After stack is compromised, stack unwinding becomes unreliable: [hjl@gnu-6 tmp]$ cat ssp-1.c int main (void) { int i = 0; char foo[255]; /* Overflow buffer. */ for (i = 0; i < 400; i++) foo[i] = 42; return 1; /* fail */ } [hjl@gnu-6 tmp]$ gcc ssp-1.c -g -fstack-protector [hjl@gnu-6 tmp]$ ./a.out *** stack smashing detected ***: ./a.out terminated Segmentation fault [hjl@gnu-6 tmp]$ gdb a.out GNU gdb (GDB) Fedora 8.0-13.0.fc25 Copyright (C) 2017 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from a.out...done. (gdb) r Starting program: /tmp/a.out Missing separate debuginfos, use: dnf debuginfo-install glibc-2.24-9.0.fc25.x86_64 *** stack smashing detected ***: /tmp/a.out terminated Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7806c8b in ?? () from /lib64/libgcc_s.so.1 Missing separate debuginfos, use: dnf debuginfo-install libgcc-6.3.1-3.2.fc25.x86_64 (gdb) bt #0 0x00007ffff7806c8b in ?? () from /lib64/libgcc_s.so.1 #1 0x00007ffff7808628 in _Unwind_Backtrace () from /lib64/libgcc_s.so.1 #2 0x00007ffff7b26b8f in backtrace () from /lib64/libc.so.6 #3 0x00007ffff7a2efb6 in backtrace_and_maps () from /lib64/libc.so.6 #4 0x00007ffff7a886eb in __libc_message () from /lib64/libc.so.6 #5 0x00007ffff7b2a387 in __fortify_fail () from /lib64/libc.so.6 #6 0x00007ffff7b2a350 in __stack_chk_fail () from /lib64/libc.so.6 #7 0x0000000000400592 in main () at ssp-1.c:11 (gdb)
Dup. *** This bug has been marked as a duplicate of bug 12189 ***