[APP CRASH] DR Mistakenly Delivers App a Signal While Interpreting RET Instruction on Page Boundary

_From [peterfeiner](https://code.google.com/u/peterfeiner/) on July 29, 2010 15:32:44_

What steps will reproduce the problem? 1. Compile the following program on 64-bit Linux:

#include
#include
#include
#include

int main(int argc, char\* argv[]) {

// This program does two things:
// 1. Allocate two contiguous pages, the first one with RWX permissions,
// and the second one with --- permissions.
// 2. Store the following code
// mov rax, 42
// ret
// at the end of the first page (i.e., the last byte of the first
// page is a RET instruction) and call it.

unsigned char\* m =
(unsigned char*) mmap(NULL, getpagesize() \* 2, PROT_NONE,
MAP_ANONYMOUS | MAP_SHARED, -1, 0);
assert(m != MAP_FAILED);
int mprotect_result = mprotect(m, getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC);
assert(mprotect_result == 0);

unsigned char\* code = m + getpagesize() - 8;

// mov rax, 42
code[0] = 0x48;
code[1] = 0xc7;
code[2] = 0xc0;
code[3] = 0x2a;
code[4] = 0x00;
code[5] = 0x00;
code[6] = 0x00;

// ret
code[7] = 0xc3;

int x = ((int(*)(void)) code)();
printf("%d\n", x);

return 0;
}
1. Run the program under DR. I used the 64-bit debug build from revision 379 . What is the expected output? What do you see instead? The program should print 42 and exit. Instead, DR sends the application a SEGV signal, causing the application to crash:

./run.sh: line 2: 7136 Segmentation fault ../dynamorio-read-only/exports/bin64/drdeploy -debug $PWD/a.out What version of the product are you using? On what operating system? Debug build of r379 on 64-bit Ubuntu 10.04. Please provide any additional information below. Running DR under GDB shows the problematic DR code. When interpreting the RET instruction, decode_sizeof on line 481 of decode_fast.c reads one byte past the RET instruction's PC:

```
reg_opcode = (byte) (((*(pc + 1)) & 0x38) >> 3);
```

Because the byte following RET isn't readable, DR is issued a SEGV signal. DR's signal handler reasons that the application should have been sent the signal, so it sends the application a SEGV signal, causing the application to crash.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=328_