printf access violation in subfunction - Ansi C90

Question

A call to printf inside a subfunction results in an Access Violation.

The program is quite huge in size. but i was able to isolate the problem to the point where only the subfunction call is made.

i am able to crash the system by calling printf with a literal constant like so: printf("test"). Some other people had also access violations by giving a weird object to printf - this is not the case here.

Here is some pseudocode:

subfunction()
{
    printf("all works great"); //Access Violation

    //some other calls here
}

void main()
{
    otherfunctions(); //
    printf("all works great");
    subfunction();        
    //some more calls here
}

From my stachtrace:

msvcr100d.dll!_chkstk()
msvcr100d.dll!_write(int fh, const void * buf, unsigned int cnt)
msvcr100d.dll!_flush(_iobuf * str)
msvcr100d.dll!_ftbuf(int flag, _iobuf * str)
msvcr100d.dll!printf(const char * format, ...)

The Code is in C90 code and compiles with VS2010. It should be treated as C90. It happened after a refactoring where all _(v)snprintf were replaced with their _(v)snprintf_s counterparts. I am not sure if this had an influence.

I think the buffer is getting flushed before anything got written into it.

How can i investigate this further? What systemsettings could my other code touch to crash printf like that?

Answer 1

The mistake was that i expected printf to print a string but in reality passed a non string to it.

For Ansi-C I usually write a structure to encapsule strings.

typedef struct TString{
    char buffer[2000];
}TString;

I tend to write:

void mistake( void ){
    TString str;
    TStrnig_Construct(&str);
    prtinf( "%s", str );
    TString_Destuct(&str);
}

This is hard to spot for me since it really looks like str is a string. In reality str is not a string but a structure. This error can manifest anywhere, especially if the content of the tructure is extended with other information (e.g. size_t size).

I should have written:

void corrected( void ){
    TString str;
    TStrnig_Construct(&str);
    prtinf( "%s", str.buffer );
    TString_Destuct(&str);
}