ARM validator: fix sandbox escape with SP update at the end of the last bundle

src/trusted/validator_arm/validator.cc

 /*
  * Copyright (c) 2012 The Native Client Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "native_client/src/trusted/service_runtime/nacl_config.h"
 #include "native_client/src/trusted/validator_arm/model.h"
 #include "native_client/src/trusted/validator_arm/validator.h"
 #include "native_client/src/include/nacl_macros.h"
@@ skipping 703 matching lines @@
       }
 
       // Decrement the virtual address by one instruction, so the for
       // loop can bump it back forward.  This is slightly dirty.
       va -= 4;
     }
 
     pred.Copy(inst);
   }
 
+  // Validate the last instruction, paired with a nop.
+  const Instruction nop(nacl_arm_dec::kNop);
+  DecodedInstruction one_past_end(segment.end_addr(), nop,
+                                  decode_state_.decode(nop));
+  complete_success &= apply_patterns(pred, one_past_end, critical, out);
+
   return complete_success;
 }
 
 static bool address_contained(uint32_t va, const vector<CodeSegment>& segs) {
   for (vector<CodeSegment>::const_iterator it = segs.begin(); it != segs.end();
       ++it) {
     if (it->contains_address(va)) return true;
   }
   return false;
 }
@@ skipping 167 matching lines @@
                                        Instruction inst,
                                        const ClassDecoder& decoder)
     : vaddr_(vaddr),
       inst_(inst),
       decoder_(&decoder),
       safety_(decoder.safety(inst_)),
       defs_(decoder.defs(inst_))
 {}
 
 }  // namespace nacl_arm_val