title: Why does this program allocate more space on the stack than required?
body: <p>I am currently playing the <a href="https://2018game.picoctf.com/game" rel="nofollow noreferrer">picoCTF 2018</a> challenges. Level "buffer overflow 1" gives you the followng source code:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;string.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;sys/types.h&gt;
  #include "asm.h"
  
  #define BUFSIZE 32
  #define FLAGSIZE 64
  
  void win() {
    char buf[FLAGSIZE];
    FILE *f = fopen("flag.txt","r");
    if (f == NULL) {
      printf("Flag File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.\n");
      exit(0);
    }
  
    fgets(buf,FLAGSIZE,f);
    printf(buf);
  }
  
  void vuln(){
    char buf[BUFSIZE];
    gets(buf);
  
    printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", get_return_address());
  }
  
  int main(int argc, char **argv){
  
    setvbuf(stdout, NULL, _IONBF, 0);
  
    gid_t gid = getegid();
    setresgid(gid, gid, gid);
  
    puts("Please enter your string: ");
    vuln();
    return 0;
  }
  </code></pre>
  
  <p>So exploit the <code>gets()</code> in <code>vuln()</code> to overwrite the return adress and jump to <code>win()</code>. Since <code>buf</code> has a size of 32, I was expecting the stack to look like this:</p>
  
  <pre><code>|-------------------|
  |        ...        |
  |        buf        |
  |        buf        |
  |        buf        |
  |        buf        |
  |-------------------|
  |     saved ebp     |
  |-------------------|
  | return after vuln |
  |-------------------|
  |        ...        |
  |-------------------|
  </code></pre>
  
  <p>So I attempted to input 36 random characters and then the return adress, which did not work. Using gdb I found out that the stack actually looks like this:</p>
  
  <pre><code>|-------------------|
  |        ...        |
  |        buf        |
  |        buf        |
  |        buf        |
  |        buf        |
  |-------------------|
  |        ???        |
  |        ???        |
  |-------------------|
  |     saved ebp     |
  |-------------------|
  | return after vuln |
  |-------------------|
  |        ...        |
  |-------------------|
  </code></pre>
  
  <p>There are 8 bytes between the end of <code>buf</code> and the saved ebp. My question is: What are these 8 bytes for?</p>