Hacker News Reader

Comment by demallien | Hacker News Reader

OK, I'm wondering if jgrahamc is sure of why that value is being overwritten in his example... According to this document (http://developer.apple.com/mac/library/DOCUMENTATION/Develop... ) there are 4 registers pushed onto the stack - ESI, EDI, EBX, and EBP - during a function call. Which means the attempt to write to ar[20] is actually blowing away a register saved on the stack by the function prolog, not an array allocated on the stack.

Of course, I've never disassembled MacOSX code, so maybe I'm forgetting something important. If anyone can correct me, I'd be very grateful!

View on HN

        .text
  .globl _a
  _a:
        pushl   %ebp
        movl    %esp, %ebp
        pushl   %esi
        subl    $100, %esp
        call    L_getpid$stub
        movl    %eax, %ecx
        movl    $1808407283, -92(%ebp)
        movl    -92(%ebp), %eax
        imull   %ecx
        sarl    $3, %edx
        movl    %ecx, %eax
        sarl    $31, %eax
        movl    %edx, %esi
        subl    %eax, %esi
        movl    %esi, -76(%ebp)
        movl    -76(%ebp), %eax
        sall    $3, %eax
        addl    -76(%ebp), %eax
        addl    %eax, %eax
        addl    -76(%ebp), %eax
        movl    %ecx, %edx
        subl    %eax, %edx
        movl    %edx, -76(%ebp)
        cmpl    $0, -76(%ebp)
        sete    %al
        movzbl  %al, %eax
        movl    %eax, 8(%ebp)
        addl    $100, %esp
        popl    %esi
        leave
        ret
  .globl _main
  _main:
        pushl   %ebp
        movl    %esp, %ebp
        subl    $72, %esp
        movl    $0, -72(%ebp)
        call    _a
        movl    -72(%ebp), %eax
        leave
        ret

Yup, guess you're sure then ;) Though out of curiousity, have you actually looked at the stack when it's running? Also, I can see ESI and EBP being pushed onto the stack, but what's the missing third value? Update: Actually, even more intriguing, why is the stack shifted by 100 bytes for the a() function??? I would have expected it to be 72, as it was for the main() function, ie 64 bytes for the ar[16] and then 8 bytes for the two registers that are pushed onto the stack.

Sigh. I'd love to actually have the time to dig out my Intel opcode books and figure it out, that would be fun, but I have to get myself back into Javascript headspace for work tomorrow morning. I wonder how many layers there are between my Javascript code and processor opcodes...

The instruction ``call _a'' pushes the address of the next instruction onto the stack.

Reply on news.ycombinator.com