I guess your function address is wrong, run "objdump /usr/lib/libc.so.5 -T | grep -w execve" to find the one for your system.

by the way: a much more reliable way to run system functions is to use systemcalls.
the respective number for each syscall can be found
with egrep "^#define __NR" /usr/inc...

[ more ]