Changing the return address of a function not working as expected

I recently learned about Assembly x86 and how functions are implemented in it and how the stack program works.

However, I tried writing this program which calls a function f2 by changing the return address of the current called function f1, so that the instruction pointer starts f2 when finishing f1, therefore not returning directly to main.

It seems unstable and sometimes I get segmentation fault, while in another cases it works but does not return 0.

Why is that?

My guess is that the program stack is not given a contiguous space in memory at run time and so its behavior is not constant.

Sometimes it works if a change v[2] = (uintptr_t) f2; into v[another_index_greater_than_2] = (uintptr_t) f2;.

It is odd, since in theory v[1] should be the old base pointer pushed on the stack, while v[2] should be the return address of the function.

#include <iostream>

using namespace std;

int main();

void f2()
{
    int v[1];
    cout << "f2\n";
    v[2] = (uintptr_t) main;
}

void f1()
{
    int v[1];
    cout << "f1\n";
    v[2] = (uintptr_t) f2;
}

int main()
{
    f1();
    cout << "Back to main";
    return 0;
}

I expected to see the 3 strings printed in order (f1, f2, main) and the program to return 0, but the behavior of the program seems to be random.

As @sklott said, the compiler may produce unexpected code by something like optimization. This answer assumes that it's expected output.

In the function prologue, rbp/ebp register is pushed first. Therefore, there is a pushed rbp/ebp register before the return address.
If you compile for x64, the pushed rbp register is 8-bytes but int might be 4-bytes.

In this case, you're likely overwriting the higher 4-bytes on saved rbp. Maybe it'll cause f2 won't be run, and it'll return to main. The avoided rbp will be overwritten, it'll cause segmentation fault in some cases.

Assumed stack (without canary):
+--------+----------------+------+
|rsp+0x8 |                | v[0] |
+--------+----------------+------+
|rsp+0x10| saved rbp      | v[1] |
+--------+----------------+------+
|rsp+0x18| return address | v[2] |
+--------+----------------+------+

Actual Stack (without canary):
+--------+----------------+------+
|rsp+0xc |                | v[0] |
+--------+----------------+------+
|rsp+0x10| saved rbp      | v[1] |
|rsp+0x14|                | v[2] |
+--------+----------------+------+
|rsp+0x18| return address |      |
+--------+----------------+------+

To solve it, replace int v[1] with uintptr_t v[1];.
However, (uintptr_t) main; will call f1(); again, so it'll be an infinite loop.

Note that the code won't work without adding -fno-stack-protector in GCC because canaries are enabled by default. However, since it seems to work in the question, I assume that it's added.