Home/ Questions/Q 6627407
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T22:00:37+00:00

I am writing a program to unpack PE files. I have a struct, Pe_SymbolHeader.

  • 0

I am writing a program to unpack PE files. I have a struct, Pe_SymbolHeader. It looks like this:

typedef struct _Pe_SymbolHeader {
    char Name[8];                // 8
    uint32_t Value;              // 12
    uint16_t SectionNumber;      // 14
    uint16_t Type;               // 16
    uint8_t  StorageClass;       // 17
    uint8_t  NumberOfAuxSymbols; // 18
} Pe_SymbolHeader;

gcc is telling me the size of this struct is 20 bytes.

printf("sizeof Pe_SymbolHeader %d\n", sizeof(Pe_SymbolHeader));

I decided to place a Pe_SymbolHeader on the stack and take a look at where everything was located in memory

Pe_SymbolHeader test

printf("%p\n", &(test.Name));
printf("%p\n", &(test.Value));
printf("%p\n", &(test.SectionNumber));
printf("%p\n", &(test.Type));
printf("%p\n", &(test.StorageClass));
printf("%p\n", &(test.NumberOfAuxSymbols));

This gave me the following, which seems ok:

0x7fffffffe150
0x7fffffffe158
0x7fffffffe15c
0x7fffffffe15e
0x7fffffffe160
0x7fffffffe161

So if gcc is using 18 bytes to store my struct, why is sizeof telling me the struct will take 20 bytes?

Edit: Ok, it seems what gcc is doing to try and help me is what is killing me, and several answers are correct. I can only vote for one, but thank you those who answered.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Because of padding for alignment

    There is padding at the end of the struct.

    The reason has to do with what happens in an array or possibly some other context where something follows your struct. That something might be another instance of this struct. The struct contains a 32-bit object so it will have an alignment requirement of 32 bits.

    The compiler very much wants the next item to start on a natural word boundary for the architecture it is compiling for, so that any field in the next object can be read with a single operation instead of two operations plus some fiddling to combine two different “words”.

    • 0