title: What do the CFI directives mean? (and some more questions)
body: <p>Ok, this is gonna be a long question. I'm trying to understand how "buffer overflow" works. I am reading <a href="http://insecure.org/stf/smashstack.html" rel="noreferrer">Smashing the stack for fun and profit</a> by aleph1 and have just got the disassembly of the following code:</p>
  
  <pre><code>void function(int a, int b, int c) {
     char buffer1[5];
     char buffer2[10];
  }
  
  void main() {
    function(1,2,3);
  }
  </code></pre>
  
  <p>The disameembly using <code>-S</code> flag of GCC gives me:</p>
  
  <pre><code>    .file   "example1.c"
      .text
      .globl  function
      .type   function, @function
  function:
  .LFB0:
      .cfi_startproc
      pushq   %rbp
      .cfi_def_cfa_offset 16
      .cfi_offset 6, -16
      movq    %rsp, %rbp
      .cfi_def_cfa_register 6
      subq    $48, %rsp
      movl    %edi, -36(%rbp)
      movl    %esi, -40(%rbp)
      movl    %edx, -44(%rbp)
      movq    %fs:40, %rax
      movq    %rax, -8(%rbp)
      xorl    %eax, %eax
      movq    -8(%rbp), %rax
      xorq    %fs:40, %rax
      je  .L2
      call    __stack_chk_fail
  .L2:
      leave
      .cfi_def_cfa 7, 8
      ret
      .cfi_endproc
  .LFE0:
      .size   function, .-function
      .globl  main
      .type   main, @function
  main:
  .LFB1:
      .cfi_startproc
      pushq   %rbp
      .cfi_def_cfa_offset 16
      .cfi_offset 6, -16
      movq    %rsp, %rbp
      .cfi_def_cfa_register 6
      movl    $3, %edx
      movl    $2, %esi
      movl    $1, %edi
      call    function
      popq    %rbp
      .cfi_def_cfa 7, 8
      ret
      .cfi_endproc
  .LFE1:
      .size   main, .-main
      .ident  "GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2"
      .section    .note.GNU-stack,"",@progbits
  </code></pre>
  
  <p>the <code>.cfi</code> directives are not in the paper by Aleph1 and I guess that they were not used back then. I have read <a href="https://stackoverflow.com/questions/2529185/what-are-cfi-directives-in-gnu-assembler-gas-used-for">this question on SO</a>  and I get that they are used by GCC for exception handling. I have also read <a href="https://stackoverflow.com/questions/5168680/questions-re-assembly-generated-from-my-c-by-gcc">another question on SO</a> and I get that .LFB0, .LFE0, .LFE1 and .LFB1 are labels however I have the following doubts:</p>
  
  <ol>
  <li>I get that .cfi directives are used for exception handling however I don't understand what they mean. I have been <a href="http://sourceware.org/binutils/docs-2.17/as/CFI-directives.html#CFI-directives" rel="noreferrer">here</a> and I see some definitions like:</li>
  </ol>
  
  <blockquote>
    <p>.cfi_def_cfa register, offset</p>
    
    <p>.cfi_def_cfa defines a rule for computing CFA as: take address from
    register and add offset to it.</p>
  </blockquote>
  
  <p>However, if you take a look at the disassembly that I have put above <em>you don't find any register name</em> (like EAX, EBX and so on) instead you find a number there (I have generally found '6') and I don't know how's that supposed to be a register. Especially, can anyone explain what <code>.cfi_def_cfa_offset 16</code>, <code>.cfi_offset 6, -16</code>, <code>.cfi_def_cfa_register 6</code> and <code>.cfi_def_cfa 7, 8</code> mean? Also, what does <code>CFA</code> mean? I am asking this because mostly in books/papers the procedure prolog is like : </p>
  
  <pre><code> pushl %ebp
   movl %esp,%ebp
   subl $20,%esp
  </code></pre>
  
  <p>However, now I think the procedure prolog in modern computers is as follows:</p>
  
  <pre><code>    .cfi_startproc
      pushq   %rbp
      .cfi_def_cfa_offset 16
      .cfi_offset 6, -16
      movq    %rsp, %rbp
      .cfi_def_cfa_register 6
      subq    $48, %rsp
  </code></pre>
  
  <p>Initially I thought that the CFI directives are used instead of <code>sub</code> mnemonic to set the offset but that's not the case; the <code>sub</code> command is still being used in spite of using the CFI directives.</p>
  
  <ol start="2">
  <li><p>I understood that there are labels for each procedure. However, why are multiple nested labels inside a procedure? In my case main has .LFB1 and .LFE2 labels. What is the need for multiple labels? Similarly the <code>function</code> procedure has the labels .LFB0, .L2 and .LFE0</p></li>
  <li><p>The last 3 lines for both the procedures seem to be used for some housekeeping functions (telling the size of the procedure, maybe?) but I am not sure what do they mean. Can anyone explain what do they mean and what's their use?</p></li>
  </ol>
  
  <p>EDIT:</p>
  
  <p>(adding one more question)</p>
  
  <ol start="4">
  <li><p>Do the CFI directives take up any space? Because in the procedure "function", each int parameter take up 4 bytes and the number of it is 3, so all parameter takes 12 bytes in memory. Next, the first <code>char</code> array takes 8 bytes (round up 5bytes to 8bytes), and next <code>char</code> array takes 12bytes (round up 10bytes to 12bytes), so the whole <code>char</code> array takes 20 bytes. Summing these all, parameter and local variables only need 12+20=32 bytes.</p>
  
  <p>But in the procedure "function", compiler subtract 48 bytes to store values. Why?</p></li>
  </ol>