help, please

Hi,

l'm getting an error when running the code below.
the error seem to be in the Bold line ("while..").

Code:

userIPF = (char *)malloc(NAME_MAX_LENGTH * sizeof(char));
    if (userIPF == NULL)
    {
        fprintf(stderr, "Error: Memory allocation error\n");
        if (crypt_func != NULL)
            free(crypt_func);
        if (crypt_func_str != NULL)
            free(crypt_func_str);
        fclose(ipf);
            return -1;
    }
 
    passwordIPF = (char *)malloc(PASSWORD_MAX_LENGTH * sizeof(char));
    if (passwordIPF == NULL)
    {
        fprintf(stderr, "Error: Memory allocation error\n");
        if (crypt_func != NULL)
            free(crypt_func);
        if (crypt_func_str != NULL)
            free(crypt_func_str);
        if (userIPF != NULL)
            free(userIPF);
        fclose(ipf);
            return -1;
    }

[B]while (fscanf(ipf,"%s\t%s", userIPF, passwordIPF) == 2)[/B]
            {               
 
                        if ((strcmp(userIPF,user)==0) && (strcmp(passwordIPF, crypt_func_str)==0))
                {
                    found = 1;
                    break;
                }
                   
                if (userIPF != NULL)
                    free(userIPF);
                if (passwordIPF != NULL)
                    free(passwordIPF);

                userIPF = (char *)malloc(NAME_MAX_LENGTH * sizeof(char));
                if (userIPF == NULL)
                {
                    fprintf(stderr, "Error: Memory allocation error\n");
                    if (crypt_func != NULL)
                        free(crypt_func);
                    if (crypt_func_str != NULL)
                        free(crypt_func_str);
                    fclose(ipf);
                        return -1;
                }
                passwordIPF = (char *)malloc(PASSWORD_MAX_LENGTH * sizeof(char));
                if (passwordIPF == NULL)
                {
                    fprintf(stderr, "Error: Memory allocation error\n");
                    if (crypt_func != NULL)
                        free(crypt_func);
                    if (crypt_func_str != NULL)
                        free(crypt_func_str);
                    if (userIPF != NULL)
                        free(userIPF);
                    fclose(ipf);
                        return -1;
                }
 
            } 

this is what Valgrind is giving me:

Code:

==28689== Invalid write of size 1
==28689==    at 0x510831F: _IO_vfscanf (in /lib/libc-2.9.so)
==28689==    by 0x51163E7: fscanf (in /lib/libc-2.9.so)
==28689==    by 0x40110B: main (authenticate.c:117)
==28689==  Address 0x5423464 is 0 bytes after a block of size 20 alloc'd
==28689==    at 0x4C278AE: malloc (vg_replace_malloc.c:207)
==28689==    by 0x400DCA: main (authenticate.c:81)
==28689==
==28689== Invalid write of size 1
==28689==    at 0x510BB91: _IO_vfscanf (in /lib/libc-2.9.so)
==28689==    by 0x51163E7: fscanf (in /lib/libc-2.9.so)
==28689==    by 0x40110B: main (authenticate.c:117)
==28689==  Address 0x5423470 is 12 bytes after a block of size 20 alloc'd
==28689==    at 0x4C278AE: malloc (vg_replace_malloc.c:207)
==28689==    by 0x400DCA: main (authenticate.c:81)
==28689==
==28689== Invalid read of size 1
==28689==    at 0x4C2832A: strcmp (mc_replace_strmem.c:337)
==28689==    by 0x400F98: main (authenticate.c:120)
==28689==  Address 0x5423464 is 0 bytes after a block of size 20 alloc'd
==28689==    at 0x4C278AE: malloc (vg_replace_malloc.c:207)
==28689==    by 0x400DCA: main (authenticate.c:81) 

i don't understand why there's an error. Can someone please help me?

thank you.
(and sorry for my english)