Writing after the ret address slot is causing the segfault because you are writing the address of touch2 in the caller's frame. The address of touch2 should be pushed to the stack from inside the buffer so that it ends up at where address of buff[0] was i.e the ret address slot.