call stack and stack buffer overflow
http://en.wikipedia.org/wiki/Call_stack
http://en.wikipedia.org/wiki/Stack_buffer_overflow
Stack_buffer_overflow里提到的frame pointer 的位置不一样,不同的系统实现应该是不一样的。
运行时的栈是从高地址向低地址分配的,堆是从低地址向高地址分配的,如:
1
int main() {
2
int a;
3
int b;
4
int *pc = new int;
5
int *pd = new int;
6
printf("%x\n", &a);//栈地址
7
printf("%x\n", &b);//栈地址
8
printf("%x\n", &pc);//栈地址
9
printf("%x\n", &pd);//栈地址
10
printf("%x\n", pc);//堆地址
11
printf("%x\n", pd);//堆地址
12
return 0;
13
}
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
2
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
3
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
4
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
5
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
6
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
7
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
8
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
9
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
10
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
11
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
12
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
13
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedBlockEnd.gif)
结果类似是这样的:
1
20fa58
2
20fa4c
3
20fa40
4
20fa34
5
354bb8
6
354bf8
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
2
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
3
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
4
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
5
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
6
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
update Apr. 26, 2011:
apue 2nd 7.6. Memory Layout of a C Program:
The stack grows from higher-numbered addresses to lower-numbered addresses on this particular architecture(x86).