More precise fault info ...

[Davide Libenzi <dlibenzi@maticad.it>]

Hi guys,

I've Debian with GCC 2.95.1 and I've build glibc 2.1.2.
It seems that all programs using c++ iostream got crashed.
This is a simple prg that crashes in my configuration:


#include <iostream.h>
#include <iomanip.h>
#include <stdlib.h>


int main()
{
    cout << "\"";

    int p = 0;

    int c;
    while ((c = cin.get()) != EOF)
    {
	if (p > 0 && p % 16 == 0)
	    cout << "\"\n\"";

	cout << "\\" << oct << setw(3) << setfill('0') << c;

	p++;
    }

    cout << "\"\n";

    return 0;
}

This is the strace result :


execve("./ss", ["./ss"], [/* 26 vars */]) = 0
brk(0)                                  = 0x8058898
open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat(3, {st_mode=0, st_size=0, ...})   = 0
mmap(0, 19549, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40015000
close(3)                                = 0
open("/lib/libm.so.6", O_RDONLY)        = 3
fstat(3, {st_mode=0, st_size=0, ...})   = 0
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3"..., 4096) = 4096
mmap(0, 118552, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x4001a000
mprotect(0x40036000, 3864, PROT_NONE)   = 0
mmap(0x40036000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x1b000) = 0x40036000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
fstat(3, {st_mode=0, st_size=0, ...})   = 0
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3"..., 4096) = 4096
mmap(0, 925116, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40037000
mprotect(0x40112000, 28092, PROT_NONE)  = 0
mmap(0x40112000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xda000) = 0x40112000
mmap(0x40116000, 11708, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40116000
close(3)                                = 0
munmap(0x40015000, 19549)               = 0
personality(PER_LINUX)                  = 0
getpid()                                = 16296
brk(0)                                  = 0x8058898
brk(0x8058a38)                          = 0x8058a38
brk(0x8059000)                          = 0x8059000
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++


This is ldd result :

libm.so.6 => /lib/libm.so.6 (0x4001a000)
libc.so.6 => /lib/libc.so.6 (0x40037000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

This is gdb stack backtrace :

(gdb) bt
#0  0x400842c0 in __overflow () from /lib/libc.so.6
#1  0x40083d9e in _IO_new_file_xsputn () from /lib/libc.so.6
#2  0x804ebbe in filebuf::xsputn (this=0x8054920, s=0x8053348 "\"", n=1)
    at /home/davide/work/gcc-2.95/libio/filebuf.cc:205
#3  0x804c129 in ostream::operator<< (this=0x8054a20, s=0x8053348 "\"")
    at /home/davide/work/gcc-2.95/libio/iostream.cc:835
#4  0x804a368 in main ()
#5  0x4004f5d9 in __libc_start_main () from /lib/libc.so.6
(gdb) 


This is gdb disassemble :


Dump of assembler code for function __overflow:
0x40084298 <__overflow>:	push   %ebp
0x40084299 <__overflow+1>:	mov    %esp,%ebp
0x4008429b <__overflow+3>:	sub    $0x14,%esp
0x4008429e <__overflow+6>:	push   %ebx
0x4008429f <__overflow+7>:	call   0x40084294 <_IO_free_backup_area+84>
0x400842a4 <__overflow+12>:	add    $0x9067c,%ebx
0x400842aa <__overflow+18>:	mov    0x8(%ebp),%edx
0x400842ad <__overflow+21>:	movsbl 0x46(%edx),%eax
0x400842b1 <__overflow+25>:	mov    0xc(%ebp),%ecx
0x400842b4 <__overflow+28>:	add    $0xfffffff8,%esp
0x400842b7 <__overflow+31>:	mov    0x94(%edx,%eax,1),%eax
0x400842be <__overflow+38>:	push   %ecx
0x400842bf <__overflow+39>:	push   %edx

0x400842c0 <__overflow+40>:	mov    0xc(%eax),%eax  <<<< Here's the segfault %eax = 0

0x400842c3 <__overflow+43>:	call   *%eax
0x400842c5 <__overflow+45>:	mov    0xffffffe8(%ebp),%ebx
0x400842c8 <__overflow+48>:	mov    %ebp,%esp
0x400842ca <__overflow+50>:	pop    %ebp
0x400842cb <__overflow+51>:	ret    
0x400842cc <__overflow+52>:	mov    (%esp,1),%ebx
0x400842cf <__overflow+55>:	ret    
End of assembler dump.


Cheers,
    Davide.

--    
"Debian, the freedom in freedom."