title: Memory address calculation in "Smashing The Stack For Fun And Profit"
body: <p>I am reading "<a href="http://www.phrack.org/issues.html?id=14&amp;issue=49" rel="nofollow">Smashing The Stack For Fun And Profit</a>"</p>
  
  <p>In the section of "Buffer Overflows", I see this:</p>
  
  <pre><code>    0x8000490 &lt;main&gt;:       pushl  %ebp
      0x8000491 &lt;main+1&gt;:     movl   %esp,%ebp
      0x8000493 &lt;main+3&gt;:     subl   $0x4,%esp
      0x8000496 &lt;main+6&gt;:     movl   $0x0,0xfffffffc(%ebp)
      0x800049d &lt;main+13&gt;:    pushl  $0x3
      0x800049f &lt;main+15&gt;:    pushl  $0x2
      0x80004a1 &lt;main+17&gt;:    pushl  $0x1
      0x80004a3 &lt;main+19&gt;:    call   0x8000470 &lt;function&gt;
      0x80004a8 &lt;main+24&gt;:    addl   $0xc,%esp
      0x80004ab &lt;main+27&gt;:    movl   $0x1,0xfffffffc(%ebp)
      0x80004b2 &lt;main+34&gt;:    movl   0xfffffffc(%ebp),%eax
      0x80004b5 &lt;main+37&gt;:    pushl  %eax
      0x80004b6 &lt;main+38&gt;:    pushl  $0x80004f8
      0x80004bb &lt;main+43&gt;:    call   0x8000378 &lt;printf&gt;
      0x80004c0 &lt;main+48&gt;:    addl   $0x8,%esp
      0x80004c3 &lt;main+51&gt;:    movl   %ebp,%esp
      0x80004c5 &lt;main+53&gt;:    popl   %ebp
      0x80004c6 &lt;main+54&gt;:    ret
      0x80004c7 &lt;main+55&gt;:    nop
  </code></pre>
  
  <p>"We can see that when calling function() the RET will be 0x8004a8, and we
  want to jump past the assignment at 0x80004ab.  The next instruction we want
  to execute is the at 0x8004b2.  A little math tells us the distance is 8
  bytes."</p>
  
  <p>I don't get the answer here. 0x80004b2 - 0x80004ab = 7, right? Why the author says it is 8?
  Do I miss any point here? </p>