Mysterious printf argument when disassembling c program

So I have this c code:

#include <stdio.h>

int main(void)
{
int a;
int b;
int c;

a=b=c=5;

printf("Hi%d%d%dHi",a,b,c);
}

I compiled it on ubuntu with:

gcc program.c -o program -ggdb -m32 -O2

And then disassembled it with:

objdump -M intel program -d

And in main printf() gets called like this:

mov DWORD PTR [esp+0x10],0x5
mov DWORD PTR [esp+0xc],0x5
mov DWORD PTR [esp+0x8],0x5
mov DWORD PTR [esp+0x4],0x8048500
mov DWORD PTR [esp],0x1
call 8048330 <__printf_chk@plt>

What I am wondering right now is what this means:

mov DWORD PTR [esp],0x1

I know what the first 4 mov instructions are for, but I just can't figure out why a '1' gets pushed onto the stack. Also this mov only occurs when optimization is turned on. Any ideas?

The GNU C library (glibc) will use `__printf_chk` instead of `printf` if you (or the the compiler) defines `_FORTIFY_SOURCE` and optimization is enabled. The `_chk` version of the function behaves just like the function it replaces except it's supposed to [check for stack overflow][1] and maybe validate the arguments. The extra first argument indicates how much checking and validation should occur.

Looking at the [actual glibc implmenation][2] it appears that doesn't do any additional stack checking over what the compiler automatic provides (and so shouldn't be necessary) and the validation of arguments is very minimal. It will check that `%n` only appears on read-only format strings, and checks that if the special <code>%<i>m</i>$</code> argument specifiers are used that they're used for all arguments without any gaps.


[1]:

[To see links please register here]

[2]:

[To see links please register here]