How the offset comes in stack?

Question

Source code:

1       int func()
2       {
3           int a = 0x12345678;
4           int *p = &a;
5           return *p;
6       }

8       int main()
9       {
10          int b = 0x87654321;
11          return b + func();
12      }

Disassemble:

(gdb) disass main
Dump of assembler code for function main():
0x0000000000400544 <main()+0>:  push   %rbp
0x0000000000400545 <main()+1>:  mov    %rsp,%rbp       
0x0000000000400548 <main()+4>:  sub    $0x10,%rsp
0x000000000040054c <main()+8>:  movl   $0x87654321,-0x4(%rbp)
0x0000000000400553 <main()+15>: callq  0x400528 <func()>
0x0000000000400558 <main()+20>: add    -0x4(%rbp),%eax
0x000000000040055b <main()+23>: leaveq
0x000000000040055c <main()+24>: retq
End of assembler dump.
(gdb) disass func
Dump of assembler code for function func():
0x0000000000400528 <func()+0>:  push   %rbp
0x0000000000400529 <func()+1>:  mov    %rsp,%rbp
0x000000000040052c <func()+4>:  movl   $0x12345678,-0xc(%rbp)  <=how -0xc comes?
0x0000000000400533 <func()+11>: lea    -0xc(%rbp),%rax
0x0000000000400537 <func()+15>: mov    %rax,-0x8(%rbp)
0x000000000040053b <func()+19>: mov    -0x8(%rbp),%rax
0x000000000040053f <func()+23>: mov    (%rax),%eax
0x0000000000400541 <func()+25>: leaveq
0x0000000000400542 <func()+26>: retq
End of assembler dump.

My question is how 0xc in following line

"0x000000000040052c <func()+4>:  movl   $0x12345678,-0xc(%rbp)" comes.

My understanding is: 0x12345678 occupies 4 bytes for variable a, followed by 4 bytes for pointer p, what the rest 4 bytes are for?

Thanks.

EDIT:

Linux 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64

EDIT 1:: One more question: what is the following line for?

Dump of assembler code for function main():

0x0000000000400544 <main()+0>:  push   %rbp
0x0000000000400545 <main()+1>:  mov    %rsp,%rbp      
0x0000000000400548 <main()+4>:  sub    $0x10,%rsp   <== ?

EDIT 2: Why main() is required to be aligned with 16 bytes (by "sub $0x10,%rsp") while func not (0x0c is not aligned, right?)?

Answer 1

Linux 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64

... followed by 4 bytes for pointer "p" ...

You are on a 64 bit architecture, so a pointer occupies 64 bit = 8 bytes:

#include <stdio.h>

int main() {
   int a = 0x12345678;
   int *p = &a;

   printf("%zu\n", sizeof(p));
   printf("%zu\n", sizeof(a));

   return 0;
}

$ gcc -std=c99 -Wall -pedantic -o sample sample.c
$ ./sample
8
4

Detailed stack analysis:

When entering func(), after executing the first two instructions, the stack looks like this (assumed that each rectangle is 4 bytes of memory):

0x0000000000400528 <func()+0>:  push   %rbp
0x0000000000400529 <func()+1>:  mov    %rsp,%rbp
+..........+
| RET ADDR | (from CALL)
+----------+
|RBP (high)|
+..........|
|RBP (low) | <== RSP, RBP
+----------+
|          | <== -0x4(%rbp) -\
+..........+                  \__ int *p
|          | <== -0x8(%rbp)   /
+----------+                -/
|          | <== -0xc(%rbp)       int a
+----------+

You are then storing a value into the local a variable:

0x000000000040052c <func()+4>:  movl   $0x12345678,-0xc(%rbp)  <=how -0xc comes?
+..........+
| RET ADDR | (from CALL)
+----------+
|RBP (high)|
+..........|
|RBP (low) | <== RSP, RBP
+----------+
|          | <== -0x4(%rbp) -\
+..........+                  \__ int *p
|          | <== -0x8(%rbp)   /
+----------+                -/
|0x12345678| <== -0xc(%rbp)       int a
+----------+

Then, you are storing a 64 bit pointer into the p variable:

0x0000000000400533 <func()+11>: lea    -0xc(%rbp),%rax  ; load address of a into RAX
0x0000000000400537 <func()+15>: mov    %rax,-0x8(%rbp)  ; store address into pointer (64 bit)
+..........+
| RET ADDR | (from CALL)
+----------+
|RBP (high)|
+..........|
|RBP (low) | <== RSP, RBP
+----------+
| &a (high)| <== -0x4(%rbp) -\
+..........+                  \__ int *p
| &a (low) | <== -0x8(%rbp)   /
+----------+                -/
|0x12345678| <== -0xc(%rbp)       int a
+----------+