Brodes/seh flow overhaul2

cpp/ql/lib/change-notes/2024-10-24-ir-seh-exception-handling-updates.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added support for structured exception handling (SEH). As a result, dataflow queries may have more results in code bases that use SEH.

cpp/ql/lib/semmle/code/cpp/ir/implementation/EdgeKind.qll

@@ -3,12 +3,13 @@
  */
 
 private import internal.EdgeKindInternal
+private import codeql.util.Boolean
 
 private newtype TEdgeKind =
   TGotoEdge() or // Single successor (including fall-through)
   TTrueEdge() or // 'true' edge of conditional branch
   TFalseEdge() or // 'false' edge of conditional branch
-  TExceptionEdge() or // Thrown exception
+  TExceptionEdge(Boolean isSeh) or // Thrown exception, true for SEH exceptions, false otherwise
   TDefaultEdge() or // 'default' label of switch
   TCaseEdge(string minValue, string maxValue) {
     // Case label of switch
@@ -54,7 +55,18 @@ class FalseEdge extends EdgeKind, TFalseEdge {
  * instruction's evaluation throws an exception.
  */
 class ExceptionEdge extends EdgeKind, TExceptionEdge {
-  final override string toString() { result = "Exception" }
+  boolean isSeh; //true for Structured Exception Handling, false for C++ exceptions
+
+  ExceptionEdge() { this = TExceptionEdge(isSeh) }
+
+  /**
+   * Holds if the exception is a Structured Exception Handling (SEH) exception.
+   */
+  final predicate isSeh() { isSeh = true }
+
+  final override string toString() {
+    if isSeh = true then result = "SEH Exception" else result = "C++ Exception"
+  }
 }
 
 /**
@@ -121,9 +133,10 @@ module EdgeKind {
   FalseEdge falseEdge() { result = TFalseEdge() }
 
   /**
-   * Gets the single instance of the `ExceptionEdge` class.
+   * Gets the instance of the `ExceptionEdge` class.
+   * `isSeh` is true if the exception is an SEH exception, and false for a C++ edge.
    */
-  ExceptionEdge exceptionEdge() { result = TExceptionEdge() }
+  ExceptionEdge exceptionEdge(boolean isSeh) { result = TExceptionEdge(isSeh) }
 
   /**
    * Gets the single instance of the `DefaultEdge` class.

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -10,6 +10,7 @@
 private import TranslatedExpr
 private import TranslatedFunction
 private import DefaultOptions as DefaultOptions
+private import EdgeKind
 
 /**
  * Gets the `CallInstruction` from the `TranslatedCallExpr` for the specified expression.
@@ -83,14 +84,36 @@
         any(UnreachedInstruction instr |
           this.getEnclosingFunction().getFunction() = instr.getEnclosingFunction()
         )
-    else (
-      not this.mustThrowException() and
-      result = this.getParent().getChildSuccessor(this, kind)
-      or
-      this.mayThrowException() and
-      kind instanceof ExceptionEdge and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge))
-    )
+    else
+      exists(boolean isSeh | kind = exceptionEdge(isSeh) |
+        // Call throw behavior is resolved from most restricted to least restricted in order
+        // if there are conflicting throwing specificaitons for a function.
+        // Enumerating all scenarios to be explicit.
+        (
+          // If the call is known to never throw, regardless of other defined throwing behavior,
+          // do not generate any exception edges, only an ordinary successor
+          if this.(TranslatedCallExpr).neverRaiseException(isSeh)
+          then result = this.getParent().getChildSuccessor(this, any(GotoEdge edge))
+          else
+            // If the call is known to always throw, regardless of other defined throwing behavior,
+            // only generate an exception edge.
+            if this.(TranslatedCallExpr).alwaysRaiseException(isSeh)
+            then
+              result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSeh)
+            else
+              if this.(TranslatedCallExpr).mayRaiseException(isSeh)
+              then (
+                // if the call is known to conditionally throw, generate both an exception edge and an
+                // ordinary successor
+                result =
+                  this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSeh)
+                or
+                result = this.getParent().getChildSuccessor(this, kind)
+              ) else
+                // fallthrough case, no exceptions, just get the ordinary successor
+                result = this.getParent().getChildSuccessor(this, kind)
+        )
+      )
   }
 
   override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
@@ -117,14 +140,28 @@
   final override Instruction getResult() { result = this.getInstruction(CallTag()) }
 
   /**
-   * Holds if the evaluation of this call may throw an exception.
+   * The call target is known to always raise an exception.
+   * Note that `alwaysRaiseException`, `mayRaiseException`,
+   * and `neverRaiseException` may conflict (e.g., all hold for a given target).
+   * Conflicting results are resolved during IR generation.
    */
-  abstract predicate mayThrowException();
+  abstract predicate alwaysRaiseException(boolean isSeh);
 
   /**
-   * Holds if the evaluation of this call always throws an exception.
+   * The call target is known to conditionally raise an exception.
+   * Note that `alwaysRaiseException`, `mayRaiseException`,
+   * and `neverRaiseException` may conflict (e.g., all hold for a given target).
+   * Conflicting results are resolved during IR generation.
    */
-  abstract predicate mustThrowException();
+  abstract predicate mayRaiseException(boolean isSeh);
+
+  /**
+   * The call target is known to never raise an exception.
+   * Note that `alwaysRaiseException`, `mayRaiseException`,
+   * and `neverRaiseException` may conflict (e.g., all hold for a given target).
+   * Conflicting results are resolved during IR generation.
+   */
+  abstract predicate neverRaiseException(boolean isSeh);
 
   /**
    * Gets the result type of the call.
@@ -320,6 +357,34 @@
   final override int getNumberOfArguments() { result = expr.getNumberOfArguments() }
 
   final override predicate isNoReturn() { any(Options opt).exits(expr.getTarget()) }
+
+  override Function getInstructionFunction(InstructionTag tag) {
+    tag = CallTargetTag() and result = expr.getTarget()
+  }
+
+  override predicate alwaysRaiseException(boolean isSeh) {
+    exists(ThrowingFunction f | f = expr.getTarget() |
+      f.alwaysRaisesException() and f.isSeh() and isSeh = true
+      or
+      f.alwaysRaisesException() and f.isCxx() and isSeh = false
+    )
+  }
+
+  override predicate mayRaiseException(boolean isSeh) {
+    exists(ThrowingFunction f | f = expr.getTarget() |
+      f.mayRaiseException() and f.isSeh() and isSeh = true
+      or
+      f.mayRaiseException() and f.isCxx() and isSeh = false
+    )
+  }
+
+  override predicate neverRaiseException(boolean isSeh) {
+    exists(NonThrowingFunction f | f = expr.getTarget() |
+      f.isSeh() and isSeh = true
+      or
+      f.isCxx() and isSeh = false
+    )
+  }
 }
 
 /**
@@ -332,14 +397,42 @@
     result = getTranslatedExpr(expr.getExpr().getFullyConverted())
   }
 
-  final override predicate mayThrowException() {
-    // We assume that a call to a function pointer will not throw an exception.
+  override predicate alwaysRaiseException(boolean isSeh) {
+    // We assume that a call to a function pointer will not throw a CXX exception.
     // This is not sound in general, but this will greatly reduce the number of
     // exceptional edges.
-    none()
+    // For SEH exceptions, use the defined ThrowingFunction behavior and
+    // if no throwing function is found, assume a conditional SEH exception
+    // see `mayRaiseException`
+    exists(ThrowingFunction f | f = expr.getTarget() |
+      f.alwaysRaisesException() and f.isSeh() and isSeh = true
+    )
+  }
+
+  override predicate mayRaiseException(boolean isSeh) {
+    // We assume that a call to a function pointer will not throw a CXX exception.
+    // This is not sound in general, but this will greatly reduce the number of
+    // exceptional edges.
+    // For SEH exceptions, use the defined ThrowingFunction behavior.
+    // ASSUMPTION: if no ThrowingFunction is found for the given call, assume a conditional SEH exception
+    // on the call.
+    exists(ThrowingFunction f | f = expr.getTarget() |
+      f.mayRaiseException() and f.isSeh() and isSeh = true
+    )
+    or
+    not exists(ThrowingFunction f | f = expr.getTarget() and f.isSeh()) and
+    isSeh = true
   }
 
-  final override predicate mustThrowException() { none() }
+  override predicate neverRaiseException(boolean isSeh) {
+    // We assume that a call to a function pointer will not throw a CXX exception.
+    // This is not sound in general, but this will greatly reduce the number of
+    // exceptional edges.
+    // For SEH exceptions, use the defined ThrowingFunction behavior and
+    // if no throwing function is found, assume a conditional SEH exception
+    // see `mayRaiseException`
+    exists(NonThrowingFunction f | f = expr.getTarget() | f.isSeh() and isSeh = true)
+  }
 }
 
 /**
@@ -348,10 +441,6 @@
 class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall {
   override FunctionCall expr;
 
-  override Function getInstructionFunction(InstructionTag tag) {
-    tag = CallTargetTag() and result = expr.getTarget()
-  }
-
   override Instruction getQualifierResult() {
     this.hasQualifier() and
     result = this.getQualifier().getResult()
@@ -361,14 +450,6 @@
     exists(this.getQualifier()) and
     not exists(MemberFunction func | expr.getTarget() = func and func.isStatic())
   }
-
-  final override predicate mayThrowException() {
-    expr.getTarget().(ThrowingFunction).mayThrowException(_)
-  }
-
-  final override predicate mustThrowException() {
-    expr.getTarget().(ThrowingFunction).mayThrowException(true)
-  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -1104,9 +1104,13 @@ abstract class TranslatedElement extends TTranslatedElement {
    * within this element. This will generally return first `catch` block of the
    * nearest enclosing `try`, or the `Unwind` instruction for the function if
    * there is no enclosing `try`. The successor edge kind is specified by `kind`.
+   *
+   * `isSeh` is true if the exception is a structured exception, false if otherwise.
+   * The boolean value can be extracted from `ExceptionEdge` from the exception
+   * edge triggering the call to this function.
    */
-  Instruction getExceptionSuccessorInstruction(EdgeKind kind) {
-    result = this.getParent().getExceptionSuccessorInstruction(kind)
+  Instruction getExceptionSuccessorInstruction(EdgeKind kind, boolean isSeh) {
+    result = this.getParent().getExceptionSuccessorInstruction(kind, isSeh)
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -15,6 +15,7 @@ private import TranslatedInitialization
 private import TranslatedStmt
 private import TranslatedGlobalVar
 private import IRConstruction
+private import EdgeKind
 import TranslatedCall
 
 /**
@@ -391,7 +392,13 @@ class TranslatedLoad extends TranslatedValueCategoryAdjustment, TTranslatedLoad
 
   override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
     tag = LoadTag() and
-    result = this.getParent().getChildSuccessor(this, kind)
+    (
+      result = this.getParent().getChildSuccessor(this, kind)
+      or
+      // All load instructions could throw an SEH exception
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
+      kind.(ExceptionEdge).isSeh()
+    )
   }
 
   override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {
@@ -1083,7 +1090,13 @@ class TranslatedStructuredBindingVariableAccess extends TranslatedNonConstantExp
     result = this.getInstruction(LoadTag())
     or
     tag = LoadTag() and
-    result = this.getParent().getChildSuccessor(this, kind)
+    (
+      result = this.getParent().getChildSuccessor(this, kind)
+      or
+      // All load instructions could throw an SEH exception
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
+      kind.(ExceptionEdge).isSeh()
+    )
   }
 
   override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) { none() }
@@ -1898,8 +1911,13 @@ class TranslatedBlockAssignExpr extends TranslatedNonConstantExpr {
 
   override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
     tag = LoadTag() and
-    result = this.getInstruction(AssignmentStoreTag()) and
-    kind instanceof GotoEdge
+    (
+      result = this.getInstruction(AssignmentStoreTag()) and kind instanceof GotoEdge
+      or
+      // All load instructions could throw an SEH exception
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
+      kind.(ExceptionEdge).isSeh()
+    )
     or
     tag = AssignmentStoreTag() and
     result = this.getParent().getChildSuccessor(this, kind)
@@ -2375,14 +2393,16 @@ class TranslatedAllocatorCall extends TTranslatedAllocatorCall, TranslatedDirect
         result = getTranslatedExpr(expr.getAllocatorCall().getArgument(index).getFullyConverted())
   }
 
-  final override predicate mayThrowException() {
+  final override predicate mayRaiseException(boolean isSeh) {
     // We assume that a call to `new` or `new[]` will never throw. This is not
     // sound in general, but this will greatly reduce the number of exceptional
     // edges.
     none()
   }
 
-  final override predicate mustThrowException() { none() }
+  final override predicate alwaysRaiseException(boolean isSeh) { none() }
+
+  final override predicate neverRaiseException(boolean isSeh) { none() }
 }
 
 TranslatedAllocatorCall getTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) {
@@ -2448,14 +2468,16 @@ class TranslatedDeleteOrDeleteArrayExpr extends TranslatedNonConstantExpr, Trans
     result = getTranslatedExpr(expr.getExprWithReuse().getFullyConverted())
   }
 
-  final override predicate mayThrowException() {
+  final override predicate mayRaiseException(boolean isSeh) {
     // We assume that a call to `delete` or `delete[]` will never throw. This is not
     // sound in general, but this will greatly reduce the number of exceptional
     // edges.
     none()
   }
 
-  final override predicate mustThrowException() { none() }
+  final override predicate alwaysRaiseException(boolean isSeh) { none() }
+
+  final override predicate neverRaiseException(boolean isSeh) { none() }
 }
 
 TranslatedDeleteOrDeleteArrayExpr getTranslatedDeleteOrDeleteArray(DeleteOrDeleteArrayExpr newExpr) {
@@ -3039,8 +3061,8 @@ class TranslatedDestructorsAfterThrow extends TranslatedElement, TTranslatedDest
       or
       // And otherwise, exit this element with an exceptional edge
       not exists(this.getChild(id + 1)) and
-      kind instanceof ExceptionEdge and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge))
+      kind = exceptionEdge(false) and
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), false)
     )
   }
 
@@ -3079,7 +3101,8 @@ abstract class TranslatedThrowExpr extends TranslatedNonConstantExpr {
       or
       not exists(this.getDestructors()) and
       kind instanceof ExceptionEdge and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge))
+      kind = exceptionEdge(false) and
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), false)
     )
   }