gcc - Invalid address in C - Stack Overflow

admin管理员组

文章数量:1435859

I ran a program like this

#include <unistd.h>
#include <stdio.h>

(*$$)() = 0x7ffff7e9a870;
$(){
    $$(1, "Hello, World!\n", 14);
}

0x7ffff7e9a870 comes from another program or I performed:

#include <unistd.h>
#include <stdio.h>

int main(void)
{
    printf("%p\n", write);
    printf("%p\n", &write);
}

With aslr disabled (so I have /proc/sys/kernel/randomize_va_space = 0)

if I compile my program with

$ gcc -B/usr/bin -Wl,--entry=$ -nostartfiles -w -O3 -g3 -o bin notmain.c

All he's ok but if I launch it:

$ ./bin 
Segmentation fault (core dumped)

And if I run my program with gdb I have this weird output:

pwndbg> b * '$'
Breakpoint 1 at 0x1000: file notmain.c, line 5.
pwndbg> r
Starting program: /mnt/c/Users/bin 

Program received signal SIGSEGV, Segmentation fault.
0x000055792b67be33 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
───────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────
 RAX  0x1c
 RBX  0
 RCX  0x7fffffffdd48 —▸ 0x7fffffffdff4 ◂— 'SHELL=/bin/bash'
 RDX  0x7ffff7fc9040 ◂— endbr64
 RDI  0x7ffff7ffe2e0 —▸ 0x555555554000 ◂— 0x10102464c457f
 RSI  0x7ffff7ffe888 ◂— 0
 R8   0
 R9   0
 R10  0x555555554000 ◂— 0x10102464c457f
 R11  0
 R12  0x55792b67be33
 R13  0x7fffffffdd30 ◂— 1
 R14  0
 R15  0
 RBP  0
 RSP  0x7fffffffdd30 ◂— 1
 RIP  0x55792b67be33
────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────
Invalid address 0x55792b67be33










─────────────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────────────
00:0000│ r13 rsp 0x7fffffffdd30 ◂— 1
01:0008│         0x7fffffffdd38 —▸ 0x7fffffffdfae ◂— '/mnt/c/Users/bin'
02:0010│         0x7fffffffdd40 ◂— 0
03:0018│ rcx     0x7fffffffdd48 —▸ 0x7fffffffdff4 ◂— 'SHELL=/bin/bash'
04:0020│         0x7fffffffdd50 —▸ 0x7fffffffe004 ◂— 'WSL2_GUI_APPS_ENABLED=1'
05:0028│         0x7fffffffdd58 —▸ 0x7fffffffe01c ◂— 'WSL_DISTRO_NAME=Ubuntu-22.04'
06:0030│         0x7fffffffdd60 —▸ 0x7fffffffe039 ◂— 'NAME=DESKTOP-PH516IR'
07:0038│         0x7fffffffdd68 —▸ 0x7fffffffe04e ◂— 'PWD=/mnt/c/Users/'
───────────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────────────
 ► 0   0x55792b67be33 None
   1              0x1 None
   2   0x7fffffffdfae None
   3              0x0 None
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

The same problem comes when I do a program just right this:

#include <unistd.h>
#include <stdio.h>

(*$$)();
$(){
    printf("Hello World\n");
    printf("%p\n", write);
}

$ gcc -B/usr/bin -Wl,--entry=$ -nostartfiles -w -O3 -g3 -o b
in notmain.c
$ valgrind ./bin
==5537== Memcheck, a memory error detector
==5537== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==5537== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==5537== Command: ./bin
==5537==
Hello World
==5537== 
==5537== Process terminating with default action of signal 11 (SIGSEGV)
==5537==  General Protection Fault
==5537==    at 0x48DC0D0: __vfprintf_internal (vfprintf-internal.c:1244)
==5537==    by 0x499BC4A: __printf_chk (printf_chk.c:33)
==5537==
==5537== HEAP SUMMARY:
==5537==     in use at exit: 1,024 bytes in 1 blocks
==5537==   total heap usage: 1 allocs, 0 frees, 1,024 bytes allocated
==5537==
==5537== LEAK SUMMARY:
==5537==    definitely lost: 0 bytes in 0 blocks
==5537==    indirectly lost: 0 bytes in 0 blocks
==5537==      possibly lost: 0 bytes in 0 blocks
==5537==    still reachable: 1,024 bytes in 1 blocks
==5537==         suppressed: 0 bytes in 0 blocks
==5537== Rerun with --leak-check=full to see details of leaked memory
==5537==
==5537== For lists of detected and suppressed errors, rerun with: -s
==5537== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Segmentation fault (core dumped)

The first one is executed but... not the second.

Can someone help me ? Thank you !

本文标签： gccInvalid address in CStack Overflow