title: How it's possible that sub instruction cause invalid pointer read?
body: <p>I have a crash dump with this code:</p>
  
  <pre><code>mov     r11,rsp
  push    rdi
  sub     rsp,0A0h
  mov     qword ptr [rsp+30h],0FFFFFFFFFFFFFFFEh
  </code></pre>
  
  <p>It's a prologue of a function. So, <code>!analyze -v</code> says <code>INVALID_POINTER_READ</code> with instruction <code>sub</code>.
  AMD instructions set says that <code>sub</code> instruction cannot produce any exceptions if argument isn't a memory pointer.</p>
  
  <p>Also, <code>READ_ADDRESS</code> is <code>ffffffffffffffff</code>, but in registers window I can see that <code>rsp</code> is <code>12b3e0</code>. And this is 32-bit application in 64-bit OS.</p>
  
  <p>I want to know about a possible reasons of this error and how to fix it.</p>
  
  <p>UPD:</p>
  
  <p>Method is std._Tree.insert(const value_type&amp; _Val) in Microsoft Visual Studio 9.0\VC\include\xtree.</p>
  
  <p>Compiler is cl.exe from Visual Studio 2008 installation, 32-bit, version 15.00.30729.01.</p>
  
  <p>Command line: </p>
  
  <pre><code> /FD /EHsc /MD /GS- /Zc:wchar_t- /Yu"stdafx.h"/W3 /WX /nologo /c /Zi /TP /wd4250 /FI -Zm200 -MP -w34100 -w34189
  </code></pre>
  
  <p>Linker is from the same source, version 9.00.30729.01.</p>
  
  <p>UPD: for those who have a sceptical views on debugging 32-bit apps with 64-bit debuggers, I have ran a 32-bit version of a debugger and got the same results. So, I still think that it's <code>sub</code> instruction.  </p>
  
  <p>UPD: to clarify: the <em>application</em> is built for <em>32-bit</em> platform. But the <strong>processor</strong> and <strong>Operation System</strong> is <strong>64-bit</strong>. So, there is nothing strange that in the dump we can see 64-bit registers with 32-bit values.</p>