3

My question is related to Stack allocation, padding, and alignment. Consider the following function:

void func(int a,int b)
{
    char buffer[5];
}

At assembly level, the function looks like this:

pushl   %ebp
movl    %esp, %ebp
subl    $24, %esp

I want to know how the 24 bytes on the stack is allocated. I understand that 16 bytes is allocated for the char buffer[5]. I don't understand why the extra 8 bytes are for and how they are allocated. The top answer in the above link says that it is for ret and leave. Can someone please expand on that?

I'm thinking that the stack structure looks like this:

[bottom] b , a , return address , frame pointer , buffer1 [top]

But this could be wrong because i'm writing a simple buffer overflow and trying to change the return address. But for some reason the return address is not changing. Is something else present on the stack?

Community
  • 1
  • 1
Aswin Parthasarathy
  • 605
  • 1
  • 8
  • 17

2 Answers2

5

There are a couple of reasons for extra space. One is for alignment of variables. A second is to introduce padding for checking the stack (typically a debug build rather than a release build use of space). A third is to have additional space for temporary storage of registers or compiler generated temporary variables.

In the C calling sequence, the way it is normally done is there will be a series of push instructions pushing the arguments onto the stack and then a call instruction is used to call the function. The call instruction will push the return address onto the stack.

When the function returns, the calling function will then remove the pushed on arguments. For instance the call to a function (this is Visual Studio 2005 with a C++ program) will look like:

push    OFFSET ?pHead@@3VPerson@@A      ; pHead
call    ?exterminateStartingFrom@@YAXPAVPerson@@@Z ; exterminateStartingFrom
add esp, 4

This is pushing the address of a variable onto the stack, calling the function (the function name is mangled per C++), and then after the called function returns, it readjusts the stack by adding to the stack pointer the number of bytes used for the address.

The following is the entry part of the called function. What this does is to allocate space on the stack for the local variables. Notice that after setting up the entry environment, it then gets the function argument from the stack.

push    ebp
mov ebp, esp
sub esp, 232                ; 000000e8H
push    ebx
push    esi
push    edi
lea edi, DWORD PTR [ebp-232]

When the function returns, it basically adjusts the stack back to where it was at the time the function was called. Each function is responsible for cleaning up whatever changes it has made to the stack before it returns.

pop edi
pop esi
pop ebx
add esp, 232                ; 000000e8H
pop ebp
ret 0

You mention that you are trying to change the return address. From these examples what you can see is that the return address is after the last argument that was pushed onto the stack.

Here is a brief writeup on function call conventions. Also take a look at this document on Intel assembler instructions.

Doing some example work with Visual Studio 2005 what I see is that if I do the following code, I can access the return for this example function.

void MyFunct (unsigned short arg) {
    unsigned char  *retAddress = (unsigned char *)&arg;
    retAddress -=4;
    printf ("Return address is 0x%2.2x%2.2x%2.2x%2.2x\n", retAddress[3], retAddress[2], retAddress[1], retAddress[0]);
}

Notice that the call assembler instruction for this Windows 32 bit addressing appears to put the return address in a byte order in which the return address is stored from low byte to high byte.

Richard Chambers
  • 16,643
  • 4
  • 81
  • 106
  • I understand the push and corresponding pop operations. I am trying to change the return address of func() inside func() itself. I create a int pointer after creating char buffer[5]. I make the pointer point to the return address by doing this: int *ret = buffer + 28; Assuming that frame pointer comes after buffer (24 for size of buffer[] and 4 for frame pointer). So now ret should point to the return address right? – Aswin Parthasarathy Sep 03 '12 at 20:15
  • 1
    I have done an edit to provide an example of printing out the return address in a function. I took a look at this with Visual Studio 2005 using the debugger and looking at memory and the dis-assembly window. – Richard Chambers Sep 03 '12 at 21:25
  • Thanks a lot! I was trying to find the return address from the top of the stack. You've done the same by subtracting from the address of argument, which is below the return address on the stack. While I still have questions about accessing it from address of local variables inside the function, what you've done does solve my problem :-) – Aswin Parthasarathy Sep 04 '12 at 01:28
3

The extra space is for the stack alignment, which is usually done for better performance.

Alexey Frunze
  • 61,140
  • 12
  • 83
  • 180
  • So where will that extra space be present on the stack? Will it be below buffer1 or above it? Is the stack structure given by me correct? – Aswin Parthasarathy Sep 03 '12 at 18:41
  • The layout is generally correct, though the parameters can be passed in registers if the appropriate calling convention is in use. The extra space can be before and after local variables. Before is used to align local variables. After is used to align parameters and the return address if the function calls another function. – Alexey Frunze Sep 03 '12 at 19:35