanf(f, "%d,%3[^,],%20[^,],%30[^,],%15[^,],%d,%d", &inPersons[i].ID, inPersons[i].salutation, inPersons[i].firstName, inPersons[i].surName, inPersons[i].job, &inPersons[i].salary, &inPersons[i].deleted)!=EOF)
{
newID = inPersons[i].ID;
i++;
}
The segfault happens during the fscanf statement. I'm not experienced with valgrind but it gives me this error for that line:
==16810== Invalid write of size 4
==16810== at 0x578215: _IO_vfscanf (in /lib/libc-2.12.so)
==16810== by 0x585368: __isoc99_fscanf (in /lib/libc-2.12.so)
==16810== by 0x8048951: loadDb (Database.c:23)
==16810== by 0x8048711: menu (Menu.c:37)
==16810== by 0x804861E: main (main.c:6)
==16810== Address 0x27230128 is not stack'd, malloc'd or (recently) free'd
I also get these Valgrind faults for the same line:
==18457== Use of uninitialised value of size 4
==18457== at 0x405A215: _IO_vfscanf (in /lib/libc-2.12.so)
==18457== by 0x4067368: __isoc99_fscanf (in /lib/libc-2.12.so)
==18457== by 0x8048943: loadDb (Database.c:23)
==18457== by 0x8048711: menu (Menu.c:37)
==18457== by 0x804861E: main (main.c:6)
==18457== Process terminating with default action of signal 11 (SIGSEGV)
==18457== Access not within mapped region at address 0x5C5E4128
==18457== at 0x405A215: _IO_vfscanf (in /lib/libc-2.12.so)
==18457== by 0x4067368: __isoc99_fscanf (in /lib/libc-2.12.so)
==18457== by 0x8048943: loadDb (Database.c:23)
==18457== by 0x8048711: menu (Menu.c:37)
==18457== by 0x804861E: main (main.c:6)

Answer 1

If you have an alphabetic or punctuation character where you should have a digit, you have an infinite loop and you overflow the bounds of the array of people that you allocated. You should be checking:
while (i < SIZE && (num = fscanf(f, "...", ...)) == 7)
{
...process valid input...
}
...consider what to do here, using `num` to distinguish between EOF and failed conversions...
The fact that valgrind can't identify the memory is puzzling. You've taken most of the relevant steps to ensure that you don't get buffer overflows (all except checking on the status of fscanf() properly).
Oh…you allocate persons; you're reading into inPersons…which is correct?
I think I would be writing a function to call fscanf() and detect and report errors, and then calling that from the while loop:
while (i < SIZE && get_person(&persons[i]) != EOF)
...
or:
while (i < SIZE && get_person(&inPersons[i]) != EOF)
...
This also allows you to switch from fscanf() to either fgets() and sscanf(), or getline() and sscanf().