rendered paste body17:21:25 [kiki@screwb /tmp]$ cat test.c
#include <stdlib.h>
int main(){
char* bb;
bb= malloc(2048);
free(bb);
free(bb);
}
17:21:28 [kiki@screwb /tmp]$ gcc test.c -o test && ./test
*** glibc detected *** ./test: double free or corruption (top): 0x0804a008 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7ea4d21]
/lib/libc.so.6(__libc_free+0x89)[0xb7ea57f9]
./test[0x8048415]
/lib/libc.so.6(__libc_start_main+0xe6)[0xb7e57896]
./test[0x8048341]
======= Memory map: ========
08048000-08049000 r-xp 00000000 03:03 2644037 /tmp/test
08049000-0804a000 rw-p 00000000 03:03 2644037 /tmp/test
0804a000-0806b000 rw-p 0804a000 00:00 0 [heap]
b7d00000-b7d21000 rw-p b7d00000 00:00 0
b7d21000-b7e00000 ---p b7d21000 00:00 0
b7e38000-b7e40000 r-xp 00000000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1
b7e40000-b7e41000 rw-p 00007000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1
b7e41000-b7e42000 rw-p b7e41000 00:00 0
b7e42000-b7f58000 r-xp 00000000 03:03 1477953 /lib/libc-2.4.so
b7f58000-b7f5a000 r--p 00115000 03:03 1477953 /lib/libc-2.4.so
b7f5a000-b7f5c000 rw-p 00117000 03:03 1477953 /lib/libc-2.4.so
b7f5c000-b7f60000 rw-p b7f5c000 00:00 0
b7f75000-b7f8e000 r-xp 00000000 03:03 1477763 /lib/ld-2.4.so
b7f8e000-b7f8f000 r--p 00019000 03:03 1477763 /lib/ld-2.4.so
b7f8f000-b7f90000 rw-p 0001a000 03:03 1477763 /lib/ld-2.4.so
bff76000-bff8b000 rw-p bff76000 00:00 0 [stack]
bfffe000-bffff000 r-xp bfffe000 00:00 0
Abandon
17:21:34 [kiki@screwb /tmp]$ strace ./test
execve("./test", ["./test"], [/* 61 vars */]) = 0
brk(0) = 0x804a000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=85930, ...}) = 0
mmap2(NULL, 85930, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f8b000
close(3) = 0
open("/lib/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340Y\1"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1225744, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f8a000
mmap2(NULL, 1164924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e6d000
mmap2(0xb7f83000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x115) = 0xb7f83000
mmap2(0xb7f87000, 9852, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f87000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e6c000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e6c6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7f83000, 8192, PROT_READ) = 0
mprotect(0xb7fb9000, 4096, PROT_READ) = 0
munmap(0xb7f8b000, 85930) = 0
brk(0) = 0x804a000
brk(0x806b000) = 0x806b000
open("/dev/tty", O_RDWR|O_NONBLOCK|O_NOCTTY) = 3
writev(3, [{"*** glibc detected *** ", 23}, {"./test", 6}, {": ", 2}, {"double free or corruption (top)", 31}, {": 0x", 4}, {"0804a008", 8}, {" ***\n", 5}], 7*** glibc detected *** ./test: double free or corruption (top): 0x0804a008 ***
) = 79
open("/etc/ld.so.cache", O_RDONLY) = 4
fstat64(4, {st_mode=S_IFREG|0644, st_size=85930, ...}) = 0
mmap2(NULL, 85930, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7f8b000
close(4) = 0
open("/usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1", O_RDONLY) = 4
read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\25"..., 512) = 512
mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0xb7c6c000
munmap(0xb7c6c000, 606208) = 0
munmap(0xb7e00000, 442368) = 0
mprotect(0xb7d00000, 135168, PROT_READ|PROT_WRITE) = 0
fstat64(4, {st_mode=S_IFREG|0644, st_size=35224, ...}) = 0
mmap2(NULL, 34052, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7e63000
mmap2(0xb7e6b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7e6b000
close(4) = 0
munmap(0xb7f8b000, 85930) = 0
write(3, "======= Backtrace: =========\n", 29======= Backtrace: =========
) = 29
writev(3, [{"/lib/libc.so.6", 14}, {"[0x", 3}, {"b7ecfd21", 8}, {"]\n", 2}], 4/lib/libc.so.6[0xb7ecfd21]
) = 27
writev(3, [{"/lib/libc.so.6", 14}, {"(", 1}, {"__libc_free", 11}, {"+0x", 3}, {"89", 2}, {")", 1}, {"[0x", 3}, {"b7ed07f9", 8}, {"]\n", 2}], 9/lib/libc.so.6(__libc_free+0x89)[0xb7ed07f9]
) = 45
writev(3, [{"./test", 6}, {"[0x", 3}, {"8048415", 7}, {"]\n", 2}], 4./test[0x8048415]
) = 18
writev(3, [{"/lib/libc.so.6", 14}, {"(", 1}, {"__libc_start_main", 17}, {"+0x", 3}, {"e6", 2}, {")", 1}, {"[0x", 3}, {"b7e82896", 8}, {"]\n", 2}], 9/lib/libc.so.6(__libc_start_main+0xe6)[0xb7e82896]
) = 51
writev(3, [{"./test", 6}, {"[0x", 3}, {"8048341", 7}, {"]\n", 2}], 4./test[0x8048341]
) = 18
write(3, "======= Memory map: ========\n", 29======= Memory map: ========
) = 29
open("/proc/self/maps", O_RDONLY) = 4
read(4, "08048000-08049000 r-xp 00000000 "..., 1024) = 1024
write(3, "08048000-08049000 r-xp 00000000 "..., 102408048000-08049000 r-xp 00000000 03:03 2644037 /tmp/test
08049000-0804a000 rw-p 00000000 03:03 2644037 /tmp/test
0804a000-0806b000 rw-p 0804a000 00:00 0 [heap]
b7d00000-b7d21000 rw-p b7d00000 00:00 0
b7d21000-b7e00000 ---p b7d21000 00:00 0
b7e63000-b7e6b000 r-xp 00000000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1
b7e6b000-b7e6c000 rw-p 00007000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1
b7e6c000-b7e6d000 rw-p b7e6c000 00:00 0
b7e6d000-b7f83000 r-xp 00000000 03:03 1477953 /lib/libc-2.4.so
b7f83000-b7f85000 r--p 00115000 03:03 1477953 /lib/libc-2.4.so
b7f85000-b7f87000 rw-p 00117000 03:03 1477953 /lib/libc-2.4.so
b7f87000-b7f8b000 rw-p b7f87000 00:00 0
b7fa0000-b7fb9000 r-xp 00000000 03:03 1477763 /lib/ld-2.4.so
b7fb9000-b7fba000 r--p 00019000 03:03 1477763 /lib/ld-2.4.so
b7fba000-b7fbb000 rw-p 0001a000 03:03 1477763 /lib/ld-2.4.so
bfaa0000-bfab6000 rw-p bfaa0000 00:00 0 [stack]
bfffe000-bffff000 r-xp bfffe000 00:00 0) = 1024
read(4, " \n", 1024) = 2
write(3, " \n", 2
) = 2
read(4, "", 1024) = 0
close(4) = 0
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
gettid() = 24383
tgkill(24383, 24383, SIGABRT) = 0
--- SIGABRT (Aborted) @ 0 (0) ---
+++ killed by SIGABRT +++
Process 24383 detached