[HaBo]

void function(int a, int b, int c)
{
	char buffer1[5];
	char buffer2[10];
	char *ret;

	ret = buffer1 + 12;
	(*ret) += 8;
}

int main()
{
	int x;

	x = 0;
	function(1, 2, 3);
	x = 1;
	printf("%d\n", x);
}

(*ret) += <zahl>;

[martin@alpha bof] $ gdb ./a.out

(gdb)
GNU gdb Red Hat Linux (6.1post-1.20040607.41rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...(no debugging symbols found)...Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) disas main

(gdb) Dump of assembler code for function main:
0x08048386 <main+0>:	push   %ebp
0x08048387 <main+1>:	mov    %esp,%ebp
0x08048389 <main+3>:	sub    $0x8,%esp
0x0804838c <main+6>:	and    $0xfffffff0,%esp
0x0804838f <main+9>:	mov    $0x0,%eax
0x08048394 <main+14>:	add    $0xf,%eax
0x08048397 <main+17>:	add    $0xf,%eax
0x0804839a <main+20>:	shr    $0x4,%eax
0x0804839d <main+23>:	shl    $0x4,%eax
0x080483a0 <main+26>:	sub    %eax,%esp
0x080483a2 <main+28>:	movl   $0x0,0xfffffffc(%ebp)
0x080483a9 <main+35>:	push   $0x3
0x080483ab <main+37>:	push   $0x2
0x080483ad <main+39>:	push   $0x1
0x080483af <main+41>:	call   0x8048368 <function>
0x080483b4 <main+46>:	add    $0xc,%esp
0x080483b7 <main+49>:	movl   $0x1,0xfffffffc(%ebp)
0x080483be <main+56>:	sub    $0x8,%esp
0x080483c1 <main+59>:	pushl  0xfffffffc(%ebp)
0x080483c4 <main+62>:	push   $0x80484b4
0x080483c9 <main+67>:	call   0x80482b0 <_init+56>
0x080483ce <main+72>:	add    $0x10,%esp
0x080483d1 <main+75>:	leave  
0x080483d2 <main+76>:	ret    
0x080483d3 <main+77>:	nop    
End of assembler dump.
(gdb) quit

(*ret) += 8;

ret = buffer1 + ((int)(&a)-4 - (int)buffer1); 
(*ret) += 10;