title: return to libc works in gdb but not when running alone
body: <p>I am trying return to libc trick with the following simple code:</p>
  
  <pre><code>#define SYSTEM_CALL_ADDR 0xb7ec5e50  /*my system call addr*/
  #define EXIT_CALL_ADDR  0xb7ebbb80   /*my exit call addr*/
  char shell[] = "/bin/sh";
  
  int main(){
   int* p; 
   p = (int*)&amp;p + 2;
   *p = SYSTEM_CALL_ADDR;
  
   p = (int*)&amp;p + 3;
   *p = EXIT_CALL_ADDR;
  
   p = (int*)&amp;p + 4;
   *p = shell;
  
   return 1;
  }
  </code></pre>
  
  <p>Interestingly when I run this program, it ends with "Segmentation error", but if I debug it using gdb and run it step by step, it's totally fine, spawning a shell and then exiting program. Anybody meet this situation? or could somebody please guide me how to correct this? Thanks first. I am on ArchLinux kernel:2.6.33, gcc 4.5.0.</p>