Segfault with C sockets on Linux

Hi!

I seem to be getting a segmentation fault and cant figure it out. Also, the count returns a negative value which is quite odd... it probably crashed after just one iteration of the loop.

-Arti

Code:

---

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFF_SIZE 1024

int main(int argc, char** argv) {
  struct sockaddr_in addr1, addr2, addr3;
  int socket1;
  char msg1[] = "GET /~1204a007/index.html HTTP/1.0\n\n";
  char *inmsg1 = 0;
  char i;
  int j;
  int count=0;
  FILE* f1;
 
  inmsg1 = (char*) malloc(sizeof(char) * BUFF_SIZE+1);
  if (inmsg1 == NULL) {
    printf("Low memory error\n");
    return 1;
  }
//  inmsg1[BUFF_SIZE] = '\0';
 
  addr1.sin_addr.s_addr = inet_addr("192.168.36.211");
  addr1.sin_port = htons(80);
  addr1.sin_family = AF_INET;
  memset(&(addr1.sin_zero), 0, 8);
 
  socket1 = socket(AF_INET, SOCK_STREAM, 0);
  connect(socket1, (struct sockaddr*) &addr1, sizeof(struct sockaddr_in));
 
  send(socket1, &msg1, strlen(msg1), 0);

f1 = fopen("versace.txt", "w");
 
  while (1) {
  memset(&inmsg1, 0, sizeof(char) * BUFF_SIZE);
  j=recv(socket1, &inmsg1, sizeof(char) * BUFF_SIZE, 0);
  if (j==0 || j==-1) break;
  count++;

//  for (i=0; i<j; i++) {
//    fprintf(f1, "%c",&inmsg1[i]);
//  }
    fprintf(f1, "%s", &inmsg1);
  }
  printf("\n");
  printf("Count: %d\n", &count);
 
  fclose(f1);
  close(socket1);
  return 0;
}

---

1) Don't typecast the return of malloc.
2) Don't pass the address of a pointer to memset, because that's not what it wants. It wants a pointer, you have a pointer, give it a pointer.

Code:

---

memset( inmsg1, 0, BUFF_SIZE );

---

3) 'sizeof( char )' will always be one, so there's no point in doing "sizeof( char ) *".
4) fflush your output, and you won't have to wonder "probably crashed after..."
5) Your indentation is horrible. But on an aside, it's better than some I've seen.

Quzah.

Hi!

Thanks for the reply. I think I got a step closer with that (I got the segfault from memset fixed), but still have the dreaded segfault. BTW, I used NEdit for formatting.... except for a few lines that I added in later. Anyway, here's what I've got after the mods to my last code:

(See the gdb output at the bottom; it wasn't of much use)

Code:

---

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFF_SIZE 1024

int main(int argc, char** argv) {
  struct sockaddr_in addr1, addr2, addr3;
  int socket1;
  char msg1[] = "GET /~1204a007/index.html HTTP/1.0\n\n";
  char *inmsg1 = 0;
  char i;
  int j;
  int count=0;
  FILE* f1;
 
  inmsg1 = malloc(sizeof(char) * BUFF_SIZE+1);
  if (inmsg1 == NULL) {
    printf("Low memory error\n");
    return 1;
  }
//  inmsg1[BUFF_SIZE] = '\0';
 
  addr1.sin_addr.s_addr = inet_addr("192.168.36.211");
  addr1.sin_port = htons(80);
  addr1.sin_family = AF_INET;
  memset(addr1.sin_zero, 0, 8);
 
  socket1 = socket(AF_INET, SOCK_STREAM, 0);
  connect(socket1, (struct sockaddr*) &addr1, sizeof(struct sockaddr_in));
 
  send(socket1, &msg1, strlen(msg1), 0);

  f1 = fopen("versace.txt", "w");
 
  while (1) {
//  memset(inmsg1, 0, sizeof(char) * BUFF_SIZE);
  j=recv(socket1, &inmsg1, sizeof(char) * BUFF_SIZE, 0);
  if (j==0 || j==-1) break;
  count++;

//  for (i=0; i<j; i++) {
//    fprintf(f1, "%c",&inmsg1[i]);
//  }
    fprintf(f1, "%s", &inmsg1);
    fflush(f1);
  }
  printf("\n");
  printf("Count: %d\n", &count);
 
  fclose(f1);
  close(socket1);
  return 0;
}



[root@CPQNitin root]# gdb ./a.out -c core.2254
GNU gdb Red Hat Linux (5.3post-0.20021129.18rh)
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
Core was generated by `./a.out'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x313a3630 in ?? ()
(gdb) bt
#0  0x313a3630 in ?? ()
Cannot access memory at address 0x3a393020

---

Code:

---

send(socket1, &msg1, strlen(msg1), 0);

---

msg1 is already a pointer, so you dont need to pass its reference. Same thing with your recv() call.