2

I found x86 lea instructions in an executable file made using clang and gcc. The lea instructions are after the ret instruction as shown below.

 0x???????? <func>
   ...
   pop %ebx
   pop %ebp
   ret
   lea 0x0(%esi,%eiz,1),%esi
   lea 0x0(%edi,%eiz,1),%edi

 0x???????? <next_func>
   ...

What are these lea instructions used for? There is no jmp instruction to the lea instructions.

My environment is Ubuntu 12.04 32-bit and gcc 4.6.3.

Z boson
  • 32,619
  • 11
  • 123
  • 226
comboy
  • 21
  • 4

1 Answers1

3

It's probably not anything--it's just padding to let the next function start at an address that's probably a multiple of at least 8 (and quite possibly 16).

Depending on the rest of the code, it's possible that it's actually a table. Some implementations of a switch statement, for example, use a constant table that's often stored in the code segment (even though, strictly speaking, it's more like data than code).

The first is a lot more likely though. As an aside, such space is often filled with 0x03 instead. This is a single-byte debug-break instruction, so if some undefined behavior results in attempting to execute that code, it immediately stops execution and breaks to the debugger (if available).

Jerry Coffin
  • 476,176
  • 80
  • 629
  • 1,111