access violation in VC6++ fwrite

[azra36]

i have an unhandled exception cx0005:access violation in VC6++ while i try to run my c code with
main.exe it gives a window showing to send a error report or to debug, while i give debug, it takes to fwrite file an breaks at the point
--> if (anybuf(stream))//this is the line where it breaks
/* already has buffer, use its size */
bufsize = stream->_bufsiz;

the call stack has following values.
fwrite(const void * 0x0012ee5c, unsigned int 0x00000001, unsigned int 0x00001000, _iobuf * 0xffffffff) line 105 + 3 bytes
main() line 164 + 26 bytes
mainCRTStartup() line 206 + 25 bytes
KERNEL32! 7c817077()
i'm trying from may days on this.
please has anyone come across this exception,Thanks in advance

[mitrmkar]

the call stack has following values.
fwrite(const void * 0x0012ee5c, unsigned int 0x00000001, unsigned int 0x00001000, _iobuf * 0xffffffff) line 105 + 3 bytes

The last parameter for fwrite() has an invalid value (0xffffffff).

Make sure that you succeed in opening the file properly (using fopen()), like so ..

FILE * fp = fopen("my_file.txt", "w");
if(fp != NULL)
{
  /* Managed to open it, now write ... */
  fwrite(..., fp);
}

PS. Why is your text all in bold?

[Tellalca]

mitrmkar catched really nice. The value is a bad pointer. You should check that value.

Please pay attention to your spelling when you are posting so we can follow easily.

[azra36]

Thanks mitrmkar & Tellalca, but this dosen't solve the problem :(

i check it dosen't point to NULL. well the point where it breaks is in fwrite.c code as given above.
can u please tell me what is the size of iobuffer fwrite writes before writing to the file??
is it in anycase overwriting the buffer??
as i have two fwrites in my code writing to different files, and the size is also quite large in MB's.

the code is as given below. i've not included certain global variables below but included in my code.

int main()
{



    unsigned int num=0;

    char InputFile[128];
    char OutputFile[128];
    int pid_value = 0x101;
	int argc = 3; 
	char *argv[] = {"main", "pat", "Puma-TV543-82-OAD-UK-001.trp"};
	
    int fcount=0;
    FILE *fptr, *optr;
    u_char sec_buff[4096];
    u_char *TSptr;
    dvb_pat_t dvb_pat;
    dvb_eit_t dvb_eit;
    

    memset(sec_buff,0,4096);
    memset(pid_array,0,100);
    memset(blocknoarr,0,100);
    if(argc < 3)
    {
        printf("Improper usage:\n");
        printf("HexFromStream <table_name> <path_of_stream>\n");
        printf("table_name: pat, eit, nit, sdt, tot, tdt\n");
        exit(-1);
    }
    else
    {
        printf("table = %s, file = %s\n",argv[1],argv[2]);
       pid_value = 0x101;//mapPidFromTable(argv[1]);
        printf("pid_value = 0x%x\n",pid_value);
        strcpy(InputFile,argv[2]);
        strcpy(OutputFile,argv[2]);
        strcat(OutputFile,".txt");
	}

          
       
         






    
	do{
    fptr = fopen(InputFile,"rb");
    optr = fopen("D:\\Puma-TV543-82-OAD-UK-001.txt","wb");

    if(fptr == NULL)
    {
        printf(" failed to open the input file");
        return 0;
    }

    if(optr == NULL)
    {
        printf(" failed to open the output file");
        return 0;
    }
       

while(!feof(fptr)) 
{
    
    do{
        num = fread(TSbuffer,1,BUFFER_SIZE,fptr);
         if(num < TS_LEN)
        {
            printf("failed to read");
            break;;
        }
        TSptr = TSbuffer;
        
        do
        {
            

		   if( NULL != filter_section(TSptr,sec_buff) ) //Third arg is Packet Number
		   {     
			   if(optr!=NULL)
				   
				   printf(" optr points at %u\n",optr);
               [B] /******* code is breaking at this fwrite**********/[/B]				   [B]fwrite(sec_buff, 1, 4096, optr);[/B]				   fflush(optr);
            }
            
            TSptr += TS_LEN;
            
        }while( ( (BUFFER_SIZE +TSbuffer) - TSptr) >= TS_LEN);
        
    }while(num);
} 

    fclose(fptr);
    fclose(optr);
	 fcount++;
	}while(fcount<2);

  

    return 0;
}


char *filter_section (u_char *_ts, u_char *buf)
{
	u_int table_id=0;
	u_int msg_id=0;
	int flag=0;
	u_char *ptr = _ts;
	ts_hdr_t *ts = (ts_hdr_t *) _ts;
	
	//FIXME: just for reset reasons
	if (buf == NULL) {
		len = 0;
		sec_len = 0;
		return NULL;
	}
	
	/***** do TS stuff *****/
	// check SYNC byte
	if (ts->sync_byte != TS_SYNC_BYTE) {
		return NULL;
	}
	if( (ts->transport_scrambling_control == 2) ||(ts->transport_scrambling_control == 3))
		fprintf (stderr, "SEC: transport_scrambling_control  = %d ", cc, ts->transport_scrambling_control);
	
	// filter PID
	if (pid != HILO (ts->PID)) 
		return NULL;
	
	// check Continuity Counter
	if (ts->payload_unit_start_indicator) {
		cc = ts->continuity_counter;
	} else {
		cc++;
		cc %= 0x10;
		
		if (cc != ts->continuity_counter)  {
			fprintf (stderr, "SEC: NP exp:%x rec:%x\n", cc, ts->continuity_counter);
			len = 0;
		}
		
		cc = ts->continuity_counter;
	}
	
	/***** do Section stuff *****/
	
	// invalid somewhere in the middle
	if (!ts->payload_unit_start_indicator && !len) {
		sec_len = 0;
		len = 0;
		fprintf (stderr, "SEC: ERR in the middle\n");
		return NULL;
	}
	
	ptr += TS_HDR_LEN;			// skip TS hdr
	
	if (ts->adaptation_field_control & 0x02)// has AF
		ptr += 1 + buf[TS_HDR_LEN];	// skip AF_len + AF
	
	if ((ptr-_ts) >= TS_LEN) {
		sec_len = 0;
		len = 0;
		fprintf (stderr, "SEC: ERR len1\n");
		return NULL;
	}
	
	if (ts->payload_unit_start_indicator) {
		if ((ptr + *ptr +1) > (_ts + TS_LEN)) {
			sec_len = 0;
			len = 0;
			fprintf (stderr, "SEC: ERR len2 %x\n", *ptr);
			return NULL;
		}
		
		ptr += *ptr + 1;		// skip section ptr field
		
		sec_len = (*(ptr+1) & 0x0F) << 8 | (*(ptr+2) & 0xFF);
		len = 0;
	}
	
	
	
		memcpy (buf+len, ptr, TS_LEN - (ptr-_ts));
	
#if 0
	{ int i;
	for (i=0; i<(TS_LEN - (ptr-_ts)); i++)
		if (isprint (ptr[i])) {
			fprintf (stderr, "%c  ", ptr[i]);
		} else {
			fprintf (stderr, "%02x ", ptr[i]);
		}
		
		fprintf (stderr, "\n\n");
	}
#endif
	
	len += TS_LEN - (ptr-_ts);
	
	if (len >= sec_len) {
		fprintf (stderr, "SEC: completed section 0x%x on PID: 0x%x len: %d\n", *buf, pid, sec_len);
		len = 0;
		return buf;
	}
	

	table_id = buf[0];

		if(table_id != 0x3c)
			
			return NULL;

            msg_id = (buf[10] << 8)  | buf[11];
			if(msg_id != 0x1003)

				return NULL;

		
		      if(  (msg_id==0x1003))
             
				 DDB_Parser_Parser( 1, 1, 1, sizeof(buf),buf,0,NULL,0);
				
                       if(DDB_Parser.ModuleId != 0x0005)
					   { 
						   return NULL;
					   }
             
					    if((DDB_Parser.ModuleId == 0x0005))
						{ 
							//return NULL;
						//}
							flag=1;
							if(flag==1)
								blocksize=0;
                         blocksize= DDB_Parser.MessageLength-6;

    
					//  NoOfBlocks = (0x017d7c54/blocksize);

                        
                          
						blocknum=DDB_Parser.BlockNumber;

						if(blocksrcv[blocknum]==0)
                      
                        {
                    
				       printf("-----------------------------------------\n");
					   printf(" Data Block Number %d\n",DDB_Parser.BlockNumber);
					   

                     
					    bpos=DDB_Parser.BlockNumber*blocksize;
                      
						  printf("%d\n",bpos);
						  fpddb = fopen("D:\\ddb.txt","wb");
				 
							if(fpddb==NULL)
							 {			
								printf("failed to open ddb output file \n");
								return 0;
							}
						
						 fseek(fpddb,bpos,SEEK_SET);
						 printf(" where fpddb points %u\n",fpddb);
						 if(fpddb!=NULL)


		      			 fwrite(DDB_Parser.BlockDataByte,blocksize,1,fpddb);
						 fflush(fpddb);
					     fclose(fpddb);
                          
					blocksrcv[blocknum]=1;
					 return buf;
						}

						
		
		
		
			//	section_notify(buf);
		//return buf;
	}
	
	
#if 0
	// crc stuff
	{
		int sec_len;
		u_long crc_new;
		u_long crc_orig;
		
		sec_len = ((*(buf+1) & 0x0F) << 8) | *(buf+2);
		
		crc_orig = buf[sec_len+2];
		crc_orig = crc_orig << 8 | buf[sec_len+1];
		crc_orig = crc_orig << 8 | buf[sec_len];
		crc_orig = crc_orig << 8 | buf[sec_len-1];
		fprintf (stderr, "crc_orig: %x\n", crc_orig);
		
		crc_new = crc32 (buf, sec_len);
		fprintf (stderr, "crc: %x\n", crc_new);
	}
#endif
}

[azra36]

the location where optr points to as i'm checking through printf is 4294967295, which is hexadecimal equivalent of 0xffffffff. as given in the call stack, so how do i avoid this?

[mitrmkar]

It very much looks like you are overwriting memory somewhere, rendering this optr invalid.
You might get a good clue about as to what is happening by doing the following:

• Put a breakpoint at the line; optr = fopen("D:\\Puma-TV543-82-OAD-UK-001.txt","wb");
• Hit F10 to open the file
• Note down the value of optr (it will be something like 0x00423A90)
• Add a data breakpoint, using the expression: optr != 0x00423A90
• Hit F5 to continue, at the moment that optr's value changes, you will break into the debugger

PS. When you post code, please use code tags.

[code]

Your (nicely formatted) code here

[/code]

[azra36]

i've noticed the value of optr is 0x00427ac0, but why is it later pointing at 0xffffffff?? i'm unable to locate where i'm overwriting....

[mitrmkar]

i'm unable to locate where i'm overwriting....

Did you try using a Data Breakpoint?

[azra36]

yeah i did....