Skip to content

Commit 9d6a1a9

Browse files
jketemajketema
committed
C++: Generate SEH edges for pointer dereference loads in __try blocks
1 parent 3eb768c commit 9d6a1a9

File tree

3 files changed

+85
-59
lines changed

3 files changed

+85
-59
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -400,7 +400,14 @@ class TranslatedLoad extends TranslatedValueCategoryAdjustment, TTranslatedLoad
400400

401401
override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
402402
tag = LoadTag() and
403-
result = this.getParent().getChildSuccessor(this, kind)
403+
(
404+
result = this.getParent().getChildSuccessor(this, kind)
405+
or
406+
expr instanceof PointerDereferenceExpr and
407+
kind instanceof SehExceptionEdge and
408+
exists(MicrosoftTryStmt tryStmt | tryStmt.getStmt() = expr.getEnclosingStmt().getParent*()) and
409+
result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e))
410+
)
404411
}
405412

406413
override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {

‎cpp/ql/test/library-tests/ir/ir/aliased_ir.expected‎

Lines changed: 48 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -39290,70 +39290,81 @@ try_except.c:
3929039290
# 59| r59_1(glval<int *>) = VariableAddress[b] :
3929139291
# 59| r59_2(int *) = Load[b] : &:r59_1, m56_6
3929239292
# 59| r59_3(int) = Load[?] : &:r59_2, ~m56_8
39293-
# 59| r59_4(glval<int>) = VariableAddress[x] :
39294-
# 59| m59_5(int) = Store[x] : &:r59_4, r59_3
39295-
# 60| r60_1(glval<int>) = VariableAddress[x] :
39296-
# 60| r60_2(int) = Load[x] : &:r60_1, m59_5
39297-
# 60| r60_3(glval<int *>) = VariableAddress[c] :
39298-
# 60| r60_4(int *) = Load[c] : &:r60_3, m56_10
39299-
# 60| r60_5(glval<int>) = CopyValue : r60_4
39300-
# 60| m60_6(int) = Store[?] : &:r60_5, r60_2
39301-
# 60| m60_7(unknown) = Chi : total:m56_12, partial:m60_6
3930239293
#-----| Goto -> Block 1
39303-
#-----| SEH Exception -> Block 4
39294+
#-----| SEH Exception -> Block 6
39295+
39296+
# 59| Block 1
39297+
# 59| r59_4(glval<int>) = VariableAddress[x] :
39298+
# 59| m59_5(int) = Store[x] : &:r59_4, r59_3
39299+
# 60| r60_1(glval<int>) = VariableAddress[x] :
39300+
# 60| r60_2(int) = Load[x] : &:r60_1, m59_5
39301+
# 60| r60_3(glval<int *>) = VariableAddress[c] :
39302+
# 60| r60_4(int *) = Load[c] : &:r60_3, m56_10
39303+
# 60| r60_5(glval<int>) = CopyValue : r60_4
39304+
# 60| m60_6(int) = Store[?] : &:r60_5, r60_2
39305+
# 60| m60_7(unknown) = Chi : total:m56_12, partial:m60_6
39306+
#-----| Goto -> Block 2
39307+
#-----| SEH Exception -> Block 6
3930439308

39305-
# 61| Block 1
39309+
# 61| Block 2
3930639310
# 61| r61_1(glval<int>) = VariableAddress[y] :
3930739311
# 61| r61_2(glval<int *>) = VariableAddress[d] :
3930839312
# 61| r61_3(int *) = Load[d] : &:r61_2, m56_14
3930939313
# 61| r61_4(int) = Load[?] : &:r61_3, ~m56_16
39310-
# 61| m61_5(int) = Store[y] : &:r61_1, r61_4
39311-
#-----| Goto -> Block 6
39314+
#-----| Goto -> Block 3
39315+
#-----| SEH Exception -> Block 6
39316+
39317+
# 61| Block 3
39318+
# 61| m61_5(int) = Store[y] : &:r61_1, r61_4
39319+
#-----| Goto -> Block 8
3931239320

39313-
# 63| Block 2
39321+
# 63| Block 4
3931439322
# 63| r63_1(int) = Constant[0] :
39315-
# 63| r63_2(bool) = CompareEQ : r63_7, r63_1
39323+
# 63| r63_2(bool) = CompareEQ : r63_9, r63_1
3931639324
# 63| v63_3(void) = ConditionalBranch : r63_2
39317-
#-----| False -> Block 3
39318-
#-----| True -> Block 7
39325+
#-----| False -> Block 5
39326+
#-----| True -> Block 9
3931939327

39320-
# 63| Block 3
39328+
# 63| Block 5
3932139329
# 63| r63_4(int) = Constant[1] :
39322-
# 63| r63_5(bool) = CompareEQ : r63_7, r63_4
39330+
# 63| r63_5(bool) = CompareEQ : r63_9, r63_4
3932339331
# 63| v63_6(void) = ConditionalBranch : r63_5
39324-
#-----| False -> Block 7
39325-
#-----| True -> Block 5
39326-
39327-
# 63| Block 4
39328-
# 63| r63_7(int) = Constant[1] :
39329-
# 63| r63_8(int) = Constant[-1] :
39330-
# 63| r63_9(bool) = CompareEQ : r63_7, r63_8
39331-
# 63| v63_10(void) = ConditionalBranch : r63_9
39332-
#-----| False -> Block 2
39332+
#-----| False -> Block 9
3933339333
#-----| True -> Block 7
3933439334

39335-
# 64| Block 5
39335+
# 63| Block 6
39336+
# 63| m63_7(unknown) = Phi : from 0:m56_12, from 1:m60_7, from 2:m60_7
39337+
# 63| m63_8(int) = Phi : from 0:m57_3, from 1:m59_5, from 2:m59_5
39338+
# 63| r63_9(int) = Constant[1] :
39339+
# 63| r63_10(int) = Constant[-1] :
39340+
# 63| r63_11(bool) = CompareEQ : r63_9, r63_10
39341+
# 63| v63_12(void) = ConditionalBranch : r63_11
39342+
#-----| False -> Block 4
39343+
#-----| True -> Block 9
39344+
39345+
# 64| Block 7
3933639346
# 64| r64_1(glval<unknown>) = FunctionAddress[sink] :
3933739347
# 64| r64_2(glval<int>) = VariableAddress[x] :
39338-
# 64| r64_3(int) = Load[x] : &:r64_2, m59_5
39348+
# 64| r64_3(int) = Load[x] : &:r64_2, m63_8
3933939349
# 64| v64_4(void) = Call[sink] : func:r64_1, 0:r64_3
3934039350
# 64| m64_5(unknown) = ^CallSideEffect : ~m56_4
3934139351
# 64| m64_6(unknown) = Chi : total:m56_4, partial:m64_5
39342-
#-----| Goto -> Block 6
39352+
#-----| Goto -> Block 8
3934339353

39344-
# 66| Block 6
39345-
# 66| m66_1(unknown) = Phi : from 1:~m56_4, from 5:~m64_6
39346-
# 66| v66_2(void) = NoOp :
39354+
# 66| Block 8
39355+
# 66| m66_1(unknown) = Phi : from 3:m60_7, from 7:m63_7
39356+
# 66| m66_2(unknown) = Phi : from 3:~m56_4, from 7:~m64_6
39357+
# 66| v66_3(void) = NoOp :
3934739358
# 56| v56_25(void) = ReturnIndirection[b] : &:r56_7, m56_8
39348-
# 56| v56_26(void) = ReturnIndirection[c] : &:r56_11, m60_7
39359+
# 56| v56_26(void) = ReturnIndirection[c] : &:r56_11, m66_1
3934939360
# 56| v56_27(void) = ReturnIndirection[d] : &:r56_15, m56_16
3935039361
# 56| v56_28(void) = ReturnIndirection[e] : &:r56_19, m56_20
3935139362
# 56| v56_29(void) = ReturnIndirection[f] : &:r56_23, m56_24
3935239363
# 56| v56_30(void) = ReturnVoid :
39353-
# 56| v56_31(void) = AliasedUse : ~m66_1
39364+
# 56| v56_31(void) = AliasedUse : ~m66_2
3935439365
# 56| v56_32(void) = ExitFunction :
3935539366

39356-
# 56| Block 7
39367+
# 56| Block 9
3935739368
# 56| v56_33(void) = Unreached :
3935839369

3935939370
try_except.cpp:

‎cpp/ql/test/library-tests/ir/ir/raw_ir.expected‎

Lines changed: 29 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -37564,16 +37564,8 @@ try_except.c:
3756437564
# 59| r59_1(glval<int *>) = VariableAddress[b] :
3756537565
# 59| r59_2(int *) = Load[b] : &:r59_1, ~m?
3756637566
# 59| r59_3(int) = Load[?] : &:r59_2, ~m?
37567-
# 59| r59_4(glval<int>) = VariableAddress[x] :
37568-
# 59| mu59_5(int) = Store[x] : &:r59_4, r59_3
37569-
# 60| r60_1(glval<int>) = VariableAddress[x] :
37570-
# 60| r60_2(int) = Load[x] : &:r60_1, ~m?
37571-
# 60| r60_3(glval<int *>) = VariableAddress[c] :
37572-
# 60| r60_4(int *) = Load[c] : &:r60_3, ~m?
37573-
# 60| r60_5(glval<int>) = CopyValue : r60_4
37574-
# 60| mu60_6(int) = Store[?] : &:r60_5, r60_2
3757537567
#-----| Goto -> Block 3
37576-
#-----| SEH Exception -> Block 6
37568+
#-----| SEH Exception -> Block 8
3757737569

3757837570
# 56| Block 1
3757937571
# 56| v56_24(void) = AliasedUse : ~m?
@@ -37583,44 +37575,60 @@ try_except.c:
3758337575
# 56| v56_26(void) = Unwind :
3758437576
#-----| Goto -> Block 1
3758537577

37586-
# 61| Block 3
37578+
# 59| Block 3
37579+
# 59| r59_4(glval<int>) = VariableAddress[x] :
37580+
# 59| mu59_5(int) = Store[x] : &:r59_4, r59_3
37581+
# 60| r60_1(glval<int>) = VariableAddress[x] :
37582+
# 60| r60_2(int) = Load[x] : &:r60_1, ~m?
37583+
# 60| r60_3(glval<int *>) = VariableAddress[c] :
37584+
# 60| r60_4(int *) = Load[c] : &:r60_3, ~m?
37585+
# 60| r60_5(glval<int>) = CopyValue : r60_4
37586+
# 60| mu60_6(int) = Store[?] : &:r60_5, r60_2
37587+
#-----| Goto -> Block 4
37588+
#-----| SEH Exception -> Block 8
37589+
37590+
# 61| Block 4
3758737591
# 61| r61_1(glval<int>) = VariableAddress[y] :
3758837592
# 61| r61_2(glval<int *>) = VariableAddress[d] :
3758937593
# 61| r61_3(int *) = Load[d] : &:r61_2, ~m?
3759037594
# 61| r61_4(int) = Load[?] : &:r61_3, ~m?
37591-
# 61| mu61_5(int) = Store[y] : &:r61_1, r61_4
37592-
#-----| Goto -> Block 8
37595+
#-----| Goto -> Block 5
37596+
#-----| SEH Exception -> Block 8
37597+
37598+
# 61| Block 5
37599+
# 61| mu61_5(int) = Store[y] : &:r61_1, r61_4
37600+
#-----| Goto -> Block 10
3759337601

37594-
# 63| Block 4
37602+
# 63| Block 6
3759537603
# 63| r63_1(int) = Constant[0] :
3759637604
# 63| r63_2(bool) = CompareEQ : r63_7, r63_1
3759737605
# 63| v63_3(void) = ConditionalBranch : r63_2
37598-
#-----| False -> Block 5
37606+
#-----| False -> Block 7
3759937607
#-----| True -> Block 2
3760037608

37601-
# 63| Block 5
37609+
# 63| Block 7
3760237610
# 63| r63_4(int) = Constant[1] :
3760337611
# 63| r63_5(bool) = CompareEQ : r63_7, r63_4
3760437612
# 63| v63_6(void) = ConditionalBranch : r63_5
37605-
#-----| True -> Block 7
37613+
#-----| True -> Block 9
3760637614

37607-
# 63| Block 6
37615+
# 63| Block 8
3760837616
# 63| r63_7(int) = Constant[1] :
3760937617
# 63| r63_8(int) = Constant[-1] :
3761037618
# 63| r63_9(bool) = CompareEQ : r63_7, r63_8
3761137619
# 63| v63_10(void) = ConditionalBranch : r63_9
37612-
#-----| False -> Block 4
37620+
#-----| False -> Block 6
3761337621
#-----| True -> Block 2
3761437622

37615-
# 64| Block 7
37623+
# 64| Block 9
3761637624
# 64| r64_1(glval<unknown>) = FunctionAddress[sink] :
3761737625
# 64| r64_2(glval<int>) = VariableAddress[x] :
3761837626
# 64| r64_3(int) = Load[x] : &:r64_2, ~m?
3761937627
# 64| v64_4(void) = Call[sink] : func:r64_1, 0:r64_3
3762037628
# 64| mu64_5(unknown) = ^CallSideEffect : ~m?
37621-
#-----| Goto -> Block 8
37629+
#-----| Goto -> Block 10
3762237630

37623-
# 66| Block 8
37631+
# 66| Block 10
3762437632
# 66| v66_1(void) = NoOp :
3762537633
# 56| v56_27(void) = ReturnIndirection[b] : &:r56_6, ~m?
3762637634
# 56| v56_28(void) = ReturnIndirection[c] : &:r56_10, ~m?

0 commit comments

Comments
 (0)