CPP: Support flow of pointed-to things through function calls.

2026-05-02 04:05:14 +02:00 · 2020-01-15 19:19:40 +00:00
parent 04af2ace94
commit ef47563139
5 changed files with 21 additions and 5 deletions
--- a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -602,9 +602,14 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
      exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel, int iIn |
        call.getTarget() = f and
        f.hasDataFlow(inModel, outModel) and
-        outModel.isReturnValue() and
-        inModel.isParameter(iIn) and
-        fromExpr = call.getArgument(iIn)
+        fromExpr = call.getArgument(iIn) and
+        (
+          inModel.isParameter(iIn) and
+          outModel.isReturnValue()
+          or
+          inModel.isParameterDeref(iIn) and
+          outModel.isReturnValueDeref()
+        )
      )
    )
 }