从函数返回时的SIGABRT

Question

my problem is that, just as I mentioned on the title, i have a function that, upon return, causes a SIGABRT to be raised. I ran valgrind on my program and I got this at that exact point.

==5807== Process terminating with default action of signal 6 (SIGABRT)
==5807==    at 0x52F5428: raise (raise.c:54)
==5807==    by 0x52F7029: abort (abort.c:89)
==5807==    by 0x53377E9: __libc_message (libc_fatal.c:175)
==5807==    by 0x53D911B: __fortify_fail (fortify_fail.c:37)
==5807==    by 0x53D90BF: __stack_chk_fail (stack_chk_fail.c:28)
==5807==    by 0x402E8B: foo (file.c:43)
==5807==    by 0x202C27323939312C: ???
==5807==    by 0x592D4D4D2D444426: ???
==5807==    by 0x66202C2927595958: ???
==5807==    by 0x2965736C60: ???
==5807==    by 0x505770F: ??? (in /usr/lib/x86_64-linux-gnu/libodbc.so.2.0.0)

==5807==

This is the code i'm executing, the stack error causes the abort at the return ret statement from add_user:

int add_user(SQLHDBC dbc, char * mail, char * password, char * name,  char * date) {

char query[TAM];
SQLHSTMT stmt;
SQLRETURN ret;

if (mail == NULL || password == NULL || name == NULL ||  date == NULL)
    return ERR;

sprintf(query, "INSERT INTO mms_user values (default,'%s',encrypt_password('%s'),set_type(),'%s',to_date('%s', 'DD-MM-YYYY'), false)", mail, password, name,date);

ret= DBExecuteQuery(dbc, query, &stmt);

DBFreeHandle(&stmt);
return ret;
}

int DBExecuteQuery(SQLHDBC dbc, char * query, SQLHSTMT *stmt) {

SQLRETURN ret;

/*Error control*/
if (query == NULL || stmt == NULL)
    return ERR;

/*Allocates memory for a new statement*/
ret = SQLAllocHandle(SQL_HANDLE_STMT, dbc, stmt);
if (!SQL_SUCCEEDED(ret)) {
    return ERR;
}

/*Executes query and stores result in stmt*/
ret = SQLExecDirect(*stmt, (SQLCHAR *)query, SQL_NTS);
if (!SQL_SUCCEEDED(ret))
    return ERR;

return OK;

}

int DBFreeHandle(SQLHSTMT * stmt){

 int ret;
  /*Frees allocated memory*/
  ret = SQLFreeHandle(SQL_HANDLE_STMT, *stmt);
  if (!SQL_SUCCEEDED(ret)) {
      return ERR;
  }

}

The function executes normally as far as I have checked. I don't know what could be happening, if any of you could provide any possible explanation, I would be really thankful. Also feel free to ask for further information (this is the only useful info I've been taught to look for, so I might need some guidance in that case).

Thank you in advance

Answer 1

This code is dangerous:

char query[TAM];
 .
 .
 .
sprintf(query, "INSERT INTO mms_user values"
    " (default,'%s',encrypt_password('%s'),set_type(),"
    "'%s',to_date('%s', 'DD-MM-YYYY'), false)",
     mail, password, name,date);

You do absolutely no bounds checking so it will overflow your stack easily.