стек. перезапись адреса возврата

Привет!

Пытаюсь читать smashing the stack for fun and profit, и нифига не работает первый пример. 

#include <stdio.h>

void function(int a, int b, int c) {
    char buffer1[5];
    char buffer2[10];
    int *ret;
    
    ret = buffer1+12;
    (*ret) += 8;
}
    
void main() {
    int x;
    
    x = 0;
    function(1,2,3);
    x = 1;
    printf("%d\n",x);
}

вот кадр function:

(gdb) info frame
Stack level 0, frame at 0xbffffba0:
 eip = 0x8048393 in function (ex1.c:9); saved eip 0x80483d5
 called by frame at 0xbffffbc0
 source language c.
 Arglist at 0xbffffb98, args: a=1, b=2, c=3
 Locals at 0xbffffb98, Previous frame's sp is 0xbffffba0
 Saved registers:
  ebp at 0xbffffb98, eip at 0xbffffb9c
(gdb) 

--

Dump of assembler code for function function:
    0x08048384 <function+0>:        push   %ebp
    0x08048385 <function+1>:        mov    %esp,%ebp
    0x08048387 <function+3>:        sub    $0x38,%esp
    0x0804838a <function+6>:        lea    0xffffffe8(%ebp),%eax
    0x0804838d <function+9>:        add    $0xc,%eax
    0x08048390 <function+12>:       mov    %eax,0xffffffd4(%ebp)
    0x08048393 <function+15>:       mov    0xffffffd4(%ebp),%edx
    0x08048396 <function+18>:       mov    0xffffffd4(%ebp),%eax
    0x08048399 <function+21>:       mov    (%eax),%eax
    0x0804839b <function+23>:       add    $0x8,%eax
    0x0804839e <function+26>:       mov    %eax,(%edx)
    0x080483a0 <function+28>:       leave  
    0x080483a1 <function+29>:       ret    
End of assembler dump.

Dump of assembler code for function main:
    0x080483a2 <main+0>:    push   %ebp
    0x080483a3 <main+1>:    mov    %esp,%ebp
    0x080483a5 <main+3>:    sub    $0x18,%esp
    0x080483a8 <main+6>:    and    $0xfffffff0,%esp
    0x080483ab <main+9>:    mov    $0x0,%eax
    0x080483b0 <main+14>:   sub    %eax,%esp
    0x080483b2 <main+16>:   movl   $0x0,0xfffffffc(%ebp)
    0x080483b9 <main+23>:   movl   $0x3,0x8(%esp)
    0x080483c1 <main+31>:   movl   $0x2,0x4(%esp)
    0x080483c9 <main+39>:   movl   $0x1,(%esp)
    0x080483d0 <main+46>:   call   0x8048384 <function>
    0x080483d5 <main+51>:   movl   $0x1,0xfffffffc(%ebp)
    0x080483dc <main+58>:   mov    0xfffffffc(%ebp),%eax
    0x080483df <main+61>:   mov    %eax,0x4(%esp)
    0x080483e3 <main+65>:   movl   $0x8048514,(%esp)
    0x080483ea <main+72>:   call   0x80482b0 <_init+56>
    0x080483ef <main+77>:   leave  
    0x080483f0 <main+78>:   ret    
End of assembler dump.

Если выравнивание идет по 4 байта. То почему в function gcc выделяет
$0x38 ?