Value of loop variable changes abruptly

Question

i am trying to run a loop from january1 2015 to current date and fill value of each day in database. I am using a julian day counter as loop variable. No where inside the loop i am changing the value of counter but after looping 2 times the value of counter changes abruptly to garbage values. What can be the reason?

for (julian_day_counter = 2457024; julian_day_counter < curr_day; \
               julian_day_counter++)
    {
        for (slot_counter = 1; slot_counter < 24; slot_counter++)
        {
            consumption = (rand() % (CONSUMPTION_MAX_VAL - CONSUMPTION_MIN_VAL + 1)) \
                    + CONSUMPTION_MIN_VAL;

            /* Form current slot value column string based on current slot value */
            addr_port_strncpy((addr_u8bit_t *)slot_value_col, (addr_u8bit_t *)"slot_", \
                addr_port_strlen((addr_c8bit_t *)"slot_"));
            ADDR_SPRINTF(temp_str, "%d", slot_counter);
            addr_port_strncat((addr_s8bit_t *)slot_value_col, (addr_c8bit_t *)temp_str, \
               ADDR_SHORT_STR_LEN);

            /* Comma separated Column names */
            addr_port_strncat((addr_s8bit_t *)col_name,(addr_c8bit_t *)slot_value_col,
                ADDR_SHORT_STR_LEN);
            addr_port_strncat((addr_s8bit_t *)col_name, \
                (addr_c8bit_t *)" ,",ADDR_SHORT_STR_LEN);

            /* Comma separated Column values */
            ADDR_SPRINTF(temp_str, "%f ,", consumption); 
            addr_port_strncat((addr_s8bit_t *)col_value,
             (addr_c8bit_t *)temp_str, ADDR_SHORT_STR_LEN);
        }
        addr_port_strncat((addr_s8bit_t *)col_name, \
                (addr_c8bit_t *)"julian_day",ADDR_SHORT_STR_LEN);

        ADDR_SPRINTF(temp_str, "%d", julian_day_counter);
        addr_port_strncat((addr_s8bit_t *)col_value, \
            (addr_c8bit_t *)temp_str, ADDR_SHORT_STR_LEN);

        /* Insert row for consumption profile information in DB*/    
        if( ADDR_FAILURE == addr_db_local_insert(p_glb_pdb,
                ADDR_APPLIANCE_CONSUMPTION_PROFILE_TABLE, (addr_c8bit_t *)col_name,
                (addr_c8bit_t *)col_value))
        {
            ret_val = ADDR_FAILURE;
        }
    }

Below is the gdb snippet:

Breakpoint 1, addr_db_update_dummy_appliance_consumption_profile (
    p_glb_pdb=0x812a4b0, curr_day=2457151)
    at addr_db_app.c:13184
13184       addr_s8bit_t         temp_str[ADDR_SHORT_STR_LEN] = {'\0'}; 
(gdb) watch julian_day_counter
Hardware watchpoint 2: julian_day_counter
(gdb) c
Continuing.
Hardware watchpoint 2: julian_day_counter

Old value = 0
New value = 2457024
0x08088d55 in addr_db_update_dummy_appliance_consumption_profile (
    p_glb_pdb=0x812a4b0, curr_day=2457151)
    at addr_db_app.c:13208
13208       for (julian_day_counter = 2457024; julian_day_counter < curr_day; \
(gdb) c
Continuing.
Hardware watchpoint 2: julian_day_counter

Old value = 2457024
New value = 2457025
0x08088f2d in addr_db_update_dummy_appliance_consumption_profile (
    p_glb_pdb=0x812a4b0, curr_day=2457151)
    at addr_db_app.c:13208
13208       for (julian_day_counter = 2457024; julian_day_counter < curr_day; \
(gdb) c
Continuing.
Hardware watchpoint 2: julian_day_counter

Old value = 2457025
New value = 2456880
0x00b6a33b in strncat () from /lib/libc.so.6

Yeah could you make the code more complicated please. Thanks. — trojanfoe, May 08 '15 at 10:23
You have the answer right there in your gdb log. `strncat` is overwriting it as cnicutar suggested. — undur_gongor, May 08 '15 at 10:23
Uhhh... how about a [minimal example](http://stackoverflow.com/help/mcve)? — luk32, May 08 '15 at 10:24
But what can be the solution for this??? and why strncat is changing it — Akash Sinha, May 08 '15 at 10:25
I assume the problem is in `addr_port_strncat` (due to the naming -> strncat). Check for dangling pointers — Levi, May 08 '15 at 10:28
Debug it step by step, and follow the contents of each of your null-terminated strings. One of these strings most likely becomes "not null-terminated" at some point, leading to undefined behavior which you experience as memory that is being overridden and values that are unexpectedly changing. I have voted to close this question (which I don't normally do), because you are essentially asking us to debug your code for you, and there's a specific category for closing this type of questions. — barak manos, May 08 '15 at 10:30
@AkashSinha The function is probably not changing it intentionally. Instead, you quite likely are exceeding a buffer and causing strncat to overwrite the value inadvertently. — David Hoelzer, May 08 '15 at 10:36

score 1 · Answer 1 · edited May 23 '17 at 11:51

Well done to @undur_gongor for pointing this out in the comments to your question; the culprit is strncat(). It's overwriting the buffer and corrupting other variables. You have a buffer overflow.

You don't appear to be passing the 3rd parameter correctly; from this question:

#define BUFFER_SIZE 64
char buff[BUFFER_SIZE];

//Use strncpy
strncpy(buff, "String 1", BUFFER_SIZE - 1);
buff[BUFFER_SIZE - 1] = '\0';

strncat(buff, "String 2", BUFFER_SIZE - strlen(buff) - 1);

strncat(buff, "String 3", BUFFER_SIZE - strlen(buff) - 1);

score 0 · Answer 2 · answered May 08 '15 at 10:27

0

The real clue here is:

0x00b6a33b in strncat () from /lib/libc.so.6

Your value is being modified in some other function call that leads to a strncat. The offending code is not in the question as it stands now, however. :)

answered May 08 '15 at 10:27

David Hoelzer

15,862
4
48
67

So what's the solution? (it's pretty simple) and well done to @undur_gongor for pointing this out originally. – trojanfoe May 08 '15 at 10:28
Sorry but am still not able to get.. julian_day_counter is not even being used in strncat function. – Akash Sinha May 08 '15 at 10:33
@undur_gongor Those are clearly wrapper functions of some kind. They very well may be where the problem is, but it is not possible to say what is causing the behavior without seeing what the wrapper functions are doing with the passed in arguments before, while and after calling strncat. – David Hoelzer May 08 '15 at 10:34
I agree: as the code is incomplete we are just guessing. – undur_gongor May 08 '15 at 10:36

Value of loop variable changes abruptly

2 Answers2