Crash EXC_BAD_ACCESS on string with format - ios

Question

I am processing raw IP data to process a video signal (ATSC-MH). However, I am having issues with some basic issue and I'm apparently fried at the moment and need another set of eyes.
This is the function that flips. Funny part is that it was working for a while and I can't rememeber what I changes. The line that is **d is the one that is referred to in the error log. I can't do much NSLog debugging because the stream comes from an accessory(so no direct debugging pipe :().
-(NSString*)reportSMT{
//NSString* ret = #"Not implemented yet";
__autoreleasing NSMutableString* ret = [[NSMutableString alloc] initWithFormat:#"\nSMT:\n SecSynInd:%# PriInd:%#\n SecLen:%d SMTMHProVer:%d\n EnID:%d VerNum:%d\n CurNxtInd:%# SecNum:%d\n lastSec#:%d #Servs:%d\n\n",(Header.section_syntax_indicator?#"YES":#"NO"),(Header.private_indicator?#"YES":#"NO"),Header.section_length,Header.SMT_MH_protocol_version,Header.ensemble_id,Header.version_number,(Header.current_next_indicator?#"YES":#"NO"), Header.section_number,Header.last_section_number,Header.num_MH_services];
[ret appendString:[NSString stringWithFormat:#"SMT Table:\n"]];
for (int i = 0; i<Header.num_MH_services; i++) {
**[ret appendString:[NSString stringWithFormat:#"Serv(%d):\n ServID:%d MultiEnServ:%d\n ServStat:%d ServSPInd:%#\n ServShotName:%#\n ServCat:%d\n source:%# dest:%#\n #MHServComps:%d\n",i,Services[i].MH_service_id,Services[i].multi_ensemble_service,Services[i].MH_service_status,(Services[i].SP_indicator?#"YES":#"NO"),[NSString stringWithUTF8String:(char*)Services[i].short_MH_service_name],(Services[i].service_source_IP_address_flag?[Utility ParseIP:Services[i].service_source_IP_address]:#"N/A"),(Services[i].service_destination_IP_address_flag?[Utility ParseIP:Services[i].service_destination_IP_address]:#"N/A"),Services[i].num_components]];**
for (int m=0; m<Services[i].num_components; m++) {
[ret appendString:[NSString stringWithFormat:#" Comp(%d)(essential:%#):\n port#count:%d compSource:%#\n compDest:%# destPort:%d\n",m,(Services[i].components[m].essential_component_indicator?#"YES":#"NO") ,Services[i].components[m].port_num_count,(Services[i].components[m].component_source_IP_address_flag?[Utility ParseIP:Services[i].components[m].component_source_IP_address]:#"N/A"),(Services[i].components[m].component_destination_IP_address_flag?[Utility ParseIP:Services[i].components[m].component_destination_IP_address]:#"N/A"),Services[i].components[m].component_destination_UDP_port_num]];
}
}
return [ret copy];
}
Here is that Utility parseIP function. Though it didn't change anything to comment the call to it and hardcode a value there:
+(NSString*)ParseIP:(long)ip{
__autoreleasing NSString* ret = nil;
if (ip) {
unsigned char* ipPtr = (unsigned char*)&ip;
unsigned char ipc[4];
for (int i=0; i<4; i++) {
ipc[i] = *(ipPtr+i);
}
ret = [NSString stringWithFormat:#"(%d.%d.%d.%d)",ipc[3],ipc[2],ipc[1],ipc[0]];
}
return ret;
}
Here is the structure for that part of the SMT:
struct SMTChunk{
unsigned int MH_service_id;//16
unsigned char multi_ensemble_service;//2
unsigned char MH_service_status;//2
bool SP_indicator;//1
unsigned char short_MH_service_name_length;//3 /* m */
unsigned char* short_MH_service_name;//16*m
unsigned char reserved2;//2 should be 11
unsigned char MH_service_category;//6
unsigned char num_components;//5
bool IP_version_flag;//1
bool service_source_IP_address_flag;//1
bool service_destination_IP_address_flag;//1
unsigned long service_source_IP_address;//32 if (service_source_IP_address_flag)
unsigned long service_destination_IP_address;//32 if (service_destination _IP_address_flag)
struct SMTComponent* components;
unsigned char reserved4;//4 1111(f)
unsigned char num_MH_service_level_descriptors;//4
struct SMTServiceDescriptor* descriptors;
};
Like I said this was working before, so I'm pretty sure the parser that fills the data structure is fine.
Device Log(important part):
Date/Time: 2012-03-06 00:56:40.480 -0600
OS Version: iPhone OS 5.0.1 (9A405)
Report Version: 104
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000a
Crashed Thread: 0
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libobjc.A.dylib 0x300e4fb6 objc_msgSend + 10
1 Foundation 0x30dd9d14 _NSDescriptionWithLocaleFunc + 44
2 CoreFoundation 0x335d699e __CFStringAppendFormatCore + 7998
3 CoreFoundation 0x33551210 _CFStringCreateWithFormatAndArgumentsAux + 68
4 Foundation 0x30dd9c3e +[NSString stringWithFormat:] + 54
5 APT-test 0x000c9630 -[SMT reportSMT] (SMT.m:178)
6 APT-test 0x000c54bc -[VideoViewController saveTimerFun:] (VideoViewController.mm:940)
7 Foundation 0x30e79616 __NSFireTimer + 138
It feels like I've been working on this app forever so any help or pointers you can give are welcome.
Thanks in advance!

Answer 1

The printf wildcards and arguments do not appear to be balanced properly:
[NSString stringWithFormat:#"1%d 2%d 3%d 4%d 5%# 6%# 7%d 8%# 9%# A%d",
/* 1 */i,
/* 2 */Services[i].MH_service_id,
/* 3 */Services[i].multi_ensemble_service,
/* 4 */Services[i].MH_service_status,
/* 5 */(Services[i].SP_indicator?#"YES":#"NO"),
/* 6 */[NSString stringWithUTF8String:(char*)Services[i].short_MH_service_name],
/* 7 */(Services[i].service_source_IP_address_flag?[Utility ParseIP:Services[i].service_source_IP_address]:#"N/A"),
/* 8 */(Services[i].service_destination_IP_address_flag?[Utility ParseIP:Services[i].service_destination_IP_address]:#"N/A"),
/* 9 */Services[i].num_components]];
It looks like you’re trying to match the %# specifier at position 9 with Services[i].num_components, which is quite probable to result in EXC_BAD_ACCESS. You would do best to rewrite the code so that it’s more readable, this mess is only asking for trouble.