I can print the memory using the gdb x command, but if I use printf, the segmentation error

Question

This line calls segfault for me:

30 printf("st_name:\t%s\n", &p_str_tab[p->st_name]); 

I tried to trace it in gdb:

 (gdb) p p_str_tab[p->st_name] $11 = 0 '\000' (gdb) p &p_str_tab[p->st_name] $12 = 0x2aaaaaab0000 "" (gdb) x/16s 0x2aaaaaab0000 0x2aaaaaab0000: "" 0x2aaaaaab0001: ".symtab" 0x2aaaaaab0009: ".strtab" (gdb) call printf("st_name:\t%s\n", 0x2aaaaaab0000) Program received signal SIGSEGV, Segmentation fault. 0x00000034f4042729 in vfprintf () from /lib64/libc.so.6 The program being debugged was signaled while in a function called from GDB. GDB remains in the frame where the signal was received. To change this behavior use "set unwindonsignal on". Evaluation of the expression containing the function 

I can print the memory using the gdb x command, but if I use printf, the segmentation error.

Why?

UPDATE as required in the comment:

 (gdb) x/1i $rip 0x34f4042729 <vfprintf+57>: mov 0xc0(%rdi),%eax (gdb) info reg rax 0x54 84 rbx 0x34f3e1bbc0 227429956544 rcx 0x0 0 rdx 0xffffffffffffffb0 -80 rsi 0x401b08 4201224 rdi 0x600908 6293768 rbp 0x7fffffffe6e0 0x7fffffffe6e0 rsp 0x7fffffffe040 0x7fffffffe040 r8 0x2aaaaaabf210 46912496202256 r9 0x34f4351780 227435419520 r10 0x1238 4664 r11 0x648 1608 r12 0x0 0 r13 0x7fffffffe9c0 140737488349632 r14 0x0 0 r15 0x0 0 rip 0x34f4042729 0x34f4042729 <vfprintf+57> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 fctrl 0x37f 895 fstat 0x0 0 ftag 0xffff 65535 ---Type <return> to continue, or q <return> to quit--- fiseg 0x0 0 fioff 0x0 0 foseg 0x0 0 fooff 0x0 0 fop 0x0 0 mxcsr 0x1f80 [ IM DM ZM OM UM PM ] 

Answer 1

The pointer problem must be overloaded, try valgrind.

Answer 2

You might want to check if the stack overflows.

Answer 3

Fault instruction mov 0xc0(%rdi),%eax represents something like eax = rdi->member , where member is at offset 0xc0. Seeing no more disassembly, it’s hard to understand what it is for sure, but it seems likely that it is stdout or something inside stdout . It is not true that the fault command dereferences your input string.

Have you done anything unusual for stdout ? A brute force approach would be to sprinkle printf everywhere (which probably doesn't matter) and see where it starts to crash. Just before something went bad.