Run-Time Check Failure #2 - Stack around the variable 'ucValue' was corrupted.

After reading from the file we are facing the issue, at the end of the loop,
Run-Time Check Failure #2 - Stack around the variable 'ucValue' was corrupted.

the file UserConfig.ini contains,

Time1 1000
Time2 1000
Time3 500
Time4 500
AboveLevel 2700
BelowLevel 2700
ModeCode1 1234
ModeCode2 5555
ModeCode3A 6666
InitialAltitude 5000
TCASBUSSPEED 1
TRANSBUSSPEED 1
SMCODE 0
ReplyMode1 1
ReplyMode2 0
ReplyMode3A 1
ReplyModeC 0
ReplyModeS 0
ReplyModeSM 0
DiscNUM 0
TransOPMODE 1
TCASOPMODE 1
TCASRng 20
AIRID
REQ123R5
AIRREG
REQ123R
GUISELECT 0

we are reading the string value Time1 separately
fscanf_s(fpCPDSReadConfig, "%s ", arrRecord, 6/*,&m_uiTime1*/);

and time value 1000 separately
fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

Can anyone suggest what is the exact issue.

Code:

int CUserConfig::ReadUserConfig()

{

FILE *fpCPDSReadConfig;

//char arrRecord[50] = {0};

char arrRecord[24];



errno_t err;

unsigned int uiValue = 0;

BOOL bValue = 0;

unsigned char ucValue = '0';

char carrValue[9];

char carrValue1[8];



        memset((void*)arrRecord, 0, sizeof(arrRecord));

        memset((void*)carrValue, 0, sizeof(carrValue));

        memset((void*)carrValue1, 0, sizeof(carrValue1));



        err = fopen_s(&fpCPDSReadConfig, "UserConfig.ini", "r+");

        if (err != 0)

        {

                return -1;

        }

        else

        {

                fscanf_s(fpCPDSReadConfig, "%s ", arrRecord, 6/*,&m_uiTime1*/);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiTime1 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s ", arrRecord, 6/*,&m_uiTime1*/);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiTime2 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s ", arrRecord, 6/*,&m_uiTime1*/);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiTime3 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s ", arrRecord, 6/*,&m_uiTime1*/);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiTime4 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord,11);

                fscanf_s(fpCPDSReadConfig, "%d", &m_uiTcasAbvLvl, 4);

                m_uiTcasAbvLvl = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord,11);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiTcasBlwLvl = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord,10);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiModeCode1 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 10);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiModeCode2 = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiModeCode3A = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 16);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiBaroAlt = uiValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 13);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bTcasBusSpd = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 14);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bTraBusSpd = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 12);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bSMCode = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyMode1 = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyMode2 = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 12);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyMode3A = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyModeC = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyModeS = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 12);

                fscanf_s(fpCPDSReadConfig, "%d", &bValue, 1);

                m_bRpyModeSM = bValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 8);

                fscanf_s(fpCPDSReadConfig, "%d", &ucValue, 1);

                m_ucDiscNo = ucValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 12);

                fscanf_s(fpCPDSReadConfig, "%d", &ucValue, 1);

                m_ucTraOpMode = ucValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 11);

                fscanf_s(fpCPDSReadConfig, "%d", &ucValue, 1);

                m_ucTcasOpMode = ucValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 8);

                fscanf_s(fpCPDSReadConfig, "%d", &ucValue,1);

                m_ucRng = ucValue;

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 6);

                fscanf_s(fpCPDSReadConfig, "%s", carrValue,9);

                memcpy(m_ucAirID, carrValue, 9);

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 7);

                fscanf_s(fpCPDSReadConfig, "%s", carrValue1, 8);

                memcpy(m_ucAirRegNo, carrValue1, 8);

                fscanf_s(fpCPDSReadConfig, "%s", arrRecord, 9);

                fscanf_s(fpCPDSReadConfig, "%d", &uiValue, 4);

                m_uiGuiSel = uiValue;        

        }

        fclose(fpCPDSReadConfig);

        return CPDS_SUCCESS;

}