title: How c program assign memory for local variable
body: <p>See below simple example code:</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  
  void dumpmem(unsigned char* p,int len,const char* desc) {
    printf("\nvar:%s\n",desc);
    printf("content:%s\n",p);
    p = p + len - 1;
    for (int i=0;i&lt;len;i++) {
        printf("----%p -&gt; %c(%02x)\n",p,*p,*p);
        p--;
    }
  }
  #define SIZE 6 
  int main(void) {
    unsigned char s1[SIZE];
    unsigned char s2[SIZE];
    unsigned char s3[27] = "abcdefghijklmnopqrstuvwxyz";
    unsigned char* p = (unsigned char*)&amp;s1;
    unsigned char* q = (unsigned char*)(&amp;s1+1);
    dumpmem(s3,27,"s3");   
    sscanf((const char*)s3,"%s",s2);
    dumpmem(s1,SIZE,"s1");   
    dumpmem(s2,SIZE,"s2");   
    dumpmem(s3,27,"s3");   
    return 0;
  }
  </code></pre>
  
  <p>The output is:</p>
  
  <pre><code>var:s3
  content:abcdefghijklmnopqrstuvwxyz
  ----0x7fff5bcc66ea -&gt; (00)
  ----0x7fff5bcc66e9 -&gt; z(7a)
  ----0x7fff5bcc66e8 -&gt; y(79)
  ----0x7fff5bcc66e7 -&gt; x(78)
  ----0x7fff5bcc66e6 -&gt; w(77)
  ----0x7fff5bcc66e5 -&gt; v(76)
  ----0x7fff5bcc66e4 -&gt; u(75)
  ----0x7fff5bcc66e3 -&gt; t(74)
  ----0x7fff5bcc66e2 -&gt; s(73)
  ----0x7fff5bcc66e1 -&gt; r(72)
  ----0x7fff5bcc66e0 -&gt; q(71)
  ----0x7fff5bcc66df -&gt; p(70)
  ----0x7fff5bcc66de -&gt; o(6f)
  ----0x7fff5bcc66dd -&gt; n(6e)
  ----0x7fff5bcc66dc -&gt; m(6d)
  ----0x7fff5bcc66db -&gt; l(6c)
  ----0x7fff5bcc66da -&gt; k(6b)
  ----0x7fff5bcc66d9 -&gt; j(6a)
  ----0x7fff5bcc66d8 -&gt; i(69)
  ----0x7fff5bcc66d7 -&gt; h(68)
  ----0x7fff5bcc66d6 -&gt; g(67)
  ----0x7fff5bcc66d5 -&gt; f(66)
  ----0x7fff5bcc66d4 -&gt; e(65)
  ----0x7fff5bcc66d3 -&gt; d(64)
  ----0x7fff5bcc66d2 -&gt; c(63)
  ----0x7fff5bcc66d1 -&gt; b(62)
  ----0x7fff5bcc66d0 -&gt; a(61)
  
  var:s1
  content:ghijklmnopqrstuvwxyz
  ----0x7fff5bcc66cb -&gt; l(6c)
  ----0x7fff5bcc66ca -&gt; k(6b)
  ----0x7fff5bcc66c9 -&gt; j(6a)
  ----0x7fff5bcc66c8 -&gt; i(69)
  ----0x7fff5bcc66c7 -&gt; h(68)
  ----0x7fff5bcc66c6 -&gt; g(67)
  
  var:s2
  content:abcdefghijklmnopqrstuvwxyz
  ----0x7fff5bcc66c5 -&gt; f(66)
  ----0x7fff5bcc66c4 -&gt; e(65)
  ----0x7fff5bcc66c3 -&gt; d(64)
  ----0x7fff5bcc66c2 -&gt; c(63)
  ----0x7fff5bcc66c1 -&gt; b(62)
  ----0x7fff5bcc66c0 -&gt; a(61)
  
  var:s3
  content:qrstuvwxyz
  ----0x7fff5bcc66ea -&gt; (00)
  ----0x7fff5bcc66e9 -&gt; z(7a)
  ----0x7fff5bcc66e8 -&gt; y(79)
  ----0x7fff5bcc66e7 -&gt; x(78)
  ----0x7fff5bcc66e6 -&gt; w(77)
  ----0x7fff5bcc66e5 -&gt; v(76)
  ----0x7fff5bcc66e4 -&gt; u(75)
  ----0x7fff5bcc66e3 -&gt; t(74)
  ----0x7fff5bcc66e2 -&gt; s(73)
  ----0x7fff5bcc66e1 -&gt; r(72)
  ----0x7fff5bcc66e0 -&gt; q(71)
  ----0x7fff5bcc66df -&gt; p(70)
  ----0x7fff5bcc66de -&gt; o(6f)
  ----0x7fff5bcc66dd -&gt; n(6e)
  ----0x7fff5bcc66dc -&gt; m(6d)
  ----0x7fff5bcc66db -&gt; l(6c)
  ----0x7fff5bcc66da -&gt; (00)
  ----0x7fff5bcc66d9 -&gt; z(7a)
  ----0x7fff5bcc66d8 -&gt; y(79)
  ----0x7fff5bcc66d7 -&gt; x(78)
  ----0x7fff5bcc66d6 -&gt; w(77)
  ----0x7fff5bcc66d5 -&gt; v(76)
  ----0x7fff5bcc66d4 -&gt; u(75)
  ----0x7fff5bcc66d3 -&gt; t(74)
  ----0x7fff5bcc66d2 -&gt; s(73)
  ----0x7fff5bcc66d1 -&gt; r(72)
  ----0x7fff5bcc66d0 -&gt; q(71)
  </code></pre>
  
  <p>Obviously, sscanf has overflow so data filled in s1 and s3 wrongly.</p>
  
  <p>Check the memory address for s1,s2,s3, it seems OS assign it as below:</p>
  
  <pre><code>s3 [0x...de,0x...ea]
  ...garbage data here
  s1 [0x...c6,0x...cb]
  s2 [0x...c0,0x...c5]
  </code></pre>
  
  <p>But I define it as s1 then s2 then s3, why not it assign memory as:</p>
  
  <pre><code>s1 [0x...c6,0x...cb]
  s2 [0x...c0,0x...c5]
  s3 [0x...a5,0x...bf]
  </code></pre>
  
  <p>Questions:</p>
  
  <ol>
  <li>Why s3 assigned address above s1?</li>
  <li>Why some data inserted between s3 and s1?</li>
  </ol>