Indirect branch

For instance, based on program input, a value could be looked up in a jump table of pointers to code for handling the various cases implied by the data value.

The data value could be added to the address of the table, with the result stored in a register.

An indirect jump could then be made based on the value of that register, efficiently dispatching program control to the code appropriate to the input.

Function Pointers are typically implemented with indirect subroutine calls.

To mitigate the attack GCC 8.1 introduced the following new options: -mindirect-branch=, -mfunction-return= and -mindirect-branch-register.