[solved] sprintf() Guru Meditation Error (maximum Task Size?)

[waterfox]

Hello Together,

I have some problems while building a Webserver on the ESP32.
I think that it is a problem with the task stack size for exporting my configuration to the webserver with the sprintf() function.

I get the following Error:

Code: Select all

<Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x400014dc  PS      : 0x00060730  A0      : 0x80164948  A1      : 0x3ffccdd0
A2      : 0x000022b3  A3      : 0x000022af  A4      : 0x000000ff  A5      : 0x0000ff00
A6      : 0x00ff0000  A7      : 0xff000000  A8      : 0x00000000  A9      : 0x3ffdcf71
A10     : 0x3ffdcf70  A11     : 0x3ffccf70  A12     : 0x00000001  A13     : 0x00060023
A14     : 0x00000001  A15     : 0x00000001  SAR     : 0x00000004  EXCCAUSE: 0x0000001c
EXCVADDR: 0x000022b3  LBEG    : 0x400014fd  LEND    : 0x4000150d  LCOUNT  : 0xfffffff9

Backtrace:0x400014d9:0x3ffccdd0 0x40164945:0x3ffccde0 0x40161a1d:0x3ffcd0f0 0x400d6daf:0x3ffcd1b0 0x400d808a:0x3ffcd370                                      0x40111ddb:0x3ffcd3b0 0x40110bf2:0x3ffcd3f0 0x40110c89:0x3ffcd480 0x401112c6:0x3ffcd4a0 0x4010f1b5:0x3ffcd4c0 0x4010f28b                                     :0x3ffcd500 0x40087f89:0x3ffcd520
0x40164945: _svfprintf_r at /builds/idf/crosstool-NG/.build/HOST-i686-w64-mingw32/xtensa-esp32-elf/src/newlib/newlib/lib                                     c/stdio/vfprintf.c:1528

0x40161a1d: sprintf at /builds/idf/crosstool-NG/.build/HOST-i686-w64-mingw32/xtensa-esp32-elf/src/newlib/newlib/libc/std                                     io/sprintf.c:618

0x400d6daf: export_aio_conf at c:\git\iotdevelopment\software\software.c\build/../components/AIO/src/AIO_Conf.c:106

0x400d808a: server_handler_get at c:\git\iotdevelopment\software\software.c\build/../components/AIO/src/AIO_Netw.c:135 (                                     discriminator 6)

0x40111ddb: httpd_uri at C:/git/esp-idf/components/esp_http_server/src/httpd_uri.c:332

0x40110bf2: httpd_parse_req at C:/git/esp-idf/components/esp_http_server/src/httpd_parse.c:667 (discriminator 6)

0x40110c89: httpd_req_new at C:/git/esp-idf/components/esp_http_server/src/httpd_parse.c:788

0x401112c6: httpd_sess_process at C:/git/esp-idf/components/esp_http_server/src/httpd_sess.c:304 (discriminator 6)

0x4010f1b5: httpd_server at C:/git/esp-idf/components/esp_http_server/src/httpd_main.c:197 (discriminator 6)

0x4010f28b: httpd_thread at C:/git/esp-idf/components/esp_http_server/src/httpd_main.c:227

0x40087f89: vPortTaskWrapper at C:/git/esp-idf/components/freertos/xtensa/port.c:143

I think it is an overflow with the sprintf() command. In my code it looks like this:

Code: Select all

char* HTML = (char*)malloc(8500);
	if (HTML != NULL)
	{
		ESP_LOGD(TAG,"Fill HTML file");
		export_aio_conf(conf, HTML, html_request);
	}
	ESP_LOGD(TAG,"Send Response");
	httpd_resp_send(req, (const char*)HTML, strlen(HTML));
	free(HTML);

And the sprintf function is here (The list is shortened).

Code: Select all

esp_err_t export_aio_conf(aio_conf_t* conf, char* str, const char* reg_str)
{
	ESP_LOGD(TAG, "starting to Export config");
	printf("string:\n %s ", reg_str);

	int ret = sprintf(str, reg_str,
		(conf->wifi_ap_ssid[0] != '\0') ? (conf->wifi_ap_ssid) : "\0",
		(conf->wifi_ap_pass[0] != '\0') ? (conf->wifi_ap_pass) : "\0",
		(conf->wifi_sta_ssid[0] != '\0') ? (conf->wifi_sta_ssid) : "\0",
		(conf->wifi_sta_pass[0] != '\0') ? (conf->wifi_sta_pass) : "\0",
		(conf->mqtt_encrypt == 0) ? "selected" : "\0");

	ESP_LOGD(TAG, "ret = %d", ret);
	if (ret < 0)
		return ESP_ERR_NOT_FOUND;
	return ESP_OK;
}

This problem does not happen if the html file is a little bit smaller.
Where can I enlarge the sprintf size?

[nvannote]

I think it is an overflow with the sprintf() command. In my code it looks like this:

Code: Select all

char* HTML = (char*)malloc(8500);
	if (HTML != NULL)
	{
		ESP_LOGD(TAG,"Fill HTML file");
		export_aio_conf(conf, HTML, html_request);
	}
	ESP_LOGD(TAG,"Send Response");
	httpd_resp_send(req, (const char*)HTML, strlen(HTML));
	free(HTML);

And the sprintf function is here (The list is shortened).

Code: Select all

esp_err_t export_aio_conf(aio_conf_t* conf, char* str, const char* reg_str)
{
	ESP_LOGD(TAG, "starting to Export config");
	printf("string:\n %s ", reg_str);

	int ret = sprintf(str, reg_str,
		(conf->wifi_ap_ssid[0] != '\0') ? (conf->wifi_ap_ssid) : "\0",
		(conf->wifi_ap_pass[0] != '\0') ? (conf->wifi_ap_pass) : "\0",
		(conf->wifi_sta_ssid[0] != '\0') ? (conf->wifi_sta_ssid) : "\0",
		(conf->wifi_sta_pass[0] != '\0') ? (conf->wifi_sta_pass) : "\0",
		(conf->mqtt_encrypt == 0) ? "selected" : "\0");

	ESP_LOGD(TAG, "ret = %d", ret);
	if (ret < 0)
		return ESP_ERR_NOT_FOUND;
	return ESP_OK;
}

This problem does not happen if the html file is a little bit smaller.
Where can I enlarge the sprintf size?

The first suspect is that you're passing reg_str as the "format string" to sprintf, which in the calling code is the variable "html_request". What are the contents of "html_request" and where did it come from? sprintf/snprintf do not just concatenate variables together as a string; It uses the format string as a control mechinism. I may also suggest the use of snprintf over sprintf so it won't exceed the bounds of the destination buffer "by accident".

Regards

[waterfox]

Thanks for your response.
I've tried snprintf() but it changed nothing.

html request is defined as static const char.
It is html code wich I minified to put it into one line of code and then put to a Text -> C/C++ string converter to have a C string wich I use vor the variable.

Here is a peace of the html for example (this one is not minified)

Code: Select all

"        \t<fieldset>\n"
"                <legend>WiFi:</legend>\n"
"                \n"
"                <fieldset class=\"ext\">\n"
"                \t<legend>Access Point:</legend>\n"
"                \tSSID:<br>\n"
"                \t<input type=\"text\" name=\"ssid_ap\" value=\"%s\"><br>\n"
"                \tPASS:<br>\n"
"                \t<input type=\"text\" name=\"pass_ap\" value=\"%s\">\n"
"            \t</fieldset>\n"
"                <fieldset class=\"ext\">\n"
"                    <legend>Connect to Station:</legend>\n"
"                    SSID:<br>\n"
"                    <input type=\"text\" name=\"ssid_sta\" value=\"%s\"><br>\n"
"                    PASS:<br>\n"
"                    <input type=\"text\" name=\"pass_sta\" value=\"%s\">\n"
"                </fieldset>\n"
"\t\t\t</fieldset>"

so the sprintf() function is used to put all the variables into the text boxes of my html file.

[chegewara]

Code: Select all

char* HTML = (char*)malloc(8500);
	if (HTML != NULL)
	{
		ESP_LOGD(TAG,"Fill HTML file");
		export_aio_conf(conf, HTML, html_request);
	
	    ESP_LOGD(TAG,"Send Response");
	    httpd_resp_send(req, (const char*)HTML, strlen(HTML));
	    free(HTML);
	}

[waterfox]

Code: Select all

char* HTML = (char*)malloc(8500);
	if (HTML != NULL)
	{
		ESP_LOGD(TAG,"Fill HTML file");
		export_aio_conf(conf, HTML, html_request);
	
	    ESP_LOGD(TAG,"Send Response");
	    httpd_resp_send(req, (const char*)HTML, strlen(HTML));
	    free(HTML);
	}

Thank you for your correction of the code. Unfortunately, I still have the Guru Meditation Error.
Following my error messages it seems like it fails during the sprintf() function.

[nvannote]

Thanks for your response.
I've tried snprintf() but it changed nothing.

html request is defined as static const char.
It is html code wich I minified to put it into one line of code and then put to a Text -> C/C++ string converter to have a C string wich I use vor the variable.

Here is a peace of the html for example (this one is not minified)

Regarding the format string fragment you posted. I see 4 format specifiers and 5 arguments passed to sprintf. That in itself isn't a "huge" problem. But are there "more" format specifiers in this string than available arguments? sprintf doesn't know how many arguments were passed and will continue to try and reach out to the stack while it encounters them in the format string.

Regards

[waterfox]

Thanks for your response.
I've tried snprintf() but it changed nothing.

html request is defined as static const char.
It is html code wich I minified to put it into one line of code and then put to a Text -> C/C++ string converter to have a C string wich I use vor the variable.

Here is a peace of the html for example (this one is not minified)

Regarding the format string fragment you posted. I see 4 format specifiers and 5 arguments passed to sprintf. That in itself isn't a "huge" problem. But are there "more" format specifiers in this string than available arguments? sprintf doesn't know how many arguments were passed and will continue to try and reach out to the stack while it encounters them in the format string.

Regards

I have for each format specifier one argument into the sprintf() fucntion. This was only a mistake in my example.

like you said it's not a problem if there are more or less arguments if my html string is shorter than approximately 6500 bytes.

[nvannote]

I have for each format specifier one argument into the sprintf() fucntion. This was only a mistake in my example.

like you said it's not a problem if there are more or less arguments if my html string is shorter than approximately 6500 bytes.

If there are more format specifiers in this format string than available variable arguments, yes that is a problem and will lead to the LoadProhibited panic you are experiencing.

I am asking, because you only posted a fragment of what looks to be a much larger format string.

Also, You wan't ensure that your structure was fully zero'ed properly. There no guarantee that the wifi_ap_ssid[0] and whatnot have a zero at index 0 if it was left uninitialized; and again, could lead to the same access violation depending what comes after it in memory.

If you wan't to completely rule out a stack constraint issue (unrelated to the use of malloc); you can increase it on your xTaskCreate create call.

Regards

[waterfox]

I have for each format specifier one argument into the sprintf() fucntion. This was only a mistake in my example.

like you said it's not a problem if there are more or less arguments if my html string is shorter than approximately 6500 bytes.

If there are more format specifiers in this format string than available variable arguments, yes that is a problem and will lead to the LoadProhibited panic you are experiencing.

I am asking, because you only posted a fragment of what looks to be a much larger format string.

Also, You wan't ensure that your structure was fully zero'ed properly. There no guarantee that the wifi_ap_ssid[0] and whatnot have a zero at index 0 if it was left uninitialized; and again, could lead to the same access violation depending what comes after it in memory.

If you wan't to completely rule out a stack constraint issue (unrelated to the use of malloc); you can increase it on your xTaskCreate create call.

Regards

Oh jesus

Thank you for pointing me twice on my mistake. I have configured my variables at the end all like int variables. But there where also option boxes.

Many thanks to all of you for the help

Regards

[nvannote]

Oh jesus

No worries, It happens. Glad you got it worked out.

Best Regards