stack corruption in coredump ? gcc/c - gcc

Question

I am noticing a strange problem when I attempt to use the signal handler to dump global data to a text file and generate the core file. I would expect the data dumped to the file to be the same as that is present in the core file (it is the same global data)
in a header file foo.h
extern char buffer[100][80] ; // Hundred records each of length 80 characters
in foo.c
char buffer[100][80];
.. in a loop ..
snprintf(buffer[i],80,"%s:%d recorded idx = %d\n",__FUNCTION__,__LINE__,i);
in signal_handler.c
.. in a loop ..
fprintf(..dump data to text file..)
The data is dumped to the text file alright. I run the program in gdb and I issue the ABRT signal (the signal I am handling) via kill. In gdb I see
gdb) p &buffer[0]
$3 = (char (*)[80]) 0x1002c8970
I continue and generate the core file. In the core dump I see
(gdb) p &buffer[0]
$2 = (char (*)[80]) 0x1002c9a80
the difference between the two positions is 1110.
My question is why do I see this discrepancy in the core file ? Any leads would be appreciated!
Thanks
John
EDIT To clarify, the problem is not in generating the core via GDB
Full code without signal handlers to isolate the problem.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define MAX 100
char buffer[100][80];
int main()
{
int i = 0;
int idx = 0;
FILE *fp = NULL;
fp = fopen("test.txt","w");
if (!fp)
exit(1);
for (i=0; i < 5500; i++) {
snprintf(buffer[idx],80,"%s:%d idx = %d\n",__FUNCTION__, __LINE__, i);
idx = ((idx + 1)% MAX);
}
for (i = 0 ; i < MAX; i++)
fprintf(fp,"%s",buffer[i]);
fclose(fp);
abort();
return 0;
}
The problem is not when I am trying to run in GDB, the problem is that in the core file generated,
gdb) p buffer[0]
$2 "c0 - idx = 54\n", '\0' , "main:20 0x7ef9524"
the buffer is offset by 1110 bytes. I had used GDB to check if the buffer was corrupted. Sorry about the confusion.

Answer 1

Please provide a stand-alone example. I can explain different address when the core is produced from outside GDB, but not when it is produced from inside GDB.
Here is what I see:
$ cat foo.c
#include <stdio.h>
#include <stdlib.h>
char buf[100][80];
int main()
{
sprintf(buf[0], "hello");
sprintf(buf[1], "hello again");
abort();
}
$ gcc -g foo.c -fPIC -pie # PIE executable so its address can be randomized
$ gdb -q a.out
Reading symbols from /tmp/a.out...done.
(gdb) r
Program received signal SIGABRT, Aborted.
0x00007ffff7a8ca75 in raise () at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
(gdb) p &buf[0]
$1 = (char (*)[80]) 0x7ffff81ff060
(gdb) sig SIGABRT
Program terminated with signal SIGABRT, Aborted.
The program no longer exists.
(gdb) q
$ gdb -q a.out core
Reading symbols from /tmp/a.out...done.
[New Thread 20440]
Core was generated by `/tmp/a.out'.
Program terminated with signal 6, Aborted.
#0 0x00007ffff7a8ca75 in raise () at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
(gdb) p &buf[0]
$1 = (char (*)[80]) 0x7ffff81ff060 # same address as before
(gdb) q
$ ./a.out
Aborted (core dumped)
$ gdb -q a.out core
Reading symbols from /tmp/a.out...done.
[New Thread 20448]
Core was generated by `./a.out'.
Program terminated with signal 6, Aborted.
#0 0x00007fef9dcb5a75 in raise () at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
(gdb) p &buf[0]
$1 = (char (*)[80]) 0x7fef9e428060 # different address due to ASLR