Trampoline failures

[p5-vbnekit]

Hi. May be it's same as x64 trampoline fail #15, but i'm not sure =)

Background

I tried to install hook on x86_64.elf shared object function and was disappointed with error #75 (EOVERFLOW). Next i tried to use SUBHOOK_64BIT_OFFSET flag and it became another grief for me. =)

Point of my problems

As i see subhook trampoline calls raises undefined undefined behaviour [always SIGSEGV? not sure] in two cases:

1. under x86_64 with SUBHOOK_64BIT_OFFSET

(gdb) run
Starting program: /tmp/build/subhook-trampoline-test/x86_64-desktop/debug/test 
main: hook = 0x555555570e70
main: executing foo...
foo: value = 1
main: hook installed
main: executing foo...
foo_replacement: value = 1, trampoline = 0
main: trampoline = 0x555555570ee0
main: executing foo...
foo_replacement: value = 1, trampoline = 0x555555570ee0
foo_replacement: executing trampoline [0x555555570ee0]...

Program received signal SIGSEGV, Segmentation fault.
0x0000555555570eec in ?? ()
(gdb) bt
#0  0x0000555555570eec in ?? ()
#1  0x0000000000000000 in ?? ()
(gdb) generate-core-file 
Saved corefile core.15694

core.15694.gz

2. under x86 with size-optimized foo function build (gcc "-Os" flag)

(gdb) run
Starting program: /tmp/build/subhook-trampoline-test/x86-desktop/release+min_size/test 
main: hook = 0x56560b70
main: executing foo...
foo: value = 1
main: hook installed
main: executing foo...
foo_replacement: value = 1, trampoline = 0
main: trampoline = 0x56560bb0
main: executing foo...
foo_replacement: value = 1, trampoline = 0x56560bb0
foo_replacement: executing trampoline [0x56560bb0]...

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xf7fc5273 in foo () from /tmp/build/subhook-trampoline-test/x86-desktop/release+min_size/libfoo.so
#2  0x5655784a in foo_replacement(int) ()
#3  0x56557ff2 in routine() ()
#4  0x56557294 in main ()
(gdb) generate-core-file 
Saved corefile core.15628

core.15628.gz

Test project on github

I published a test project on github to demonstrate this problem. Please check it.

Can you fix this bugs?
Thanks a lot!

[Zeex]

I think this bug is fixed now. Trampline code should be allocated within 32-bit address space of the process.