C++: Support data flow from parameter deref to return value.

2025-12-18 01:33:15 +01:00 · 2020-11-10 13:14:10 +00:00
parent 4563e32e92
commit c4fe8df04c
2 changed files with 230 additions and 221 deletions
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -677,6 +677,11 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
      exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel |
        f.hasDataFlow(inModel, outModel) and
        (
+          exists(int iIn |
+            inModel.isParameterDeref(iIn) and
+            call.passesByReference(iIn, fromExpr)
+          )
+          or
          exists(int iIn |
            inModel.isParameter(iIn) and
            fromExpr = call.getArgument(iIn)
--- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected