I have a function that looks like so:

```
int bof(char *str)
{
    char buffer[12];

    strcpy(buffer, str);

    return 1;
}

```

I am attempting to overwrite its return address. I have found that I can do so by using, for instance, `memcpy(buffer+24, "\x15\xf1\xff\xbf", 4)`. What I do not understand is why I need to access `buffer + 24`. My understanding of the C memory model tells me that the stack when this function is executed should look like 

```
bottom of                                                            top of
memory                                                               memory
           buffer(12)     sfp(4)   ret(4)   str(4)
<------   [            ][       ][       ][       ] --->

top of                                                            bottom of
stack                                                                 stack

```

This would suggest that I should the ret address should begin at buffer+16. Where are the extra 8 bytes coming in?

By the way, I am running this on a 32-bit system.