why the DSO was loaded at address 0

[Abin Xu <abin1525 at gmail dot com>]

There is a simple test program,it dlopen()s a DSO "/lib/libc.so.6" and
then prints the address of symbol "printf".

#include <dlfcn.h>
#include <stdio.h>

int main() {
    void* handle;
    void (*func)();
    char* error_test;
    if (handle = dlopen("/lib/libc.so.6", RTLD_NOW)) {
        func = dlsym(handle, "printf");
        (*func)("address:%p\n",func);
        sleep(-1);
        dlclose(handle);
        return 0;
    }
    return -1;
}



When I debug it with "LD_DEBUG=all",it shows that:

[root@localhost glibc_test]# LD_DEBUG=all LD_DEBUG_OUTPUT=error ./test &
[18] 14690
[root@localhost glibc_test]# address:0x2f87b0



But the file "error" shows that "/lib/libc.so.6" was loaded to address
0! That`s why?
     14690:    initialize program: ./test
     14690:
     14690:
     14690:    transferring control: ./test
     14690:
     14690:    symbol=dlopen;  lookup in file=./test [0]
     14690:    symbol=dlopen;  lookup in file=/changed_glibc/lib/libdl.so.2 [0]
     14690:    binding file ./test [0] to
/changed_glibc/lib/libdl.so.2 [0]: normal symbol `dlopen' [GLIBC_2.1]
     14690:
     14690:    file=/lib/libc.so.6 [0];  needed by ./test [0]
     14690:    file=/lib/libc.so.6 [0];  generating link map
     14690:      dynamic: 0x0043cd7c  base: 0x00000000   size: 0x00191988
     14690:        entry: 0x002c5e40  phdr: 0x002af034  phnum:         10



What`s more,the "/proc/14270/maps" file perform normal,and the address
of symbol "func"(0x2f87b0) in the test program lies in right
range(002af000-0043b000).

[root@localhost ~]# cat /proc/14690/maps
002af000-0043b000 r-xp 00000000 fd:00 1714117    /lib/libc-2.12.so
0043b000-0043d000 r--p 0018c000 fd:00 1714117    /lib/libc-2.12.so
0043d000-0043e000 rw-p 0018e000 fd:00 1714117    /lib/libc-2.12.so
0043e000-00441000 rw-p 00000000 00:00 0