Skip to content

Generated binary crashes for varargs compiled with icc

To save the xmm registers to the varargs list, the icc uses a register indirect jump that zipr does not recognize. This can lead to crashing generated binaries since the possible jump targets are not registered and may be distributed to different locations. The assembly roughly looks like this:

lea     rsi, ds:0[rdi*4]
mov     eax, offset loc_50A13D
sub     rax, rsi
jmp     rax
movaps  xmmword ptr [rcx-0Fh], xmm7
movaps  xmmword ptr [rcx-1Fh], xmm6
movaps  xmmword ptr [rcx-2Fh], xmm5
movaps  xmmword ptr [rcx-3Fh], xmm4
movaps  xmmword ptr [rcx-4Fh], xmm3
movaps  xmmword ptr [rcx-5Fh], xmm2
movaps  xmmword ptr [rcx-6Fh], xmm1
movaps  xmmword ptr [rcx-7Fh], xmm0
loc_50A13D:
...

The crash of the executable then happens when the jump goes somewhere in the middle of the xmm store section, as loc_50A13D is correctly identified as a possible jump target.

Since I do not have the icc compiler, I can currently not offer a minimal crashing example (I only have some large executables with inputs that lead to a segfault due to this bug). An example of the how generated code can look like with a generic vararg function:

Edited by Andreas Wendler