I can print the memory with gdb's x command ,but if I use printf,segmentation fault

Question

This line is causing segfault to me:

30              printf("st_name:\t%s\n", &p_str_tab[p->st_name]);

I've tried to trace it down in gdb:

(gdb) p p_str_tab[p->st_name]
$11 = 0 '\000'
(gdb) p &p_str_tab[p->st_name]
$12 = 0x2aaaaaab0000 ""
(gdb) x/16s 0x2aaaaaab0000
0x2aaaaaab0000:  ""
0x2aaaaaab0001:  ".symtab"
0x2aaaaaab0009:  ".strtab"
(gdb) call printf("st_name:\t%s\n", 0x2aaaaaab0000)

Program received signal SIGSEGV, Segmentation fault.
0x00000034f4042729 in vfprintf () from /lib64/libc.so.6
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on".
Evaluation of the expression containing the function

I can print the memory with gdb's x command ,but if I use printf,segmentation fault.

Why?

UPDATE as required in comment:

(gdb) x/1i $rip 
0x34f4042729 <vfprintf+57>: mov    0xc0(%rdi),%eax
(gdb) info reg 
rax            0x54 84
rbx            0x34f3e1bbc0 227429956544
rcx            0x0  0
rdx            0xffffffffffffffb0   -80
rsi            0x401b08 4201224
rdi            0x600908 6293768
rbp            0x7fffffffe6e0   0x7fffffffe6e0
rsp            0x7fffffffe040   0x7fffffffe040
r8             0x2aaaaaabf210   46912496202256
r9             0x34f4351780 227435419520
r10            0x1238   4664
r11            0x648    1608
r12            0x0  0
r13            0x7fffffffe9c0   140737488349632
r14            0x0  0
r15            0x0  0
rip            0x34f4042729 0x34f4042729 <vfprintf+57>
eflags         0x10202  [ IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0  0
es             0x0  0
fs             0x0  0
gs             0x0  0
fctrl          0x37f    895
fstat          0x0  0
ftag           0xffff   65535
---Type <return> to continue, or q <return> to quit---
fiseg          0x0  0
fioff          0x0  0
foseg          0x0  0
fooff          0x0  0
fop            0x0  0
mxcsr          0x1f80   [ IM DM ZM OM UM PM ]

Answer 1

You might want to check whether you're overflowing the stack.

Answer 2

The faulting instruction mov 0xc0(%rdi),%eax represents something like eax = rdi->member where member is at offset 0xc0. Without seeing more disassembly it's hard to know what that is for sure, but it seems likely that it's stdout or something inside stdout. It's not likely that the faulting instruction is dereferencing your input string.

Have you done anything unusual to stdout? A brute force approach would be to sprinkle printf everywhere (of what it probably doesn't matter) and see where it starts crashing. Just before that is where something got corrupted.