Memory error in C program, The name disappears? - c

Question

Im trying to make a simple game, http://pastebin.com/BxEBB7Z6, in c. The goal is to beat the computer by getting as close to 21 as possible by getting random numbers.
For each round the players name and sum is presented, but for some reasons it only works that first time? Something like this:
Player John has sum 0.
Player has sum 9.
Player has sum 11.
And so on.
Why does the the player's name get showed once, but not any other prints after that? I dont do a reassign somewhere :-)
I use the function void PrintPlayerSum(struct Player *p) to print it out, it works the first time, but only that.
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
struct Player
{
char name[256];
int sum;
};
void PrintPlayerSum(struct Player *p)
{
printf("Player %s has sum %d\n", p->name, p->sum);
}
void wait ( int seconds )
{
clock_t endwait;
endwait = clock () + seconds * CLOCKS_PER_SEC ;
while (clock() < endwait) {}
}
int main()
{
struct Player *player = malloc(sizeof(*player));
strcpy( player->name, "John");
player->sum = 0;
while(1)
{
PrintPlayerSum(player);
printf("Do you want another number? (y/n, q for quit) ");
char ch;
scanf("%s", &ch);
if( ch == 'q' )
break;
if( ch == 'y' )
{
srand(time(NULL));
int rnd = rand() % 13 + 1;
player->sum += rnd;
printf("Player got %d\n", rnd);
}
if( ch == 'n' || player->sum > 21)
{
if( player->sum > 21 )
{
printf("\n*** You lost the game, please try again... ***");
}
else
{
printf("\nCPU's turn\n");
int cpusum = 0;
while( 1 )
{
if( cpusum > 21 )
{
printf("\n*** CPU lost the game with the score %d, you win! ***", cpusum);
break;
}
if( cpusum > player->sum )
{
printf("\n*** CPU won the game with the score %d, please try again ***", cpusum);
break;
}
wait(1);
srand(time(NULL));
int rnd = rand() % 13 + 1;
cpusum += rnd;
printf("CPU got %d, sum is %d\n", rnd, cpusum);
}
}
break;
}
printf("\n\n");
}
/* Cleanup ******************/
free(player);
/****************************/
printf("\n\n\n");
system("PAUSE");
return 0;
}

Answer 1

I suspect the problem is your use of scanf. You say you want to read a zero-terminated string, but you stuff it into a single char. The way the variables are laid out on the stack causes the terminating zero-byte to end up as the first char in player->name.
Try typing "buffer overflow" instead of "y", and you should get "player uffer overflow go ...".
If you want to stick with scanf, you want to make sure you pass it a proper string and set a limit on the size of the target buffer. For reading one char, try fgetc.
Edit:
The above is of course not quite right... It is a buffer overflow, but it is the pointer of the player struct that is being overwritten. By lucky coincidence you get to a valid address that points to a zero-byte. By typing more, you will most likely get a crash instead.

Answer 2

Your scanf call is likely the problem:
scanf("%s", &ch);
You seem to want a single character, but you're reading a string. It'll put the first character in ch, but keep going from there and overwrite whatever's next on the stack.
You should probably just use fgetc(stdin) or another function that reads a single character, if a single character is what you want.

Answer 3

shouldn't it be
struct Player *player = malloc(sizeof(struct Player));

Answer 4

Weird thing like that are usually caused by writing to unallocated memory. (Usually writing beyond the end of an array.)
I didn't look at your code, but search for things like that. Then run your program under valgrind.

Answer 5

At a first glance i can see you have done:
scanf("%s", &ch);
Which will use the address of ch to input a string, and therefore result in a buffer overflow. You need to do
ch = getchar ();
scanf ("%c", &ch);
etc.