fails to identify what program left a core file

[Marius Gedminas]

Steps to reproduce:

- 'ulimit -c unlimited' so you get core files
- get a program to crash
- run 'file core' to see what program it was that crashed

Expected results:

- file tells me the name of the program

Actual results:

- "core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), too many program headers (463)"

This matters when you find a 'core' file after time has passed and you don't remember when or what crashed.

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: file 1:5.22+15-2ubuntu1
ProcVersionSignature: Ubuntu 4.2.0-16.19-generic 4.2.3
Uname: Linux 4.2.0-16-generic x86_64
ApportVersion: 2.19.1-0ubuntu4
Architecture: amd64
CurrentDesktop: GNOME
Date: Fri Oct 30 14:40:56 2015
Dependencies:
 gcc-5-base 5.2.1-22ubuntu2
 libc6 2.21-0ubuntu4
 libgcc1 1:5.2.1-22ubuntu2
 libmagic1 1:5.22+15-2ubuntu1
 zlib1g 1:1.2.8.dfsg-2ubuntu4
EcryptfsInUse: Yes
InstallationDate: Installed on 2012-07-25 (1191 days ago)
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
SourcePackage: file
UpgradeStatus: Upgraded to wily on 2015-10-22 (7 days ago)

[Marius Gedminas (mgedmin)]

objdump -h core shows this:

core: file format elf64-x86-64

Sections:
Idx Name Size VMA LMA File off Algn
  0 note0 00007cd4 0000000000000000 0000000000000000 00006588 2**0
                  CONTENTS, READONLY
  1 .reg/22412 000000d8 0000000000000000 0000000000000000 0000660c 2**2
                  CONTENTS
  2 .reg 000000d8 0000000000000000 0000000000000000 0000660c 2**2
                  CONTENTS
  3 .note.linuxcore.siginfo/22412 00000080 0000000000000000 0000000000000000 0000679c 2**2
                  CONTENTS
  4 .note.linuxcore.siginfo 00000080 0000000000000000 0000000000000000 0000679c 2**2
                  CONTENTS
  5 .auxv 00000130 0000000000000000 0000000000000000 00006830 2**3
                  CONTENTS
  6 .note.linuxcore.file/22412 00007380 0000000000000000 0000000000000000 00006974 2**2
                  CONTENTS
  7 .note.linuxcore.file 00007380 0000000000000000 0000000000000000 00006974 2**2
                  CONTENTS
  8 .reg2/22412 00000200 0000000000000000 0000000000000000 0000dd08 2**2
                  CONTENTS
  9 .reg2 00000200 0000000000000000 0000000000000000 0000dd08 2**2
                  CONTENTS
 10 .reg-xstate/22412 00000340 0000000000000000 0000000000000000 0000df1c 2**2
                  CONTENTS
 11 .reg-xstate 00000340 0000000000000000 0000000000000000 0000df1c 2**2
                  CONTENTS
 12 load1a 00001000 0000000000400000 0000000000000000 0000f000 2**12
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
 13 load1b 00000000 0000000000401000 0000000000001000 00010000 2**12
                  ALLOC, READONLY, CODE
 14 load2 00001000 00000000008b8000 0000000000000000 00010000 2**12
                  CONTENTS, ALLOC, LOAD, READONLY
...
577 load460 00002000 00007ffef5d89000 0000000000000000 42581000 2**12
                  CONTENTS, ALLOC, LOAD, READONLY
578 load461 00002000 00007ffef5d8b000 0000000000000000 42583000 2**12
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
579 load462 00001000 ffffffffff600000 0000000000000000 42585000 2**12
                  CONTENTS, ALLOC, LOAD, READONLY, CODE

[Marius Gedminas (mgedmin)]

Workaround: 'readelf -n core' and look at the first mapped file.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.