After some Google and asking Mr. GPT I found out that the return address is usually stored at the allocated stack size + 8 bytes on x86. So I disassembled assignment1c and found the following assembly code: 0x0000000000401168 <+0>: push %rbp 0x0000000000401169 <+1>: mov %rsp,%rbp 0x000000000040116c <+4>: sub $0x90,%rsp 0x0000000000401173 <+11>: lea -0x90(%rbp),%rax 0x000000000040117a <+18>: mov %rax,%rdi 0x000000000040117d <+21>: call 0x401040 0x0000000000401182 <+26>: mov 0x8(%rbp),%rax 0x0000000000401186 <+30>: mov %rax,-0x8(%rbp) 0x000000000040118a <+34>: mov -0x8(%rbp),%rax 0x000000000040118e <+38>: lea 0xe7b(%rip),%rdx # 0x402010 0x0000000000401195 <+45>: mov %rax,%rsi 0x0000000000401198 <+48>: mov %rdx,%rdi 0x000000000040119b <+51>: mov $0x0,%eax 0x00000000004011a0 <+56>: call 0x401030 0x00000000004011a5 <+61>: nop 0x00000000004011a6 <+62>: leave What we can see here is that with lea we allocate a size of 0x90 = 144 bytes. So with 144 + 8 being 152, I have to write 152 'A' characters and then put in my return address. So that's how the stack-c.sh file works.