How to reproduce "Stack smashing detected" in C++ application

Question

I get this error constantly in an embedded Linux application. I am trying to locate the problem and I narrowed it down to the following piece of code.

I want to solve this problem, if not I'd appreciate a couple of pointers what might have caused it.

Any suggestions how to reproduce this stack smashing problem is greately appreciated:

    uint8_t laststate = HIGH;
    uint8_t counter = 0;
    uint8_t j = 0;
    uint8_t i = 0;
    int data[5] = {0,0,0,0,0};

    int try_again = 1;
    float h = 0.0;
    float c = 0.0;

    int try_count = 0;
    const int max_tries = 30;

    if (this->DHT22_SETUP_ != 1)
    {
        fprintf(stderr,"You havent set up Gpio !\n");
    }
    else
    {

            data[0] = 0;
            data[1] = 0;
            data[2] = 0;
            data[3] = 0;
            data[4] = 0;

            //f = 0.0;
            h = 0.0;
            c = 0.0;
            j = 0;
            i = 0;
            counter = 0;
            laststate = HIGH;

            /* pull pin down for 18 milliseconds */
            pinMode( this->DHT22Pin, OUTPUT );
            digitalWrite( this->DHT22Pin, LOW );
            delay( 18 );

            /* prepare to read the pin */
            pinMode( this->DHT22Pin, INPUT );

            /* detect change and read data */
            for ( i = 0; i < MAX_TIMINGS; i++ )
            {
                counter = 0;
                while ( digitalRead( this->DHT22Pin ) == laststate )
                {
                    counter++;
                    delayMicroseconds( 1 );
                    if ( counter == 255 )
                    {
                        break;
                    }
                }
                laststate = digitalRead( this->DHT22Pin );

                if ( counter == 255 )
                    break;

                /* ignore first 3 transitions */
                if ( (i >= 4) && (i % 2 == 0) )
                {
                    /* shove each bit into the storage bytes */
                    data[j / 8] <<= 1;
                    if ( counter > 16 )
                        data[j / 8] |= 1;
                    j++;
                }
            }


            /*
             * check we read 40 bits (8bit x 5 ) + verify checksum in the last byte
             * print it out if data is good
             */
            if ((j >= 40) &&
                 (data[4] == ( (data[0] + data[1] + data[2] + data[3]) & 0xFF) ) )
            {
                h = (float)((data[0] << 8) + data[1]) / 10;
                if ( h > 100 )
                {
                    h = data[0];    // for DHT11
                }
                c = (float)(((data[2] & 0x7F) << 8) + data[3]) / 10;
                if ( c > 125 )
                {
                    c = data[2];    // for DHT11
                }
                if ( data[2] & 0x80 )
                {
                    c = -c;
                }
                //f = c * 1.8f + 32;
    #ifdef DEBUG
                printf( "Humidity = %.1f %% Temperature = %.1f *C (%.1f *F)\n", h, c, f );
    #endif
                try_again = 0;

                if (h == 0)
                {
                    try_again = 1;
                }
            }
            else
            {
                /* Data not good */
                try_again = 1;
                return 0.0;
                //printf ("Data not good, skipping\n");
            }

        /* Return humidity */
        return h;
    }

Thanks in advance.

Answer 1

If MAX_TIMINGS is >83, and if counter doesn't reach 255 before i goes over that 83 threshold, then the detect change and read data loop is repeated that many times, and therefore the block of ignore first 3 transitions if-expression is executed >40 times (there may be some off-by-one errors in my quick analysis) and therefore j ends up being >40 which means that j / 8 will be >4 which means it is out of bounds of data array and therefore accessing data[j / 8] in that case has undefined behaviour.

Answer 2

Here's a nice easy way:

class T {
   char big[<Some number bigger than your stack size>];
}

int main() {
    T bang;
    return 0;
}

The allocation of T on the stack will result in your stacksmash. What you have done is likely similar just not with a single class.