Smashed Stack when iterating over int pointers

Question

I'm fairly new to C, and I'm trying to write a utility to open all event handlers which handle EV_KEY events, and give me a list of their file descriptors (while they're still open). The function which does all of that appears to be functioning properly, when when I try to loop over the file descriptors, I'm getting a smashed stack error. I tried compiling each C file with gcc's -Wall flag to find what might be causing the problem, but it hasn't helped me. Here's my code:

int *get_key_handlers() {

    int *fds;
    int fd;
    int num_handlers = 0;
    struct dirent *dp;
    DIR *dir;
    char full_path[100];
    char *base_path = "/dev/input/";

    printf("Creating file descriptor array\n");
    fds = malloc(sizeof(int*)*32);   // not currently going to bother
                                     //   with more than 32 handlers

    printf("Opening event handler directory\n");
    if (!(dir = opendir(base_path))) {
        return 1;
    }

    printf("Beginning reading through directory\n");
    while ((dp = readdir(dir))) {

        if (dp->d_name && !strncmp(dp->d_name, "event", 5)) {

            // cat the base path and device name, store in full_path
            snprintf(full_path, sizeof(full_path), "%s%s", base_path, dp->d_name);
            printf("Found handler at %s\n", full_path);
            fd = open(full_path, O_RDONLY);

            printf("Detecting handler features...\n");
            unsigned char results[EV_MAX/8+1];
            memset(results, 0, sizeof(results));
            ioctl(fd, EVIOCGBIT(EV_KEY, EV_MAX), results); 
            printf("Features determined\n");
            printf("EV_KEY: %d\n", EV_KEY);
            if (test_bit(*results, EV_KEY)) {
                printf("EV_KEY feature detected on %s\n", full_path);
                fds[num_handlers] = fd;
                num_handlers++;
            } else {
                printf("EV_KEY feature NOT detected on %s\n", full_path);
                close(fd);
            }
            printf("Done with handler at %s\n", full_path);
        }
    }
    printf("Finished creating handler list\n");

    fds = realloc(fds, sizeof(int*) * num_handlers);
    printf("Handler list re-sized\n");
    return fds;
}

Here is the code that calls the get_key_handlers() function:

int main() {
    int *fds = get_key_handlers();
    int i = 0;
    for (i = 0; i < (sizeof(fds)/sizeof(int*)); i++) {
        printf("Next file descriptor: %d\n", *(fds + (i * sizeof(int*))));
    }

    free(fds);
    return 0;
}

Last of all, here are the commands I'm running to compile and link, along with runtime output of the program:

tim@tim-ubuntu:~/Documents/Programming/C/clogger$ gcc -c -Wall thinput.c
thinput.c: In function ‘get_key_handlers’:
thinput.c:21:9: warning: return makes pointer from integer without a cast [enabled by default]
tim@tim-ubuntu:~/Documents/Programming/C/clogger$ gcc -c -Wall thinputtest.c
tim@tim-ubuntu:~/Documents/Programming/C/clogger$ gcc thinput.o thinputtest.o -o thinputtest
tim@tim-ubuntu:~/Documents/Programming/C/clogger$ sudo ./thinputtest
Creating file descriptor array
Opening event handler directory
Beginning reading through directory
Found handler at /dev/input/event15
Detecting handler features...
Features determined
EV_KEY: 1
EV_KEY feature NOT detected on /dev/input/event15
Done with handler at /dev/input/event15
Found handler at /dev/input/event14
Detecting handler features...
Features determined
EV_KEY: 1
EV_KEY feature detected on /dev/input/event3
Done with handler at /dev/input/event3
Found handler at /dev/input/event2
Detecting handler features...
Features determined
EV_KEY: 1
EV_KEY feature NOT detected on /dev/input/event1
Done with handler at /dev/input/event1
Found handler at /dev/input/event0
Detecting handler features...
Features determined
EV_KEY: 1
EV_KEY feature NOT detected on /dev/input/event0
Done with handler at /dev/input/event0
Finished creating handler list
Handler list re-sized
*** stack smashing detected ***: ./thinputtest terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f0ef8658807]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x0)[0x7f0ef86587d0]
./thinputtest[0x400ac7]
======= Memory map: ========
00400000-00401000 r-xp 00000000 08:02 7215828                            /home/tim/Documents/Programming/C/clogger/thinputtest
00601000-00602000 r--p 00001000 08:02 7215828                            /home/tim/Documents/Programming/C/clogger/thinputtest
00602000-00603000 rw-p 00002000 08:02 7215828                            /home/tim/Documents/Programming/C/clogger/thinputtest
01b88000-01ba9000 rw-p 00000000 00:00 0                                  [heap]
7f0ef8338000-7f0ef834d000 r-xp 00000000 08:02 5247337                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0ef834d000-7f0ef854c000 ---p 00015000 08:02 5247337                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0ef854c000-7f0ef854d000 r--p 00014000 08:02 5247337                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0ef854d000-7f0ef854e000 rw-p 00015000 08:02 5247337                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0ef854e000-7f0ef8703000 r-xp 00000000 08:02 5247958                    /lib/x86_64-linux-gnu/libc-2.15.so
7f0ef8703000-7f0ef8902000 ---p 001b5000 08:02 5247958                    /lib/x86_64-linux-gnu/libc-2.15.so
7f0ef8902000-7f0ef8906000 r--p 001b4000 08:02 5247958                    /lib/x86_64-linux-gnu/libc-2.15.so
7f0ef8906000-7f0ef8908000 rw-p 001b8000 08:02 5247958                    /lib/x86_64-linux-gnu/libc-2.15.so
7f0ef8908000-7f0ef890d000 rw-p 00000000 00:00 0 
7f0ef890d000-7f0ef892f000 r-xp 00000000 08:02 5255999                    /lib/x86_64-linux-gnu/ld-2.15.so
7f0ef8b08000-7f0ef8b0b000 rw-p 00000000 00:00 0 
7f0ef8b2b000-7f0ef8b2f000 rw-p 00000000 00:00 0 
7f0ef8b2f000-7f0ef8b30000 r--p 00022000 08:02 5255999                    /lib/x86_64-linux-gnu/ld-2.15.so
7f0ef8b30000-7f0ef8b32000 rw-p 00023000 08:02 5255999                    /lib/x86_64-linux-gnu/ld-2.15.so
7fffbd9b4000-7fffbd9d5000 rw-p 00000000 00:00 0                          [stack]
7fffbd9ff000-7fffbda00000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Thank you very much in advance for any time you spend helping me figure this out; I appreciate any advice or critiques sent my way!

Answer 1

The ioctl has the wrong size:

ioctl(fd, EVIOCGBIT(EV_KEY, EV_MAX), results);

change that line to:

ioctl(fd, EVIOCGBIT(EV_KEY, sizeof(results)), results);

You are indirectly writing outside results’ bounds by telling EVIOCGBIT that it has EV_MAX bytes to fill while it only has EV_MAX÷8, thus your stack is trashed. Due to the way stack smashing detection works it can only be detected once you return.

To get you convinced, have a look at the comment in drivers/input/evdev.c, it says:

/*
 * Work around bugs in userspace programs that like to do
 * EVIOCGBIT(EV_KEY, KEY_MAX) and not realize that 'len'
 * should be in bytes, not in bits.
 */