Bus error reading file; strange i value

Hi guys. I'm working on a program that basically functions as a cookie cutter for GeoTIFF (geographic TIFF) images based on a shapefile (just a file with some shape information, like it sounds). It has worked reliably with most shapefiles, but the one I'm currently using is causing some weird problems reprojecting the projection file. My projection code is based off of the open source shpproj.c.

Here's where the code is messing up exactly (it's a very large program, so there's a chance it showed up way earlier in the code, but I can't post all of that):

Code:

---

SHP = SHPOpen(shp_name, "rb");

if(SHP == NULL){
    printf("Unable to open shapefile.\n");
    exit(-1);
}

prj_file = fopen(asFileName(prj_filename, "prj"), "rt");

if(prj_file){

    i = 0;

    while(fscanf(prj_file, "%s", parg) != EOF){
        printf("%d\n", i);
        in_prj[i] = malloc(strlen(parg) + 1);
        strcpy(in_prj[i], parg);
        i++;
    }
}

---

prj_file is a FILE*, parg is a char[128], i is an int, in_prj is a char* [16]. I added the printf to try to figure out what the bus error was. For some reason, when it prints i for this particular file, it's reliably always printing 1600418401. Then there's a bus error immediately following, which makes sense. What confuses me is the i value. I'm assuming it's a memory issue of some sort. Valgrinding produces nothing useful, though. It says there aren't any memory issues leading up to it, and then tells me there's an invalid write where it's giving me the bus error, which I know.

If anyone has any ideas, please let me know. I'm confused beyond all belief.

I can post more information about what I'm calling if you need that. I'm working remotely from a Linux machine and posting on my Windows machine, so copying the code won't let me paste it here but if I really need to I guess I can just open up Firefox on that machine and post from there.

> 1600418401
In Hex = 5F647261

As characters
5F = _
64 = d
72 = r
61 = a

Seem familiar? (look in your file)

Look for either "ard_" or "_dra"

> while(fscanf(prj_file, "%s", parg)
This doesn't check for overflowing parg

> strcpy(in_prj[i], parg);
> i++;
This doesn't check for overflowing in_prj either

I actually did just make parg a lot bigger which fixed the problem for this case, but not for all. How do you check for overflowing parg? That'd be something really useful in the future, to avoid weird problems like this. Thank you.

Read the file using fgets(), where you do specify the size of the buffer.

Then validate that buffer (for content and length) before copying it to wherever you want.

I would do in your case

Code:

---

char buff[BUFSIZ];
while ( i < 16 && fgets(buff, sizeof buff, prj_file) != NULL ) {
  // check content and length
  // allocate space and copy
}

---