memory overflow in irrecv.decode

[msilenius]

Version/revision of the library used

2.8.6

Describe the bug

When calling irrecv.decode(&results, NULL, 10, 0) then a variable that a has no relation with it is changed

To Reproduce

Serial.printf("--> Debug ip: %d %d %d %d \n", ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);
if (!irrecv.decode(&results, NULL, 10, 0)) return;
Serial.printf("--> Debug ip: %d %d %d %d \n", ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);

What steps did you do, and what did or didn't actually happen? How can we reproduce the issue?

global variables:

IPAddress NullIP;
byte ServerIP[] = {0, 0, 0, 0};
IPAddress BroadCastIP(255,255,255,255);
IPAddress LocalIp = NullIP;

byte MAC[6];
unsigned int localUdpPort = PORTNUMBER;
unsigned int ServerPort = PORTNUMBER;
bool ACKPending;

bool IsVest = false;

decode_results results;
IRrecv irrecv(PIN_IR_IN);
IRsend irsend(PIN_IR_OUT);


in setup
irrecv.enableIRIn();  // Start the ir receiver
irsend.begin();

in loop
ManageIRSensor();

then definition ofManageIRSensor();

//manage Ir reciever
void ManageIRSensor()
{
  //decode_results results;
  Serial.printf("--> Debug ip before: %d  %d  %d  %d  \n",  ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);
	if (!irrecv.decode(&results, NULL, 10, 0)) return;
  Serial.printf("--> Debug ip after: %d  %d  %d  %d  \n",  ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);

.......
}

result
23:05:18.075 -> --> Debug ip before: 192 168 1 155
23:05:18.075 -> --> Debug ip after: 24 0 1 155

Has this library/code previously worked as expected for you?

i didn't used this variable before so no idea.

[msilenius]

more precision I also use this:

#define IR_ENABLE_DEFAULT false
#define DECODE_MILESTAG2 true
#define DECODE_SONY true

and I am using esp8266

[msilenius]

meanwhile I moved decode_results results as a local variable. That fix it for now. but i guess it might overflow something else.

void ManageIRSensor()
{
decode_results results;
Serial.printf("--> Debug ip before: %d %d %d %d \n", ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);
if (!irrecv.decode(&results, NULL, 10, 0)) return;
Serial.printf("--> Debug ip after: %d %d %d %d \n", ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);

result
23:14:24.125 -> --> Debug ip before: 192 168 1 155
23:14:24.125 -> --> Debug ip after: 192 168 1 155

[crankyoldgit]

Um, wow. That's bad. It shouldn't do that at all.
Reviewing the code (on my phone) I can't see any mistakes.
Are you able to radically simplify your code for the purposes minimal code to reproduce the issue and make it available?

This is puzzling.

[msilenius]

i disabled everything in my loop except the

ManageIRSensor() and the yield.

same problem.

i don't really want to change the rest of the program, because with memory overflow, changing anything in variable creation order could move the bug or hide it.

I am using esp 8266 board 2.7.4

the bug doesn't seems to happen in IrRemote8266 2.5.0, 2.5.4, 2.5.6

testing other version now

of course with memory overflow quited hard to tell if it's just luck.

[msilenius]

that took a while but:

2.8.6 bug
2.7.20 bug
2.7.9 bug
2.7.5 bug
2.7.4 bug
2.7.3 bug
2.7.2 seems working
2.7.1 seems working
2.7.0 seems working

i had to to use this for the older version: if (!irrecv.decode(&results, NULL)) return;

[crankyoldgit]

Okay. so looking at the changes from 2.7.2 to 2.7.3. i.e. v2.7.2...v2.7.3
It seems 2.7.3 we added the ability to disable decoding of individual protocols. e.g. DECODE_SONY

So, to debug it further, can you try setting DECODE_SONY to false and test that, and then ditto for MILESTAG etc.
That might help narrow it down to which protocol decoder is broken.

In the meantime, I'll look at the code for both to see if I can spot something.

[crankyoldgit]

Looking over the code for both of those decoders, I can't see anything obvious. They only write to the passed results structure/variable via a pointer (i.e. &results).
So, it has to be something in how it is dealing with the results structure/variable somewhere.

As I said before, it would be really helpful for you to remove everything you can from your code, to make the smallest amount of code that still triggers the issue. If/when I have that code, that may help me pinpoint exactly what is causing it.

[crankyoldgit]

if (!irrecv.decode(&results, NULL, 10, 0)) return;

Can you please humour me, and remove the max_skip parameter from this call?
e.g. Change it to just:

  if (!irrecv.decode(&results)) return;
  # OR
  if (!irrecv.decode(&results, NULL)) return;

[msilenius]

2.7.3 with
#define IR_ENABLE_DEFAULT false
#define DECODE_MILESTAG2 false
#define DECODE_SONY false
still bugged
(and decoding still happen with a results.decode_type = 4)

if (!irrecv.decode(&results)) return;
still bugged

I purged 98% of the code this is my remaining program

[msilenius]

#define IR_ENABLE_DEFAULT false
#define DECODE_MILESTAG2 true
#define DECODE_SONY false
bug
and still decode type 4 which is supposed to ne sony weird

if i remove the parsebyte it doesn't bug

if i change the byte MAC[6]= {0,0,0,0,0,0}; to byte MAC[6]= {255,255,255,255,255,255}; it doesnt bug

if i start to change remove any other variable it doesn't bug (i guess memory overflow just happen somewhere else)

parse byte seems to work as expected.

[crankyoldgit]

Looking at your code, I'm very concerned about your parsebyte procedure.
I think you're accidentally modifying the stack. That maybe overwriting parts of the variables that IRrecv is using causing it to misbehave.

I.e. you're modifying the cstr that is passed to it. The reason it is a const is because you're not supposed to modify it. The compiler is not expecting it to be modified because you told it you wouldn't. That's not great programming form as it can lead to unexpected results.

Try copying the incoming C string to a local static array in that function. And only modify that string.

I'll continue to look at my code, to see if can spot anything.
Can you supply the code on those images as text so I can use it to make some tests?

[msilenius]

thanks for the tips,I changed the parsebyte but still bugged:

to test using a tsop 4856 I send a mile tag ir packet with an android phone which should be an arduino equivalent to

void sendMiles2Test()
{
  byte IRPacket[] = { 0x83, 0x05, 0xE8 };
  sendMilesIR(IRPacket, 3);
}

// sending a miles tag 2 packet over IR
// Args:
//  data: a pointer a an aray of byte the send over ir.
void sendMilesIR(byte* data, byte size)
{
  if (SERIAL_ON) Serial.printf("IR sending: %d %d %d \n", data[0], data[1], data[2]);
  irsend.sendGeneric(2400, 600, 1200, 600, 600, 600, 0, 3200, data, size, 56000, true, 0U, 50U);
}

the full code on the receiver (this still bug )

#define SERIAL_ON 1

#include <ESP8266WiFi.h>

#if SERIAL_ON == 1 
  #define DEBUG_LAZERGUN(fmt, ...) Serial.printf_P( (PGM_P)PSTR(fmt), ## __VA_ARGS__ )
#else
  #define DEBUG_LAZERGUN(fmt, ...)
#endif

#define PIN_DFPLAYER D0
#define PIN_LED_RED D1
#define PIN_LED_GREEN D2
#define PIN_LED_BLUE D3
#define PIN_IR_IN SD3
#define PIN_IR_OUT D5
#define PIN_LASER D7
#define PIN_TRIGGER D6
#define PIN_RELOAD D4
#define PIN_VIBRATION D8 
#define PIN_SPOTLIGHT D8
#define SD3 10

#include <WiFiUdp.h>

#define _IR_ENABLE_DEFAULT_ false
#define DECODE_MILESTAG2 true
#define DECODE_SONY false

#include <IRremoteESP8266.h>
#include <IRrecv.h>
#include <IRutils.h>
#include <IRsend.h>

#include <SoftwareSerial.h>
#include <ESP8266httpUpdate.h>

#define CURRENT_VERSION "0.0.1.9"
#define CURRENT_VERSION_BYTE  19
#define FULL_NET_DEBUG 1

WiFiUDP Udp;
IPAddress NullIP;
byte ServerIP[] = {0, 0, 0, 0};
IPAddress BroadCastIP(255,255,255,255);
IPAddress LocalIp = NullIP;

byte MAC[6]= {0,0,0,0,0,0};

decode_results results;
IRrecv irrecv(PIN_IR_IN);
IRsend irsend(PIN_IR_OUT);

void setup()
{
	if (SERIAL_ON) Serial.begin(115200);
	if (SERIAL_ON) Serial.println("Go");
	
	irrecv.enableIRIn();  // Start the ir receiver
	irsend.begin();

	parseBytes(WiFi.macAddress().c_str(), ':', MAC, 6, 16);
	pinMode(PIN_IR_IN, INPUT);
}


void parseBytes(const char* str, char sep, byte* bytes, int maxBytes, int base) 
{
  char * toto = strdup(str);
    
  for (int i = 0; i < maxBytes; i++) 
  {
    bytes[i] = strtoul(toto, NULL, base);  // Convert byte
    toto = strchr(toto, sep);               // Find next separator
    if (toto == NULL || *toto == '\0') {
      break;                            // No more separators, exit
    }
    //DEBUG_LAZERGUN("%s \n", str);
    toto++;                                // Point to next character after separator
  }
}

void loop()
{
   byte before[]  = {0,0,0,0};
  before[0] = ServerIP[0];
  before[1] = ServerIP[1];
  before[2] = ServerIP[2];
  before[3] = ServerIP[3];
  
  //decode_results results;

  if (!irrecv.decode(&results/*, NULL, 10, 0*/)) return;
  Serial.printf("--> Debug ip before: %d  %d  %d  %d  \n",  before[0],before[1],before[2],before[3]);
  Serial.printf("--> Debug ip after: %d  %d  %d  %d  \n",  ServerIP[0],ServerIP[1],ServerIP[2],ServerIP[3]);

  DEBUG_LAZERGUN("IR recieved: %d ", results.decode_type);
  
  irrecv.resume();  // Receive the next value
  
	yield();
}

board setup

result:

9:23:34.236 -> --> Debug ip before: 0 0 0 0
09:23:34.236 -> --> Debug ip after: 24 0 0 0
09:23:34.236 -> IR recieved: 4

[crankyoldgit]

char * toto = strdup(str);

FYI .. you need to free() this string before exiting the procedure, otherwise you will have a memory leak