17:21:25 [kiki@screwb /tmp]$ cat test.c #include int main(){ char* bb; bb= malloc(2048); free(bb); free(bb); } 17:21:28 [kiki@screwb /tmp]$ gcc test.c -o test && ./test *** glibc detected *** ./test: double free or corruption (top): 0x0804a008 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7ea4d21] /lib/libc.so.6(__libc_free+0x89)[0xb7ea57f9] ./test[0x8048415] /lib/libc.so.6(__libc_start_main+0xe6)[0xb7e57896] ./test[0x8048341] ======= Memory map: ======== 08048000-08049000 r-xp 00000000 03:03 2644037 /tmp/test 08049000-0804a000 rw-p 00000000 03:03 2644037 /tmp/test 0804a000-0806b000 rw-p 0804a000 00:00 0 [heap] b7d00000-b7d21000 rw-p b7d00000 00:00 0 b7d21000-b7e00000 ---p b7d21000 00:00 0 b7e38000-b7e40000 r-xp 00000000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1 b7e40000-b7e41000 rw-p 00007000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1 b7e41000-b7e42000 rw-p b7e41000 00:00 0 b7e42000-b7f58000 r-xp 00000000 03:03 1477953 /lib/libc-2.4.so b7f58000-b7f5a000 r--p 00115000 03:03 1477953 /lib/libc-2.4.so b7f5a000-b7f5c000 rw-p 00117000 03:03 1477953 /lib/libc-2.4.so b7f5c000-b7f60000 rw-p b7f5c000 00:00 0 b7f75000-b7f8e000 r-xp 00000000 03:03 1477763 /lib/ld-2.4.so b7f8e000-b7f8f000 r--p 00019000 03:03 1477763 /lib/ld-2.4.so b7f8f000-b7f90000 rw-p 0001a000 03:03 1477763 /lib/ld-2.4.so bff76000-bff8b000 rw-p bff76000 00:00 0 [stack] bfffe000-bffff000 r-xp bfffe000 00:00 0 Abandon 17:21:34 [kiki@screwb /tmp]$ strace ./test execve("./test", ["./test"], [/* 61 vars */]) = 0 brk(0) = 0x804a000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=85930, ...}) = 0 mmap2(NULL, 85930, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f8b000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340Y\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1225744, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f8a000 mmap2(NULL, 1164924, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e6d000 mmap2(0xb7f83000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x115) = 0xb7f83000 mmap2(0xb7f87000, 9852, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f87000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e6c000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e6c6b0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 mprotect(0xb7f83000, 8192, PROT_READ) = 0 mprotect(0xb7fb9000, 4096, PROT_READ) = 0 munmap(0xb7f8b000, 85930) = 0 brk(0) = 0x804a000 brk(0x806b000) = 0x806b000 open("/dev/tty", O_RDWR|O_NONBLOCK|O_NOCTTY) = 3 writev(3, [{"*** glibc detected *** ", 23}, {"./test", 6}, {": ", 2}, {"double free or corruption (top)", 31}, {": 0x", 4}, {"0804a008", 8}, {" ***\n", 5}], 7*** glibc detected *** ./test: double free or corruption (top): 0x0804a008 *** ) = 79 open("/etc/ld.so.cache", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0644, st_size=85930, ...}) = 0 mmap2(NULL, 85930, PROT_READ, MAP_PRIVATE, 4, 0) = 0xb7f8b000 close(4) = 0 open("/usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\25"..., 512) = 512 mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0xb7c6c000 munmap(0xb7c6c000, 606208) = 0 munmap(0xb7e00000, 442368) = 0 mprotect(0xb7d00000, 135168, PROT_READ|PROT_WRITE) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=35224, ...}) = 0 mmap2(NULL, 34052, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0xb7e63000 mmap2(0xb7e6b000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0x7) = 0xb7e6b000 close(4) = 0 munmap(0xb7f8b000, 85930) = 0 write(3, "======= Backtrace: =========\n", 29======= Backtrace: ========= ) = 29 writev(3, [{"/lib/libc.so.6", 14}, {"[0x", 3}, {"b7ecfd21", 8}, {"]\n", 2}], 4/lib/libc.so.6[0xb7ecfd21] ) = 27 writev(3, [{"/lib/libc.so.6", 14}, {"(", 1}, {"__libc_free", 11}, {"+0x", 3}, {"89", 2}, {")", 1}, {"[0x", 3}, {"b7ed07f9", 8}, {"]\n", 2}], 9/lib/libc.so.6(__libc_free+0x89)[0xb7ed07f9] ) = 45 writev(3, [{"./test", 6}, {"[0x", 3}, {"8048415", 7}, {"]\n", 2}], 4./test[0x8048415] ) = 18 writev(3, [{"/lib/libc.so.6", 14}, {"(", 1}, {"__libc_start_main", 17}, {"+0x", 3}, {"e6", 2}, {")", 1}, {"[0x", 3}, {"b7e82896", 8}, {"]\n", 2}], 9/lib/libc.so.6(__libc_start_main+0xe6)[0xb7e82896] ) = 51 writev(3, [{"./test", 6}, {"[0x", 3}, {"8048341", 7}, {"]\n", 2}], 4./test[0x8048341] ) = 18 write(3, "======= Memory map: ========\n", 29======= Memory map: ======== ) = 29 open("/proc/self/maps", O_RDONLY) = 4 read(4, "08048000-08049000 r-xp 00000000 "..., 1024) = 1024 write(3, "08048000-08049000 r-xp 00000000 "..., 102408048000-08049000 r-xp 00000000 03:03 2644037 /tmp/test 08049000-0804a000 rw-p 00000000 03:03 2644037 /tmp/test 0804a000-0806b000 rw-p 0804a000 00:00 0 [heap] b7d00000-b7d21000 rw-p b7d00000 00:00 0 b7d21000-b7e00000 ---p b7d21000 00:00 0 b7e63000-b7e6b000 r-xp 00000000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1 b7e6b000-b7e6c000 rw-p 00007000 03:03 983318 /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libgcc_s.so.1 b7e6c000-b7e6d000 rw-p b7e6c000 00:00 0 b7e6d000-b7f83000 r-xp 00000000 03:03 1477953 /lib/libc-2.4.so b7f83000-b7f85000 r--p 00115000 03:03 1477953 /lib/libc-2.4.so b7f85000-b7f87000 rw-p 00117000 03:03 1477953 /lib/libc-2.4.so b7f87000-b7f8b000 rw-p b7f87000 00:00 0 b7fa0000-b7fb9000 r-xp 00000000 03:03 1477763 /lib/ld-2.4.so b7fb9000-b7fba000 r--p 00019000 03:03 1477763 /lib/ld-2.4.so b7fba000-b7fbb000 rw-p 0001a000 03:03 1477763 /lib/ld-2.4.so bfaa0000-bfab6000 rw-p bfaa0000 00:00 0 [stack] bfffe000-bffff000 r-xp bfffe000 00:00 0) = 1024 read(4, " \n", 1024) = 2 write(3, " \n", 2 ) = 2 read(4, "", 1024) = 0 close(4) = 0 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 gettid() = 24383 tgkill(24383, 24383, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 24383 detached