30 N58使用at组件后内存溢出

发布于 2022-12-29 11:09:32 浏览：512 订阅该版

运行出错，如图

![1.png](https://oss-club.rt-thread.org/uploads/20221229/1da4815e42225eb8775e9614a8848428.png)

debug发现mutex的值为0

![2.png](https://oss-club.rt-thread.org/uploads/20221229/45ec947352c155a39ed4332a98e56e00.png)

1、debug发现client的地址为0x20022958,地址上的数据为0x20004bfc，此时client->lock的值为0x200280d8

![3.png](https://oss-club.rt-thread.org/uploads/20221229/8cd9827047a0ff91abd02acf7785b4d7.png.webp)

2、继续运行发现代码运行到at_resp_parse_line_args_by_kw(resp, "+CCID:", "+CCID: %s", ccid)之后，client地址0x20022958上指向的地址被修改了

![4.png](https://oss-club.rt-thread.org/uploads/20221229/f00a307a3a98a9d9b0ba176f629b5ea0.png.webp)

```c
static void n58_init_thread_entry(void *parameter)
{
#define INIT_RETRY 5
#define CPIN_RETRY 10
#define CSQ_RETRY 10
#define CREG_RETRY 60
#define CEREG_RETRY 30
#define CCID_SIZE 20

int i, retry_num = INIT_RETRY;
    char ccid[CCID_SIZE] = {0};
    char parsed_data[10] = {0};
    rt_err_t result = RT_EOK;
    at_response_t resp = RT_NULL;
    struct at_device *device = (struct at_device *)parameter;
    struct at_client *client = device->client;

resp = at_create_resp(128, 0, rt_tick_from_millisecond(300));
    if (resp == RT_NULL)
    {
        LOG_E("no memory for n58 device(%s) response structure.", device->name);
        return;
    }

while (retry_num--)
    {
        rt_memset(parsed_data, 0, sizeof(parsed_data));
        rt_thread_mdelay(1000);
        n58_power_on(device);
        rt_thread_mdelay(5000); //check the n58 hardware manual, when we use the pow_key to start n58, it takes about 20s,so we put 25s here to ensure starting n58 normally.

LOG_I("start initializing the n58 device(%s)", device->name);
        /* wait n58 startup finish */
        if (at_client_obj_wait_connect(client, N58_WAIT_CONNECT_TIME))
        {
            result = -RT_ETIMEOUT;
            goto __exit;
        }

/* disable echo */
        AT_SEND_CMD(client, resp, 0, 300, "ATE0");
        /* get module version */
        AT_SEND_CMD(client, resp, 0, 300, "ATI");
        /* show module version */
        for (i = 0; i < (int)resp->line_counts - 1; i++)
        {
            LOG_I("%s", at_resp_get_line(resp, i + 1));
        }
        /* check SIM card */
        for (i = 0; i < CPIN_RETRY; i++)
        {
            at_resp_set_info(resp, 128, 2, 5 * RT_TICK_PER_SECOND);
            if (at_obj_exec_cmd(client, resp, "AT+CCID") < 0)
            {
                LOG_E("AT+CCID ERROR! retry:%d.", i);
                rt_thread_mdelay(1000);
                continue;
            }

if (at_resp_parse_line_args_by_kw(resp, "+CCID:", "+CCID: %s", ccid))
            {
                LOG_I("n58 device(%s) SIM card detection success.", device->name);
                LOG_I("CCID: %s", ccid);
                break;
            }
            rt_thread_mdelay(1000);
        }
```

4、继续debug，进入`at_resp_parse_line_args_by_kw(resp, "+CCID:", "+CCID: %s", ccid)`中，发现代码执行完`vsscanf(resp_line_buf, resp_expr, args)`之后，client地址0x20022958指向的内容就被更改了

```c
int at_resp_parse_line_args_by_kw(at_response_t resp, const char *keyword, const char *resp_expr, ...)
{
    va_list args;
    int resp_args_num = 0;
    const char *resp_line_buf = RT_NULL;

RT_ASSERT(resp);
    RT_ASSERT(resp_expr);

if ((resp_line_buf = at_resp_get_line_by_kw(resp, keyword)) == RT_NULL)
    {
        return -1;
    }

va_start(args, resp_expr);

resp_args_num = vsscanf(resp_line_buf, resp_expr, args);

va_end(args);

return resp_args_num;
}
```
尝试把n58_init_thread_entry的线程栈改大无效，把申请resp的空间改大改小也没有效果
问题：请问这个是什么问题，该怎么解决