Index: src/trusted/validator/x86/ncval_reg_sfi/nc_jumps.c |
=================================================================== |
--- src/trusted/validator/x86/ncval_reg_sfi/nc_jumps.c (revision 7726) |
+++ src/trusted/validator/x86/ncval_reg_sfi/nc_jumps.c (working copy) |
@@ -97,8 +97,18 @@ |
else if ((to_address & state->alignment_mask) == 0 && |
(to_address & ~(NaClPcAddress) 0xffffffff) == 0) { |
/* Allow bundle-aligned jump. */ |
- } |
- else { |
+ } else if (inst->unchanged) { |
+ /* If we are replacing this instruction during dynamic code modification |
+ * and it has not changed, the jump target must be valid because the |
+ * instruction has been previously validated. However, we may be only |
+ * replacing a subsection of the code segment and therefore may not have |
+ * information about instruction boundaries outside of the code being |
+ * replaced. Therefore, we allow unaligned direct jumps outside of the code |
+ * being validated if and only if the instruction is unchanged. |
+ * If dynamic code replacement is not being performed, inst->unchanged |
+ * should always be false. |
+ */ |
+ } else { |
NaClValidatorInstMessage(LOG_ERROR, state, inst, |
"Instruction jumps to bad address\n"); |
} |