How to reproduce "Stack smashing detected" in C++ application - c++

Question

I get this error constantly in an embedded Linux application. I am trying to locate the problem and I narrowed it down to the following piece of code.
I want to solve this problem, if not I'd appreciate a couple of pointers what might have caused it.
Any suggestions how to reproduce this stack smashing problem is greately appreciated:
uint8_t laststate = HIGH;
uint8_t counter = 0;
uint8_t j = 0;
uint8_t i = 0;
int data[5] = {0,0,0,0,0};
int try_again = 1;
float h = 0.0;
float c = 0.0;
int try_count = 0;
const int max_tries = 30;
if (this->DHT22_SETUP_ != 1)
{
fprintf(stderr,"You havent set up Gpio !\n");
}
else
{
data[0] = 0;
data[1] = 0;
data[2] = 0;
data[3] = 0;
data[4] = 0;
//f = 0.0;
h = 0.0;
c = 0.0;
j = 0;
i = 0;
counter = 0;
laststate = HIGH;
/* pull pin down for 18 milliseconds */
pinMode( this->DHT22Pin, OUTPUT );
digitalWrite( this->DHT22Pin, LOW );
delay( 18 );
/* prepare to read the pin */
pinMode( this->DHT22Pin, INPUT );
/* detect change and read data */
for ( i = 0; i < MAX_TIMINGS; i++ )
{
counter = 0;
while ( digitalRead( this->DHT22Pin ) == laststate )
{
counter++;
delayMicroseconds( 1 );
if ( counter == 255 )
{
break;
}
}
laststate = digitalRead( this->DHT22Pin );
if ( counter == 255 )
break;
/* ignore first 3 transitions */
if ( (i >= 4) && (i % 2 == 0) )
{
/* shove each bit into the storage bytes */
data[j / 8] <<= 1;
if ( counter > 16 )
data[j / 8] |= 1;
j++;
}
}
/*
* check we read 40 bits (8bit x 5 ) + verify checksum in the last byte
* print it out if data is good
*/
if ((j >= 40) &&
(data[4] == ( (data[0] + data[1] + data[2] + data[3]) & 0xFF) ) )
{
h = (float)((data[0] << 8) + data[1]) / 10;
if ( h > 100 )
{
h = data[0]; // for DHT11
}
c = (float)(((data[2] & 0x7F) << 8) + data[3]) / 10;
if ( c > 125 )
{
c = data[2]; // for DHT11
}
if ( data[2] & 0x80 )
{
c = -c;
}
//f = c * 1.8f + 32;
#ifdef DEBUG
printf( "Humidity = %.1f %% Temperature = %.1f *C (%.1f *F)\n", h, c, f );
#endif
try_again = 0;
if (h == 0)
{
try_again = 1;
}
}
else
{
/* Data not good */
try_again = 1;
return 0.0;
//printf ("Data not good, skipping\n");
}
/* Return humidity */
return h;
}
Thanks in advance.

Answer 1

If MAX_TIMINGS is >83, and if counter doesn't reach 255 before i goes over that 83 threshold, then the detect change and read data loop is repeated that many times, and therefore the block of ignore first 3 transitions if-expression is executed >40 times (there may be some off-by-one errors in my quick analysis) and therefore j ends up being >40 which means that j / 8 will be >4 which means it is out of bounds of data array and therefore accessing data[j / 8] in that case has undefined behaviour.

Answer 2

Here's a nice easy way:
class T {
char big[<Some number bigger than your stack size>];
}
int main() {
T bang;
return 0;
}
The allocation of T on the stack will result in your stacksmash. What you have done is likely similar just not with a single class.