c - Where is the old EBP and return address? -

i'm having trouble understanding find ebp , return addresses. understanding, call sub made reserve space local variables within function. i'm bit confused on code in particular..

void countlines(file* f){ char buf[0x400];//should big enough int lines=0; fread(buf,readsize,1,f);    for(int i=0;i<0x400;i++)   if(buf[i] == '\n')     lines++;   printf("the number of lines in file %d\n",lines); return; } 

after disassembling function gdb, get:

0x08048484 <+0>:    push   %ebp 0x08048485 <+1>:    mov    %esp,%ebp 0x08048487 <+3>:    sub    $0x428,%esp 

why 0x428? adding local variable lengths, 0x408 (char[400], lines, , i). furthermore, ebp , return address found following reserved space?

after function prologue has executed, stack looks this:

***** ***** return address old ebp   <---- ebp ..... ..f.. ..r.. ..e..          (0x428 bytes) ..e.. .....      <---  esp 

to return function, restore esp value held in ebp, pop previous ebp stack, , call ret. in turn pop return address off stack , jump there:

mov %ebp, %esp pop %ebp ret 

(the point of keeping ebp around don't have remember how you've incremented esp during function (think alloca). don't have use ebp, though, e.g. gcc's -fomit-frame-pointer.)