Skip to content

Commit 4a42ca8

Browse files
jketemajketema
committed
C++: Limit SEH exception edges to calls in __try blocks
1 parent c7a7447 commit 4a42ca8

File tree

3 files changed

+96
-158
lines changed

3 files changed

+96
-158
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,7 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall {
364364
final override predicate mayThrowException(ExceptionEdge e) {
365365
this.mustThrowException(e)
366366
or
367-
expr.getEnclosingStmt().getParentStmt*() instanceof MicrosoftTryStmt and
367+
exists(MicrosoftTryStmt tryStmt | tryStmt.getStmt().getAChild*() = expr) and
368368
e instanceof SehExceptionEdge
369369
}
370370

‎cpp/ql/test/library-tests/ir/ir/aliased_ir.expected

Lines changed: 91 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -39097,18 +39097,10 @@ try_except.c:
3909739097
# 21| v21_3(void) = Call[ProbeFunction] : func:r21_1, 0:r21_2
3909839098
# 21| m21_4(unknown) = ^CallSideEffect : ~m18_4
3909939099
# 21| m21_5(unknown) = Chi : total:m18_4, partial:m21_4
39100-
#-----| Goto -> Block 3
39101-
#-----| SEH Exception -> Block 4
39102-
39103-
# 18| Block 1
39104-
# 18| v18_5(void) = AliasedUse : ~m26_8
39105-
# 18| v18_6(void) = ExitFunction :
39106-
39107-
# 18| Block 2
39108-
# 18| v18_7(void) = Unwind :
3910939100
#-----| Goto -> Block 1
39101+
#-----| SEH Exception -> Block 2
3911039102

39111-
# 22| Block 3
39103+
# 22| Block 1
3911239104
# 22| r22_1(glval<int>) = VariableAddress[y] :
3911339105
# 22| r22_2(int) = Load[y] : &:r22_1, m19_5
3911439106
# 22| r22_3(glval<int>) = VariableAddress[x] :
@@ -39118,24 +39110,21 @@ try_except.c:
3911839110
# 23| v23_3(void) = Call[ProbeFunction] : func:r23_1, 0:r23_2
3911939111
# 23| m23_4(unknown) = ^CallSideEffect : ~m21_5
3912039112
# 23| m23_5(unknown) = Chi : total:m21_5, partial:m23_4
39121-
#-----| Goto|SEH Exception -> Block 4
39113+
#-----| Goto|SEH Exception -> Block 2
3912239114

39123-
# 26| Block 4
39124-
# 26| m26_1(unknown) = Phi : from 0:~m21_5, from 3:~m23_5
39125-
# 26| m26_2(int) = Phi : from 0:m19_2, from 3:m22_4
39115+
# 26| Block 2
39116+
# 26| m26_1(unknown) = Phi : from 0:~m21_5, from 1:~m23_5
39117+
# 26| m26_2(int) = Phi : from 0:m19_2, from 1:m22_4
3912639118
# 26| r26_3(glval<unknown>) = FunctionAddress[sink] :
3912739119
# 26| r26_4(glval<int>) = VariableAddress[x] :
3912839120
# 26| r26_5(int) = Load[x] : &:r26_4, m26_2
3912939121
# 26| v26_6(void) = Call[sink] : func:r26_3, 0:r26_5
3913039122
# 26| m26_7(unknown) = ^CallSideEffect : ~m26_1
3913139123
# 26| m26_8(unknown) = Chi : total:m26_1, partial:m26_7
39132-
#-----| Goto -> Block 5
39133-
#-----| SEH Exception -> Block 2
39134-
39135-
# 28| Block 5
39136-
# 28| v28_1(void) = NoOp :
39137-
# 18| v18_8(void) = ReturnVoid :
39138-
#-----| Goto -> Block 1
39124+
# 28| v28_1(void) = NoOp :
39125+
# 18| v18_5(void) = ReturnVoid :
39126+
# 18| v18_6(void) = AliasedUse : ~m26_8
39127+
# 18| v18_7(void) = ExitFunction :
3913939128

3914039129
# 32| void h(int)
3914139130
# 32| Block 0
@@ -39153,66 +39142,57 @@ try_except.c:
3915339142
# 35| r35_3(int) = Constant[0] :
3915439143
# 35| r35_4(bool) = CompareNE : r35_2, r35_3
3915539144
# 35| v35_5(void) = ConditionalBranch : r35_4
39156-
#-----| False -> Block 8
39157-
#-----| True -> Block 3
39158-
39159-
# 32| Block 1
39160-
# 32| m32_7(unknown) = Phi : from 2:~m40_6, from 8:~m42_1
39161-
# 32| v32_8(void) = AliasedUse : ~m32_7
39162-
# 32| v32_9(void) = ExitFunction :
39163-
39164-
# 32| Block 2
39165-
# 32| v32_10(void) = Unwind :
39166-
#-----| Goto -> Block 1
39145+
#-----| False -> Block 6
39146+
#-----| True -> Block 1
3916739147

39168-
# 36| Block 3
39148+
# 36| Block 1
3916939149
# 36| r36_1(glval<unknown>) = FunctionAddress[AfxThrowMemoryException] :
3917039150
# 36| v36_2(void) = Call[AfxThrowMemoryException] : func:r36_1
3917139151
# 36| m36_3(unknown) = ^CallSideEffect : ~m32_4
3917239152
# 36| m36_4(unknown) = Chi : total:m32_4, partial:m36_3
39173-
#-----| Goto -> Block 8
39174-
#-----| SEH Exception -> Block 6
39153+
#-----| Goto -> Block 6
39154+
#-----| SEH Exception -> Block 4
3917539155

39176-
# 39| Block 4
39156+
# 39| Block 2
3917739157
# 39| r39_1(int) = Constant[0] :
3917839158
# 39| r39_2(bool) = CompareEQ : r39_7, r39_1
3917939159
# 39| v39_3(void) = ConditionalBranch : r39_2
39180-
#-----| False -> Block 5
39181-
#-----| True -> Block 9
39160+
#-----| False -> Block 3
39161+
#-----| True -> Block 7
3918239162

39183-
# 39| Block 5
39163+
# 39| Block 3
3918439164
# 39| r39_4(int) = Constant[1] :
3918539165
# 39| r39_5(bool) = CompareEQ : r39_7, r39_4
3918639166
# 39| v39_6(void) = ConditionalBranch : r39_5
39187-
#-----| False -> Block 9
39188-
#-----| True -> Block 7
39167+
#-----| False -> Block 7
39168+
#-----| True -> Block 5
3918939169

39190-
# 39| Block 6
39170+
# 39| Block 4
3919139171
# 39| r39_7(int) = Constant[1] :
3919239172
# 39| r39_8(int) = Constant[-1] :
3919339173
# 39| r39_9(bool) = CompareEQ : r39_7, r39_8
3919439174
# 39| v39_10(void) = ConditionalBranch : r39_9
39195-
#-----| False -> Block 4
39196-
#-----| True -> Block 9
39175+
#-----| False -> Block 2
39176+
#-----| True -> Block 7
3919739177

39198-
# 40| Block 7
39178+
# 40| Block 5
3919939179
# 40| r40_1(glval<unknown>) = FunctionAddress[sink] :
3920039180
# 40| r40_2(glval<int>) = VariableAddress[x] :
3920139181
# 40| r40_3(int) = Load[x] : &:r40_2, m33_3
3920239182
# 40| v40_4(void) = Call[sink] : func:r40_1, 0:r40_3
3920339183
# 40| m40_5(unknown) = ^CallSideEffect : ~m36_4
3920439184
# 40| m40_6(unknown) = Chi : total:m36_4, partial:m40_5
39205-
#-----| Goto -> Block 8
39206-
#-----| SEH Exception -> Block 2
39185+
#-----| Goto -> Block 6
3920739186

39208-
# 42| Block 8
39209-
# 42| m42_1(unknown) = Phi : from 0:~m32_4, from 3:~m36_4, from 7:~m40_6
39210-
# 42| v42_2(void) = NoOp :
39211-
# 32| v32_11(void) = ReturnVoid :
39212-
#-----| Goto -> Block 1
39187+
# 42| Block 6
39188+
# 42| m42_1(unknown) = Phi : from 0:~m32_4, from 1:~m36_4, from 5:~m40_6
39189+
# 42| v42_2(void) = NoOp :
39190+
# 32| v32_7(void) = ReturnVoid :
39191+
# 32| v32_8(void) = AliasedUse : ~m42_1
39192+
# 32| v32_9(void) = ExitFunction :
3921339193

39214-
# 32| Block 9
39215-
# 32| v32_12(void) = Unreached :
39194+
# 32| Block 7
39195+
# 32| v32_10(void) = Unreached :
3921639196

3921739197
try_except.cpp:
3921839198
# 6| void f_cpp()
@@ -39296,18 +39276,10 @@ try_except.cpp:
3929639276
# 21| v21_3(void) = Call[ProbeFunction] : func:r21_1, 0:r21_2
3929739277
# 21| m21_4(unknown) = ^CallSideEffect : ~m18_4
3929839278
# 21| m21_5(unknown) = Chi : total:m18_4, partial:m21_4
39299-
#-----| Goto -> Block 3
39300-
#-----| SEH Exception -> Block 4
39301-
39302-
# 18| Block 1
39303-
# 18| v18_5(void) = AliasedUse : ~m26_8
39304-
# 18| v18_6(void) = ExitFunction :
39305-
39306-
# 18| Block 2
39307-
# 18| v18_7(void) = Unwind :
3930839279
#-----| Goto -> Block 1
39280+
#-----| SEH Exception -> Block 2
3930939281

39310-
# 22| Block 3
39282+
# 22| Block 1
3931139283
# 22| r22_1(glval<int>) = VariableAddress[y] :
3931239284
# 22| r22_2(int) = Load[y] : &:r22_1, m19_5
3931339285
# 22| r22_3(glval<int>) = VariableAddress[x] :
@@ -39317,24 +39289,21 @@ try_except.cpp:
3931739289
# 23| v23_3(void) = Call[ProbeFunction] : func:r23_1, 0:r23_2
3931839290
# 23| m23_4(unknown) = ^CallSideEffect : ~m21_5
3931939291
# 23| m23_5(unknown) = Chi : total:m21_5, partial:m23_4
39320-
#-----| Goto|SEH Exception -> Block 4
39292+
#-----| Goto|SEH Exception -> Block 2
3932139293

39322-
# 26| Block 4
39323-
# 26| m26_1(unknown) = Phi : from 0:~m21_5, from 3:~m23_5
39324-
# 26| m26_2(int) = Phi : from 0:m19_2, from 3:m22_4
39294+
# 26| Block 2
39295+
# 26| m26_1(unknown) = Phi : from 0:~m21_5, from 1:~m23_5
39296+
# 26| m26_2(int) = Phi : from 0:m19_2, from 1:m22_4
3932539297
# 26| r26_3(glval<unknown>) = FunctionAddress[sink] :
3932639298
# 26| r26_4(glval<int>) = VariableAddress[x] :
3932739299
# 26| r26_5(int) = Load[x] : &:r26_4, m26_2
3932839300
# 26| v26_6(void) = Call[sink] : func:r26_3, 0:r26_5
3932939301
# 26| m26_7(unknown) = ^CallSideEffect : ~m26_1
3933039302
# 26| m26_8(unknown) = Chi : total:m26_1, partial:m26_7
39331-
#-----| Goto -> Block 5
39332-
#-----| SEH Exception -> Block 2
39333-
39334-
# 28| Block 5
39335-
# 28| v28_1(void) = NoOp :
39336-
# 18| v18_8(void) = ReturnVoid :
39337-
#-----| Goto -> Block 1
39303+
# 28| v28_1(void) = NoOp :
39304+
# 18| v18_5(void) = ReturnVoid :
39305+
# 18| v18_6(void) = AliasedUse : ~m26_8
39306+
# 18| v18_7(void) = ExitFunction :
3933839307

3933939308
# 32| void h_cpp(int)
3934039309
# 32| Block 0
@@ -39352,66 +39321,57 @@ try_except.cpp:
3935239321
# 35| r35_3(int) = Constant[0] :
3935339322
# 35| r35_4(bool) = CompareNE : r35_2, r35_3
3935439323
# 35| v35_5(void) = ConditionalBranch : r35_4
39355-
#-----| False -> Block 8
39356-
#-----| True -> Block 3
39357-
39358-
# 32| Block 1
39359-
# 32| m32_7(unknown) = Phi : from 2:~m40_6, from 8:~m42_1
39360-
# 32| v32_8(void) = AliasedUse : ~m32_7
39361-
# 32| v32_9(void) = ExitFunction :
39362-
39363-
# 32| Block 2
39364-
# 32| v32_10(void) = Unwind :
39365-
#-----| Goto -> Block 1
39324+
#-----| False -> Block 6
39325+
#-----| True -> Block 1
3936639326

39367-
# 36| Block 3
39327+
# 36| Block 1
3936839328
# 36| r36_1(glval<unknown>) = FunctionAddress[AfxThrowMemoryException] :
3936939329
# 36| v36_2(void) = Call[AfxThrowMemoryException] : func:r36_1
3937039330
# 36| m36_3(unknown) = ^CallSideEffect : ~m32_4
3937139331
# 36| m36_4(unknown) = Chi : total:m32_4, partial:m36_3
39372-
#-----| Goto -> Block 8
39373-
#-----| SEH Exception -> Block 6
39332+
#-----| Goto -> Block 6
39333+
#-----| SEH Exception -> Block 4
3937439334

39375-
# 39| Block 4
39335+
# 39| Block 2
3937639336
# 39| r39_1(int) = Constant[0] :
3937739337
# 39| r39_2(bool) = CompareEQ : r39_7, r39_1
3937839338
# 39| v39_3(void) = ConditionalBranch : r39_2
39379-
#-----| False -> Block 5
39380-
#-----| True -> Block 9
39339+
#-----| False -> Block 3
39340+
#-----| True -> Block 7
3938139341

39382-
# 39| Block 5
39342+
# 39| Block 3
3938339343
# 39| r39_4(int) = Constant[1] :
3938439344
# 39| r39_5(bool) = CompareEQ : r39_7, r39_4
3938539345
# 39| v39_6(void) = ConditionalBranch : r39_5
39386-
#-----| False -> Block 9
39387-
#-----| True -> Block 7
39346+
#-----| False -> Block 7
39347+
#-----| True -> Block 5
3938839348

39389-
# 39| Block 6
39349+
# 39| Block 4
3939039350
# 39| r39_7(int) = Constant[1] :
3939139351
# 39| r39_8(int) = Constant[-1] :
3939239352
# 39| r39_9(bool) = CompareEQ : r39_7, r39_8
3939339353
# 39| v39_10(void) = ConditionalBranch : r39_9
39394-
#-----| False -> Block 4
39395-
#-----| True -> Block 9
39354+
#-----| False -> Block 2
39355+
#-----| True -> Block 7
3939639356

39397-
# 40| Block 7
39357+
# 40| Block 5
3939839358
# 40| r40_1(glval<unknown>) = FunctionAddress[sink] :
3939939359
# 40| r40_2(glval<int>) = VariableAddress[x] :
3940039360
# 40| r40_3(int) = Load[x] : &:r40_2, m33_3
3940139361
# 40| v40_4(void) = Call[sink] : func:r40_1, 0:r40_3
3940239362
# 40| m40_5(unknown) = ^CallSideEffect : ~m36_4
3940339363
# 40| m40_6(unknown) = Chi : total:m36_4, partial:m40_5
39404-
#-----| Goto -> Block 8
39405-
#-----| SEH Exception -> Block 2
39364+
#-----| Goto -> Block 6
3940639365

39407-
# 42| Block 8
39408-
# 42| m42_1(unknown) = Phi : from 0:~m32_4, from 3:~m36_4, from 7:~m40_6
39409-
# 42| v42_2(void) = NoOp :
39410-
# 32| v32_11(void) = ReturnVoid :
39411-
#-----| Goto -> Block 1
39366+
# 42| Block 6
39367+
# 42| m42_1(unknown) = Phi : from 0:~m32_4, from 1:~m36_4, from 5:~m40_6
39368+
# 42| v42_2(void) = NoOp :
39369+
# 32| v32_7(void) = ReturnVoid :
39370+
# 32| v32_8(void) = AliasedUse : ~m42_1
39371+
# 32| v32_9(void) = ExitFunction :
3941239372

39413-
# 32| Block 9
39414-
# 32| v32_12(void) = Unreached :
39373+
# 32| Block 7
39374+
# 32| v32_10(void) = Unreached :
3941539375

3941639376
# 44| void throw_cpp(int)
3941739377
# 44| Block 0
@@ -39429,62 +39389,53 @@ try_except.cpp:
3942939389
# 47| r47_3(int) = Constant[0] :
3943039390
# 47| r47_4(bool) = CompareNE : r47_2, r47_3
3943139391
# 47| v47_5(void) = ConditionalBranch : r47_4
39432-
#-----| False -> Block 8
39433-
#-----| True -> Block 3
39434-
39435-
# 44| Block 1
39436-
# 44| m44_7(unknown) = Phi : from 2:~m52_6, from 8:~m54_1
39437-
# 44| v44_8(void) = AliasedUse : ~m44_7
39438-
# 44| v44_9(void) = ExitFunction :
39439-
39440-
# 44| Block 2
39441-
# 44| v44_10(void) = Unwind :
39442-
#-----| Goto -> Block 1
39392+
#-----| False -> Block 6
39393+
#-----| True -> Block 1
3944339394

39444-
# 48| Block 3
39395+
# 48| Block 1
3944539396
# 48| r48_1(glval<int>) = VariableAddress[#throw48:13] :
3944639397
# 48| r48_2(int) = Constant[1] :
3944739398
# 48| m48_3(int) = Store[#throw48:13] : &:r48_1, r48_2
3944839399
# 48| v48_4(void) = ThrowValue : &:r48_1, m48_3
39449-
#-----| C++ Exception -> Block 6
39400+
#-----| C++ Exception -> Block 4
3945039401

39451-
# 51| Block 4
39402+
# 51| Block 2
3945239403
# 51| r51_1(int) = Constant[0] :
3945339404
# 51| r51_2(bool) = CompareEQ : r51_7, r51_1
3945439405
# 51| v51_3(void) = ConditionalBranch : r51_2
39455-
#-----| False -> Block 5
39456-
#-----| True -> Block 9
39406+
#-----| False -> Block 3
39407+
#-----| True -> Block 7
3945739408

39458-
# 51| Block 5
39409+
# 51| Block 3
3945939410
# 51| r51_4(int) = Constant[1] :
3946039411
# 51| r51_5(bool) = CompareEQ : r51_7, r51_4
3946139412
# 51| v51_6(void) = ConditionalBranch : r51_5
39462-
#-----| False -> Block 9
39463-
#-----| True -> Block 7
39413+
#-----| False -> Block 7
39414+
#-----| True -> Block 5
3946439415

39465-
# 51| Block 6
39416+
# 51| Block 4
3946639417
# 51| r51_7(int) = Constant[1] :
3946739418
# 51| r51_8(int) = Constant[-1] :
3946839419
# 51| r51_9(bool) = CompareEQ : r51_7, r51_8
3946939420
# 51| v51_10(void) = ConditionalBranch : r51_9
39470-
#-----| False -> Block 4
39471-
#-----| True -> Block 9
39421+
#-----| False -> Block 2
39422+
#-----| True -> Block 7
3947239423

39473-
# 52| Block 7
39424+
# 52| Block 5
3947439425
# 52| r52_1(glval<unknown>) = FunctionAddress[sink] :
3947539426
# 52| r52_2(glval<int>) = VariableAddress[x] :
3947639427
# 52| r52_3(int) = Load[x] : &:r52_2, m45_3
3947739428
# 52| v52_4(void) = Call[sink] : func:r52_1, 0:r52_3
3947839429
# 52| m52_5(unknown) = ^CallSideEffect : ~m44_4
3947939430
# 52| m52_6(unknown) = Chi : total:m44_4, partial:m52_5
39480-
#-----| Goto -> Block 8
39481-
#-----| SEH Exception -> Block 2
39431+
#-----| Goto -> Block 6
3948239432

39483-
# 54| Block 8
39484-
# 54| m54_1(unknown) = Phi : from 0:~m44_4, from 7:~m52_6
39485-
# 54| v54_2(void) = NoOp :
39486-
# 44| v44_11(void) = ReturnVoid :
39487-
#-----| Goto -> Block 1
39433+
# 54| Block 6
39434+
# 54| m54_1(unknown) = Phi : from 0:~m44_4, from 5:~m52_6
39435+
# 54| v54_2(void) = NoOp :
39436+
# 44| v44_7(void) = ReturnVoid :
39437+
# 44| v44_8(void) = AliasedUse : ~m54_1
39438+
# 44| v44_9(void) = ExitFunction :
3948839439

39489-
# 44| Block 9
39490-
# 44| v44_12(void) = Unreached :
39440+
# 44| Block 7
39441+
# 44| v44_10(void) = Unreached :

0 commit comments

Comments
 (0)