vulnerabilities using queues

Examine the queue management routines below. It handles any number
of queues, and returns a pointer to the queue that is created.
The header file - queueHeader.c - and queue manager - queeManager.c -
are below.

Write a main driver, queueMain.c and exercise these functions to get a
feel for it.

Analyze the code given and explain clearly any four vulnerabilities, each
description of about 5 -6 sentences - each vulnerability has to be a
very specific problem, not something general like buffer overflow etc.

For any ONE vulnerability, describe how you may fix it - NO need to write
actual (fix) code though.

For any ONE vulnerability, write an exploit, mainExploit.c --
exploit code should be readable and well-documented, else you get 0.

/**
         queueHeader.h header file
*/

/*
 * the queue structure
 */
typedef struct queue {
        int *que;               /* the actual array of queue elements */
        int head;               /* head index in que of the queue */
        int count;              /* number of elements in queue */
        int size;               /* max number of elements in queue */
} QUEUE;

/*
 * the library functions
 */
void queueManage(QUEUE **, int, int);   /* create or delete a queue */
void addToQueue(QUEUE *, int);  /* add to queue */
void removeFromQueue(QUEUE *, int *);   /* remove from queue */


/**
         queueManager.c source
*/

#include <stdlib.h>
#include "queueHeader.h"

/*
 * create or delete a queue
 *
 * PARAMETERS:  QUEUE **qptr    space for, or pointer to, queue
 *              int flag        1 for create, 0 for delete
 *              int size        max elements in queue
 */
void queueManage(QUEUE **qptr, int flag, int size)
{
        if (flag){
                /* allocate a new queue */
                *qptr = malloc(sizeof(QUEUE));
                (*qptr)->head = (*qptr)->count = 0;
                (*qptr)->que = malloc(size * sizeof(int));
                (*qptr)->size = size;
        }
        else{
                /* delete the current queue */
                (void) free((*qptr)->que);
                (void) free(*qptr);
        }
}

/*
 * add an element to an existing queue
 *
 * PARAMETERS:  QUEUE *qptr     pointer for queue involved
 *              int n           element to be appended
 */
void addToQueue(QUEUE *qptr, int n)
{
        /* add new element to tail of queue */
        qptr->que[(qptr->head + qptr->count) % qptr->size] = n;
        qptr->count++;

}

/*
 * take an element off the front of an existing queue
 *
 * PARAMETERS:  QUEUE *qptr     pointer for queue involved
 *              int *n          storage for the return element
 */
void removeFromQueue(QUEUE *qptr, int *n)
{
        /* return the element at the head of the queue */
        *n = qptr->que[qptr->head++];
        qptr->count--;
        qptr->head %= qptr->size;
}

Can someone please help me REAL quick? I'm having trouble with some of my syntax right now creating this queueMain.c. Once I get this working I will be able to completely finish this assignment and be able to turn it in.


#include <stdio.h>
#include "queueHeader.c"

int main (int argc, const char * argv[])
{

        QUEUE theQ;
        QUEUE *ptr1 = &theQ;
        QUEUE **ptr2 = &ptr1;

        //creating the queue
        queueManage(&ptr1, 1, 2);
        printf("QUEUE of size 2 created");


        // adding  value to queue
        addToQueue(&theQ, 5);
        printf("Value 5 has been added to the QUEUE");


        // adding another value to queue
        addToQueue(&theQ, 3);
        printf("Value 3 has been added to the QUEUE");


        // Remove the front value from queue
        int head = ptr1->head;
        removeFromQueue(&theQ, &head);
        printf("The front value has been removed from the QUEUE");


        //delete the que
        queueManage(&ptr1, 0, 2);
        printf("QUEUE has been destroyed");

        return 0;
}
Is my code, but for some reason it is giving me an "Arithmetic Exception". What have I done wrong? Right now it is supposed to run queueManage and create a queue called "theQ" with a size of 2. It's then supposed to insert two values into the queue, filling it. Then it is to remove the head value and then run queueManage again to destroy the queue, but for some reason I can't seem to figure out where it is going wrong.