While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the stack.
In that case, the stack's binary isn't randomized, so there is a NULL DWORD at 0xbffffffc (0xc0000000 - 4). Then normally goes the program's name towards low addresses. So one would read into the stack:
./program_name\0 + NULL DWORD
But I'm finding two dwords when I check this out with gdb:
(gdb) x/4x 0xc0000000 - 0x10 0xbffffff0: 0x5f747365 0x00766e65 0x00000000 0x0000000
I can see that there's the end of my program name (plus the \0 as well) but shouldn't it end at 0xbffffffc instead of 0xbffffff8? There are two nul dwords instead of one, and I cannot understand why.