Question

My question is related to Stack allocation, padding, and alignment. Consider the following function:

void func(int a,int b)
{
    char buffer[5];
}

At assembly level, the function looks like this:

pushl   %ebp
movl    %esp, %ebp
subl    $24, %esp

I want to know how the 24 bytes on the stack is allocated. I understand that 16 bytes is allocated for the char buffer[5]. I don’t understand why the extra 8 bytes are for and how they are allocated. The top answer in the above link says that it is for ret and leave. Can someone please expand on that?

I’m thinking that the stack structure looks like this:

[bottom] b , a , return address , frame pointer , buffer1 [top]

But this could be wrong because i’m writing a simple buffer overflow and trying to change the return address. But for some reason the return address is not changing. Is something else present on the stack?

Answer 1

There are a couple of reasons for extra space. One is for alignment of variables. A second is to introduce padding for checking the stack (typically a debug build rather than a release build use of space). A third is to have additional space for temporary storage of registers or compiler generated temporary variables.

In the C calling sequence, the way it is normally done is there will be a series of push instructions pushing the arguments onto the stack and then a call instruction is used to call the function. The call instruction will push the return address onto the stack.

When the function returns, the calling function will then remove the pushed on arguments. For instance the call to a function (this is Visual Studio 2005 with a C++ program) will look like:

push    OFFSET ?pHead@@3VPerson@@A      ; pHead
call    ?exterminateStartingFrom@@YAXPAVPerson@@@Z ; exterminateStartingFrom
add esp, 4

This is pushing the address of a variable onto the stack, calling the function (the function name is mangled per C++), and then after the called function returns, it readjusts the stack by adding to the stack pointer the number of bytes used for the address.

The following is the entry part of the called function. What this does is to allocate space on the stack for the local variables. Notice that after setting up the entry environment, it then gets the function argument from the stack.

push    ebp
mov ebp, esp
sub esp, 232                ; 000000e8H
push    ebx
push    esi
push    edi
lea edi, DWORD PTR [ebp-232]

When the function returns, it basically adjusts the stack back to where it was at the time the function was called. Each function is responsible for cleaning up whatever changes it has made to the stack before it returns.

pop edi
pop esi
pop ebx
add esp, 232                ; 000000e8H
pop ebp
ret 0

You mention that you are trying to change the return address. From these examples what you can see is that the return address is after the last argument that was pushed onto the stack.

Here is a brief writeup on function call conventions. Also take a look at this document on Intel assembler instructions.

Doing some example work with Visual Studio 2005 what I see is that if I do the following code, I can access the return for this example function.

void MyFunct (unsigned short arg) {
    unsigned char  *retAddress = (unsigned char *)&arg;
    retAddress -=4;
    printf ("Return address is 0x%2.2x%2.2x%2.2x%2.2x\n", retAddress[3], retAddress[2], retAddress[1], retAddress[0]);
}

Notice that the call assembler instruction for this Windows 32 bit addressing appears to put the return address in a byte order in which the return address is stored from low byte to high byte.