Merge 7712 - Ensure super instructions are marked during dynamic code modification.

src/trusted/validator/x86/ncval_reg_sfi/nc_jumps.c

 /*
  * Copyright (c) 2011 The Native Client Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 /*
  * nc_jumps.c - Validate where valid jumps can occur.
  */
 
@@ skipping 79 matching lines @@
     NaClAddressSetAddInline(jump_sets->actual_targets, to_address, state);
   }
   /* The range check may not be strictly necessary given that we have
    * guard regions around the sandbox address space, but it shouldn't
    * hurt to disallow branches that overflow or underflow the address
    * space.
    */
   else if ((to_address & state->alignment_mask) == 0 &&
            (to_address & ~(NaClPcAddress) 0xffffffff) == 0) {
     /* Allow bundle-aligned jump. */
-  }
-  else {
+  } else if (inst->unchanged) {
+    /* If we are replacing this instruction during dynamic code modification
+     * and it has not changed, the jump target must be valid because the
+     * instruction has been previously validated.  However, we may be only
+     * replacing a subsection of the code segment and therefore may not have
+     * information about instruction boundaries outside of the code being
+     * replaced. Therefore, we allow unaligned direct jumps outside of the code
+     * being validated if and only if the instruction is unchanged.
+     * If dynamic code replacement is not being performed, inst->unchanged
+     * should always be false.
+     */
+  } else {
     NaClValidatorInstMessage(LOG_ERROR, state, inst,
                              "Instruction jumps to bad address\n");
   }
 }
 
 static Bool NaClExtractBinaryOperandIndices(
     NaClInstState* inst,
     int* op_1,
     int* op_2) {
   uint32_t index;
@@ skipping 517 matching lines @@
      * the call to NaClRememberIp in JumpValidator.
      */
   } else {
     DEBUG(NaClLog(LOG_INFO,
                   "Mark instruction as jump illegal: %"NACL_PRIxNaClPcAddress
                  "\n",
                  pc));
     NaClAddressSetAddInline(state->jump_sets.removed_targets, pc, state);
   }
 }