Why am I getting a seg fault? - c

Question

After getting a seg fault, I used the gdb a.out core command. Afterwards I used backtrace (bt) and this is what gdb tells me
warning: core file may not match specified executable file.
warning: Error reading shared library list entry at 0xfbe8
warning: Error reading shared library list entry at 0x74c085ff
Core was generated by 'family.out smith.ged'.
Program terminated with signal 11, Segmentation fault.
(poundsign)0 0x08086a6 in count_records ()
(gdb) bt
(poundsign)0 0x080486a6 in count_records()
(poundsign)1 0x08048906 in __libc_csu_init ()
(poundsign)2 0xbf85624c in ??()
(poundsign)3 0xbf856310 in ?? ()
Backtrace stopped: previous fram inner to this frame(corrupt stack?)
Could someone give me some insight as to what might have caused this seg fault? Usually gdb gives me the line number in the program, but this time it didn't.

Answer 1

What likely happen here is you've corrupted the stack. A lot of the state of the program (including all the stack frames that tell you what function you're in) resides on the stack, so once that gets overwritten, the debugger only has corrupt information to work with.
A common way to do this is to overflow a buffer declared as a local variable as a string, e.g.
int main()
{
char buf[4];
return func1(buf);
}
int func1(char* theBuf)
{
return func2(theBuf);
}
int func2(char* sameBufBackSomeplaceInTheStack)
{
sprintf(sameBufBackSomeplaceInTheStack, "The stack is doomed.");
return 0;
}
Results may vary, but my destroyed stack looks like this in the debugger after I do this:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100000d00 in _mh_execute_header ()
(gdb) where
#0 0x0000000100000d00 in _mh_execute_header ()
#1 0x0000000000000000 in ?? ()
(gdb)
Anyway, somewhere someplace your program has overwritten the stack, which is often challenging to debug...