-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Adding capabilities for SEH and CPP edges in IR. #18241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adding capabilities for SEH and CPP edges in IR. #18241
Conversation
….com/microsoft/codeql into brodes/seh_flow_phase3_add_seh_edges
@MathiasVP , would this PR require a change log? |
Why has the raw IR significantly changed? I now see
I also do not expect changes like the following, where suddenly branches are missing:
|
Nope. What we want is a change note at the end of all of these PRs that state something along the lines of "Microsoft structured exception handling is now better supported. Queries evaluated on databases containing structured exception handling code now report more precise alerts" or something along those lines. But until we're done with all the work we don't need any change notes. So feel free to add the 'no-change-note-required' label if you can. |
….com/microsoft/codeql into brodes/seh_flow_phase3_add_seh_edges
…for SEH exceptions.
@MathiasVP I do not have permissions to add labels. |
@jketema , as discussed in a separate DM, I found where the error was in how unwind was handled. We will now only unwind if a function is throwing a non-seh exception. I'm still investigating the missing branches. |
@jketema the missing branches are due to not having unwind mechanics for SEH which was a conscious choice. That said, the case you pointed out is an unwind inside of a function that specifically has a try/except statement. Generally if we included unwind for SEH every function would have an unwind since SEH occurs for any load/store/call. @MathiasVP , this is a question for you as well, do you think it is appropriate to have an unwind if there is an explicit try/except or simply have as a universal rule, now unwinds for SEH? I do not believe the unwind buys anything (yet) as all function calls are assumed to potentially raise SEH anyway. |
# 25| v25_4(void) = Call[ExRaiseAccessViolation] : func:r25_1, 0:r25_3 | ||
# 25| mu25_5(unknown) = ^CallSideEffect : ~m? | ||
#-----| C++ Exception -> Block 6 | ||
#-----| Goto -> Block 2 | ||
#-----| SEH Exception -> Block 5 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The goto here is unexpected, as ExRaiseAccessViolation
always raises an SEH exception.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is generating a goto and an SEH not for the call, but for the Load[x], all load instructions "MAY" throw an SEH exception, so you get a goto and an exception case.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Note the call doesn't occur in this block at all anymore, it is now in Block 2, which is related to your next question.
# 25| Block 2 | ||
# 25| v25_4(void) = Call[ExRaiseAccessViolation] : func:r25_1, 0:r25_3 | ||
# 25| mu25_5(unknown) = ^CallSideEffect : ~m? | ||
#-----| SEH Exception -> Block 5 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Where does this block come from?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Per above, the load[x] occurs, and if no exception, you will flow to block 2 for the call. The call always throws an SEH exception.
The unwind exists as the handler for exceptions that reach the top of the AST (i.e., the function scope). For C++ exceptions we will definitely always want to have an void test() {
try {
throw 42;
} catch(...) { }
} For SEH exceptions we will not generate an |
Splitting this PR up manually as suggested. Closing this PR. |
Phase 3 move towards supporting SEH exceptions separately from CPP exceptions. This PR differentiates the SEH and CPP edges in the IR.