Zeex/samp-plugin-jit

JIT Sleep: ExecContHelper tries to jump to null address.

Opened this issue · 2 comments

Seems that jump_lookup_label_ returns 0 and it tries to use that

asm_.call(jump_lookup_label_);
asm_.mov(edx, eax); // address
asm_.mov(eax, dword_ptr(esi, offsetof(AMX, pri)));
asm_.mov(ecx, dword_ptr(esi, offsetof(AMX, alt)));
asm_.jmp(edx);

imagen

Server crashes after this

Seems that the 0 comes from the GetJITInstrPtr function. This check fails and makes it return 0:

if (result != last && result->address == address) {
return result->ptr;
}
return 0;
}

imagen

By the way, there's a previous ExecContHelper that gets executed seemingly fine, the 2nd one is the one that crashes.

Zeex commented

It looks like some code tried to jump to an invalid AMX code address, i.e. address that does not directly match any native/JIT instruction recorded in the instr_table.