Stack around variable 'x' was corrupted

Question

I am manipulating a C code which requires me to extract a value, perform calculations and put the value back in the original variable.

The task of putting back the value causes the error:

Run-time check failiure-Stack around variable 'x' was corrupted.

Here's the code:

int RBSPtoNALU (unsigned char *rbsp, NALU_t *nalu, int rbsp_size, int nal_unit_type, int nal_reference_idc, int UseAnnexbLongStartcode)
{
  int len;

  int num = nalu->buf;  ***//nalu->buf is the information i am extracting***

 int r = 0,newnum=0;

  while (num > 0)       ***// Doing a simple reverse operation***

  {
      r = num % 10;
      newnum = newnum * 10 + r;

      num =(num/10);
  }


  byte x = newnum;
  printf("x is in c %c \n", x);
  printf("x is in d %d \n \n \n", x);  getchar();

  nalu->buf = &x;  ***// My efforts end here***


  assert (nalu != NULL);
  assert (nal_reference_idc <=3 && nal_reference_idc >=0);
#if (MVC_EXTENSION_ENABLE)
  assert (nal_unit_type > 0 && nal_unit_type <= NALU_TYPE_SLC_EXT);
#else
  assert (nal_unit_type > 0 && nal_unit_type <= NALU_TYPE_FILL);
#endif
  assert (rbsp_size < MAXRBSPSIZE);

  nalu->startcodeprefix_len = UseAnnexbLongStartcode ? 4 : 3;
  nalu->forbidden_bit       = 0;  
  nalu->nal_reference_idc   = (NalRefIdc) nal_reference_idc;
  nalu->nal_unit_type       = (NaluType) nal_unit_type;

#if (MVC_EXTENSION_ENABLE)
  if(nal_unit_type==NALU_TYPE_PREFIX || nal_unit_type==NALU_TYPE_SLC_EXT)
  {
    nalu->svc_extension_flag = 0;
    //nalu->non_idr_flag       = (nal_reference_idc==NALU_PRIORITY_HIGHEST) ? 0:1;
    nalu->reserved_one_bit   = 1;

  }
  else
    nalu->svc_extension_flag = 0;
endif


  len = RBSPtoEBSP (nalu->buf, rbsp, rbsp_size);
  nalu->len = len;

  printf("length len is %d", len); printf("\n \n");

  return len;
} ***//end of code***

nalu is an instance of the struct NALU_t with the following definition:

typedef struct nalu_t
{
  int       startcodeprefix_len;   //!< 4 for parameter sets and first slice in picture, 3 for everything else (suggested)
  unsigned  len;                   //!< Length of the NAL unit (Excluding the start code, which does not belong to the NALU)
  unsigned  max_size;              //!< NAL Unit Buffer size
  int       forbidden_bit;         //!< should be always FALSE
  NaluType  nal_unit_type;         //!< NALU_TYPE_xxxx
  NalRefIdc nal_reference_idc;     //!< NALU_PRIORITY_xxxx  
  ***byte     *buf;***                   //!< contains the first byte followed by the EBSP
  uint16    lost_packets;          //!< true, if packet loss is detected
#if (MVC_EXTENSION_ENABLE)
  int       svc_extension_flag;    //!< should be always 0, for MVC
  int       non_idr_flag;          //!< 0 = current is IDR
  int       priority_id;           //!< a lower value of priority_id specifies a higher priority
  int       view_id;               //!< view identifier for the NAL unit
  int       temporal_id;           //!< temporal identifier for the NAL unit
  int       anchor_pic_flag;       //!< anchor access unit
  int       inter_view_flag;       //!< inter-view prediction enable
  int       reserved_one_bit;      //!< shall be equal to 1
#endif
} NALU_t;

buf is a pointer reference to byte which is a struct defined as follows:

typedef unsigned char byte;

other markdown won't work inside code markdown, `**this is not bold**`. don't confuse people — Sourav Ghosh, Jul 02 '15 at 11:06

Gopi · Accepted Answer · 2015-07-02T11:12:48.187

0

int num = nalu->buf;

nalu->buf gives the value of pointer(address not the value stored in the location). You need to dereference it to get the value stored in the location

int num = *(nalu->buf);

Do the reverse

*(nalu->buf) = newnum;/* or  *(nalu->buf) = x */

edited Jul 02 '15 at 11:12

answered Jul 02 '15 at 10:56

Gopi

19,784
4
24
36

still won't work. now it gives an access violation. Can you suggest a way in which i can extract nalu-buf's value and then store it back into it without an error. – chicken momo Jul 02 '15 at 11:00
done this. help me put the modified value back into nalu->buf @gopi – chicken momo Jul 02 '15 at 11:10
the program is running, thanks, i'll trouble you just one last time with this problem: I wrote the following lines in the code(to check if its working fine) newnum = 12345; *(nalu->buf) = newnum; printf("value inside nalu->buf is %d \n", *(nalu->buf)); But the output that i get is: value inside nalu->buf is 57 what is going wrong? thanks in advance @gopi – chicken momo Jul 02 '15 at 11:20
@chickenmomo Good. If this helped mark it as answered right way to say thanks on SO – Gopi Jul 02 '15 at 11:21
the program is running, thanks, i'll trouble you just one last time with this problem: I wrote the following lines in the code(to check if its working fine) newnum = 12345; *(nalu->buf) = newnum; printf("value inside nalu->buf is %d \n", *(nalu->buf)); But the output that i get is: value inside nalu->buf is 57 what is going wrong? thanks in advance @gopi – chicken momo Jul 02 '15 at 11:27
`nalu->buf` is of type char and can hold only one byte .. Whereas `sizeof(int) > sizeof(char)` – Gopi Jul 02 '15 at 11:31

score 0 · Answer 2 · answered Jul 02 '15 at 10:57

You can't do that:

  byte x = newnum;
  printf("x is in c %c \n", x);
  printf("x is in d %d \n \n \n", x);  getchar();

  nalu->buf = &x;  ***// My efforts end here***

x (which probably is just becoming a compiler alias for newnum, as you don't modify it) only has local scope! It should cease to exist once your function exits. But you save its address in a struct that comes from the outside.

score 0 · Answer 3 · answered Jul 02 '15 at 11:09

nalu->buf is defined as byte *buf;

Which means it is a pointer to byte.

You are copying the address in the nalu->buf to integer variable num. Which is wrong. This is a symantic error, but you are not getting the exception due to this.

Going further from there you declare a variable named 'x' and copy it's address into nalu->buf. Which is wrong because the variable x will not exist when this function exits. This is the reason you are getting the runtime error.

Stack around variable 'x' was corrupted

3 Answers3