Updated Bouncy Castle signer unit tests

- Signature operations are now handled by a single algorithm instance
- All key generation operations except generic EC key generation
  operations are now handled by a single algorithm instance
- Ed25519 and Ed448 key generation have the algorithm set to Ed25519 and
  Ed448 respectively
- For generic EC key generation operations the algorithm is given by the
  corresponding curve (since these could be used for either ECDSA or ECDH)

.github/workflows/build-ripunzip.yml

@@ -6,18 +6,18 @@ on:
       ripunzip-version:
         description: "what reference to checktout from google/runzip"
         required: false
-        default: v1.2.1
+        default: v2.0.2
       openssl-version:
         description: "what reference to checkout from openssl/openssl for Linux"
         required: false
-        default: openssl-3.3.0
+        default: openssl-3.5.0
 
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04, macos-13, windows-2019]
+        os: [ubuntu-22.04, macos-13, windows-2022]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4

.github/workflows/csharp-qltest.yml

@@ -36,7 +36,7 @@ jobs:
   unit-tests:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-2019]
+        os: [ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -66,6 +66,6 @@ jobs:
           # Update existing stubs in the repo with the freshly generated ones
           mv "$STUBS_PATH/output/stubs/_frameworks" ql/test/resources/stubs/
           git status
-          codeql test run --threads=0 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries -- ql/test/library-tests/dataflow/flowsources/aspremote
+          codeql test run --threads=0 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries -- ql/test/library-tests/dataflow/flowsources/aspremote
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/go-tests-other-os.yml

@@ -26,9 +26,8 @@ jobs:
         uses: ./go/actions/test
 
   test-win:
-    if: github.repository_owner == 'github'
     name: Test Windows
-    runs-on: windows-latest-xl
+    runs-on: windows-latest
     steps:
       - name: Check out code
         uses: actions/checkout@v4

.github/workflows/mad_modelDiff.yml

@@ -68,7 +68,7 @@ jobs:
             DATABASE=$2
             cd codeql-$QL_VARIANT
             SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
+            python misc/scripts/models-as-data/generate_mad.py --language java --with-summaries --with-sinks $DATABASE $SHORTNAME/$QL_VARIANT
             mkdir -p $MODELS/$SHORTNAME
             mv java/ql/lib/ext/generated/$SHORTNAME/$QL_VARIANT $MODELS/$SHORTNAME
             cd ..

.github/workflows/ruby-qltest-rtjo.yml

@@ -35,6 +35,6 @@ jobs:
           key: ruby-qltest
       - name: Run QL tests
         run: |
-          codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
+          codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/ruby-qltest.yml

@@ -68,6 +68,6 @@ jobs:
           key: ruby-qltest
       - name: Run QL tests
         run: |
-          codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
+          codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/swift.yml

@@ -32,7 +32,7 @@ jobs:
     if: github.repository_owner == 'github'
     strategy:
       matrix:
-        runner: [ubuntu-latest, macos-13-xlarge]
+        runner: [ubuntu-latest, macos-15-xlarge]
       fail-fast: false
     runs-on: ${{ matrix.runner }}
     steps:

.github/workflows/validate-change-notes.yml

@@ -31,4 +31,4 @@ jobs:
       - name: Fail if there are any errors with existing change notes
 
         run: |
-          codeql pack release --groups cpp,csharp,java,javascript,python,ruby,-examples,-test,-experimental
+          codeql pack release --groups actions,cpp,csharp,go,java,javascript,python,ruby,shared,swift -examples,-test,-experimental

.gitignore

@@ -62,6 +62,7 @@ node_modules/
 
 # Temporary folders for working with generated models
 .model-temp
+/mad-generation-build
 
 # bazel-built in-tree extractor packs
 /*/extractor-pack
@@ -71,3 +72,7 @@ node_modules/
 
 # cargo build directory
 /target
+
+# some upgrade/downgrade checks create these files
+**/upgrades/*/*.dbscheme.stats
+**/downgrades/*/*.dbscheme.stats

CODEOWNERS

@@ -16,7 +16,8 @@
 /java/ql/test-kotlin2/ @github/codeql-kotlin
 
 # Experimental CodeQL cryptography
-**/experimental/quantum/ @github/ps-codeql
+**/experimental/**/quantum/ @github/ps-codeql
+/shared/quantum/ @github/ps-codeql
 
 # CodeQL tools and associated docs
 /docs/codeql/codeql-cli/ @github/codeql-cli-reviewers

Cargo.lock

@@ -242,6 +242,8 @@ version = "1.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
 dependencies = [
+ "jobserver",
+ "libc",
  "shlex",
 ]
 
@@ -390,6 +392,7 @@ dependencies = [
  "tree-sitter",
  "tree-sitter-json",
  "tree-sitter-ql",
+ "zstd",
 ]
 
 [[package]]
@@ -983,6 +986,15 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "jod-thread"
 version = "0.1.2"
@@ -1334,6 +1346,12 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
 [[package]]
 name = "portable-atomic"
 version = "1.11.0"
@@ -3027,3 +3045,31 @@ dependencies = [
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.15+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
+dependencies = [
+ "cc",
+ "pkg-config",
+]

Cargo.toml

@@ -10,6 +10,7 @@ members = [
     "rust/ast-generator",
     "rust/autobuild",
 ]
+exclude = ["mad-generation-build"]
 
 [patch.crates-io]
 # patch for build script bug preventing bazel build

MODULE.bazel

@@ -24,7 +24,7 @@ bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "10.0.0")
-bazel_dep(name = "rules_kotlin", version = "2.0.0-codeql.1")
+bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
 bazel_dep(name = "gazelle", version = "0.40.0")
 bazel_dep(name = "rules_dotnet", version = "0.17.4")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
@@ -124,6 +124,7 @@ use_repo(
     "vendor_ts__tree-sitter-ruby-0.23.1",
     "vendor_ts__triomphe-0.1.14",
     "vendor_ts__ungrammar-1.16.1",
+    "vendor_ts__zstd-0.13.3",
 )
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
@@ -193,10 +194,6 @@ use_repo(
     kotlin_extractor_deps,
     "codeql_kotlin_defaults",
     "codeql_kotlin_embeddable",
-    "kotlin-compiler-1.5.0",
-    "kotlin-compiler-1.5.10",
-    "kotlin-compiler-1.5.20",
-    "kotlin-compiler-1.5.30",
     "kotlin-compiler-1.6.0",
     "kotlin-compiler-1.6.20",
     "kotlin-compiler-1.7.0",
@@ -208,10 +205,7 @@ use_repo(
     "kotlin-compiler-2.0.20-Beta2",
     "kotlin-compiler-2.1.0-Beta1",
     "kotlin-compiler-2.1.20-Beta1",
-    "kotlin-compiler-embeddable-1.5.0",
-    "kotlin-compiler-embeddable-1.5.10",
-    "kotlin-compiler-embeddable-1.5.20",
-    "kotlin-compiler-embeddable-1.5.30",
+    "kotlin-compiler-2.2.0-Beta1",
     "kotlin-compiler-embeddable-1.6.0",
     "kotlin-compiler-embeddable-1.6.20",
     "kotlin-compiler-embeddable-1.7.0",
@@ -223,10 +217,7 @@ use_repo(
     "kotlin-compiler-embeddable-2.0.20-Beta2",
     "kotlin-compiler-embeddable-2.1.0-Beta1",
     "kotlin-compiler-embeddable-2.1.20-Beta1",
-    "kotlin-stdlib-1.5.0",
-    "kotlin-stdlib-1.5.10",
-    "kotlin-stdlib-1.5.20",
-    "kotlin-stdlib-1.5.30",
+    "kotlin-compiler-embeddable-2.2.0-Beta1",
     "kotlin-stdlib-1.6.0",
     "kotlin-stdlib-1.6.20",
     "kotlin-stdlib-1.7.0",
@@ -238,6 +229,7 @@ use_repo(
     "kotlin-stdlib-2.0.20-Beta2",
     "kotlin-stdlib-2.1.0-Beta1",
     "kotlin-stdlib-2.1.20-Beta1",
+    "kotlin-stdlib-2.2.0-Beta1",
 )
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
@@ -247,24 +239,24 @@ go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
 use_repo(go_deps, "org_golang_x_mod", "org_golang_x_tools")
 
-lfs_files = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_files")
+lfs_archive = use_repo_rule("//misc/bazel:lfs.bzl", "lfs_archive")
 
-lfs_files(
+lfs_archive(
     name = "ripunzip-linux",
-    srcs = ["//misc/ripunzip:ripunzip-linux"],
-    executable = True,
+    src = "//misc/ripunzip:ripunzip-Linux.zip",
+    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 
-lfs_files(
+lfs_archive(
     name = "ripunzip-windows",
-    srcs = ["//misc/ripunzip:ripunzip-windows.exe"],
-    executable = True,
+    src = "//misc/ripunzip:ripunzip-Windows.zip",
+    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 
-lfs_files(
+lfs_archive(
     name = "ripunzip-macos",
-    srcs = ["//misc/ripunzip:ripunzip-macos"],
-    executable = True,
+    src = "//misc/ripunzip:ripunzip-macOS.zip",
+    build_file = "//misc/ripunzip:BUILD.ripunzip.bazel",
 )
 
 register_toolchains(

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 0.4.11
+
+No user-facing changes.
+
+## 0.4.10
+
+No user-facing changes.
+
+## 0.4.9
+
+No user-facing changes.
+
 ## 0.4.8
 
 No user-facing changes.

actions/ql/lib/change-notes/2025-06-09-bash-parsing-performance.md

@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+* Fixed performance issues in the parsing of Bash scripts in workflow files,
+  which led to out-of-disk errors when analysing certain workflow files with
+  complex interpolations of shell commands or quoted strings.

actions/ql/lib/change-notes/released/0.4.10.md

@@ -0,0 +1,3 @@
+## 0.4.10
+
+No user-facing changes.

actions/ql/lib/change-notes/released/0.4.11.md

@@ -0,0 +1,3 @@
+## 0.4.11
+
+No user-facing changes.

actions/ql/lib/change-notes/released/0.4.9.md

@@ -0,0 +1,3 @@
+## 0.4.9
+
+No user-facing changes.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.8
+lastReleaseVersion: 0.4.11

actions/ql/lib/codeql/actions/Ast.qll

@@ -50,8 +50,8 @@ class Expression extends AstNode instanceof ExpressionImpl {
   string getNormalizedExpression() { result = normalizeExpr(expression) }
 }
 
-/** A common class for `env` in workflow, job or step. */
-abstract class Env extends AstNode instanceof EnvImpl {
+/** An `env` in workflow, job or step. */
+class Env extends AstNode instanceof EnvImpl {
   /** Gets an environment variable value given its name. */
   ScalarValueImpl getEnvVarValue(string name) { result = super.getEnvVarValue(name) }
 

actions/ql/lib/codeql/actions/Bash.qll

@@ -8,35 +8,64 @@ class BashShellScript extends ShellScript {
     )
   }
 
-  private string lineProducer(int i) {
-    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", i)
+  /**
+   * Gets the line at 0-based index `lineIndex` within this shell script,
+   * assuming newlines as separators.
+   */
+  private string lineProducer(int lineIndex) {
+    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", lineIndex)
   }
 
-  private predicate cmdSubstitutionReplacement(string cmdSubs, string id, int k) {
-    exists(string line | line = this.lineProducer(k) |
-      exists(int i, int j |
-        cmdSubs =
-          // $() cmd substitution
-          line.regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", i, j)
-              .regexpReplaceAll("^\\$\\(", "")
-              .regexpReplaceAll("\\)$", "") and
-        id = "cmdsubs:" + k + ":" + i + ":" + j
-      )
-      or
-      exists(int i, int j |
-        // `...` cmd substitution
-        cmdSubs =
-          line.regexpFind("\\`[^\\`]+\\`", i, j)
-              .regexpReplaceAll("^\\`", "")
-              .regexpReplaceAll("\\`$", "") and
-        id = "cmd:" + k + ":" + i + ":" + j
-      )
+  private predicate cmdSubstitutionReplacement(string command, string id, int lineIndex) {
+    this.commandInSubstitution(lineIndex, command, id)
+    or
+    this.commandInBackticks(lineIndex, command, id)
+  }
+
+  /**
+   * Holds if there is a command substitution `$(command)` in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this command.
+   */
+  private predicate commandInSubstitution(int lineIndex, string command, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      command =
+        // Look for the command inside a $(...) command substitution
+        this.lineProducer(lineIndex)
+            .regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", occurrenceIndex,
+              occurrenceOffset)
+            // trim starting $( - TODO do this in first regex
+            .regexpReplaceAll("^\\$\\(", "")
+            // trim ending ) - TODO do this in first regex
+            .regexpReplaceAll("\\)$", "") and
+      id = "cmdsubs:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
     )
   }
 
-  private predicate rankedCmdSubstitutionReplacements(int i, string old, string new) {
-    old = rank[i](string old2 | this.cmdSubstitutionReplacement(old2, _, _) | old2) and
-    this.cmdSubstitutionReplacement(old, new, _)
+  /**
+   * Holds if `command` is a command in backticks `` `...` `` in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this command.
+   */
+  private predicate commandInBackticks(int lineIndex, string command, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      command =
+        this.lineProducer(lineIndex)
+            .regexpFind("\\`[^\\`]+\\`", occurrenceIndex, occurrenceOffset)
+            // trim leading backtick - TODO do this in first regex
+            .regexpReplaceAll("^\\`", "")
+            // trim trailing backtick - TODO do this in first regex
+            .regexpReplaceAll("\\`$", "") and
+      id = "cmd:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
+    )
+  }
+
+  private predicate rankedCmdSubstitutionReplacements(int i, string command, string commandId) {
+    // rank commands by their unique IDs
+    commandId = rank[i](string c, string id | this.cmdSubstitutionReplacement(c, id, _) | id) and
+    // since we cannot output (command, ID) tuples from the rank operation,
+    // we need to work out the specific command associated with the resulting ID
+    this.cmdSubstitutionReplacement(command, commandId, _)
   }
 
   private predicate doReplaceCmdSubstitutions(int line, int round, string old, string new) {
@@ -64,31 +93,56 @@ class BashShellScript extends ShellScript {
     this.cmdSubstitutionReplacement(result, _, i)
   }
 
+  /**
+   * Holds if `quotedStr` is a string in double quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate doubleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // double quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
+  /**
+   * Holds if `quotedStr` is a string in single quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate singleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // single quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("'((?:\\\\.|[^'\\\\])*)'", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
   private predicate quotedStringReplacement(string quotedStr, string id) {
-    exists(string line, int k | line = this.cmdSubstitutedLineProducer(k) |
-      exists(int i, int j |
-        // double quoted string
-        quotedStr = line.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
+    exists(int lineIndex |
+      this.doubleQuotedString(lineIndex, quotedStr, id)
       or
-      exists(int i, int j |
-        // single quoted string
-        quotedStr = line.regexpFind("'((?:\\\\.|[^'\\\\])*)'", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
+      this.singleQuotedString(lineIndex, quotedStr, id)
     ) and
     // Only do this for strings that might otherwise disrupt subsequent parsing
     quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
   }
 
-  private predicate rankedQuotedStringReplacements(int i, string old, string new) {
-    old = rank[i](string old2 | this.quotedStringReplacement(old2, _) | old2) and
-    this.quotedStringReplacement(old, new)
+  private predicate rankedQuotedStringReplacements(int i, string quotedString, string quotedStringId) {
+    // rank quoted strings by their nearly-unique IDs
+    quotedStringId = rank[i](string s, string id | this.quotedStringReplacement(s, id) | id) and
+    // since we cannot output (string, ID) tuples from the rank operation,
+    // we need to work out the specific string associated with the resulting ID
+    this.quotedStringReplacement(quotedString, quotedStringId)
   }
 
   private predicate doReplaceQuotedStrings(int line, int round, string old, string new) {

actions/ql/lib/ext/config/actions_permissions.yml

@@ -22,16 +22,21 @@ extensions:
       - ["actions/stale", "pull-requests: write"]
       - ["actions/attest-build-provenance", "id-token: write"]
       - ["actions/attest-build-provenance", "attestations: write"]
+      - ["actions/deploy-pages", "pages: write"]
+      - ["actions/deploy-pages", "id-token: write"]
+      - ["actions/delete-package-versions", "packages: write"]
       - ["actions/jekyll-build-pages", "contents: read"]
       - ["actions/jekyll-build-pages", "pages: write"]
       - ["actions/jekyll-build-pages", "id-token: write"]
       - ["actions/publish-action", "contents: write"]
-      - ["actions/versions-package-tools", "contents: read"]      
+      - ["actions/versions-package-tools", "contents: read"]
       - ["actions/versions-package-tools", "actions: read"]
-      - ["actions/reusable-workflows", "contents: read"]      
+      - ["actions/reusable-workflows", "contents: read"]
       - ["actions/reusable-workflows", "actions: read"]
+      - ["actions/ai-inference", "contents: read"]
+      - ["actions/ai-inference", "models: read"]
       # TODO: Add permissions for actions/download-artifact
       # TODO: Add permissions for actions/upload-artifact
+      # No permissions needed for actions/upload-pages-artifact
       # TODO: Add permissions for actions/cache
-
-      
+      # No permissions needed for actions/configure-pages

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.9-dev
+version: 0.4.12-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 0.6.3
+
+No user-facing changes.
+
+## 0.6.2
+
+### Minor Analysis Improvements
+
+* The query `actions/missing-workflow-permissions` is now aware of the minimal permissions needed for the actions `deploy-pages`, `delete-package-versions`, `ai-inference`. This should lead to better alert messages and better fix suggestions.
+
+## 0.6.1
+
+No user-facing changes.
+
 ## 0.6.0
 
 ### Breaking Changes

actions/ql/src/change-notes/released/0.6.1.md

@@ -0,0 +1,3 @@
+## 0.6.1
+
+No user-facing changes.

actions/ql/src/change-notes/released/0.6.2.md

@@ -0,0 +1,5 @@
+## 0.6.2
+
+### Minor Analysis Improvements
+
+* The query `actions/missing-workflow-permissions` is now aware of the minimal permissions needed for the actions `deploy-pages`, `delete-package-versions`, `ai-inference`. This should lead to better alert messages and better fix suggestions.

actions/ql/src/change-notes/released/0.6.3.md

@@ -0,0 +1,3 @@
+## 0.6.3
+
+No user-facing changes.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.3

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.1-dev
+version: 0.6.4-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

actions/ql/test/query-tests/Security/CWE-094/.github/workflows/interpolation.yml

@@ -0,0 +1,81 @@
+name: Workflow with complex interpolation
+on: 
+  workflow_dispatch:
+    inputs:
+      choice-a:
+        required: true
+        type: choice
+        description: choice-a
+        default: a1
+        options: 
+        - a1
+        - a2
+        - a3
+      string-b:
+        required: false
+        type: string
+        description: string-b
+      string-c:
+        required: false
+        type: string
+        description: string-c
+      list-d:
+        required: true
+        type: string
+        default: d1 d2
+        description: list-d whitespace separated
+      list-e:
+        required: false
+        type: string
+        description: list-e whitespace separated
+      choice-f:
+        required: true
+        type: choice
+        description: choice-f
+        options: 
+        - false
+        - true
+          
+env:
+  DRY_TEST: false
+  B: ${{ github.event.inputs.string-b }}
+
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Produce values
+      id: produce-values
+      run: |
+        echo "region=region" >> $GITHUB_OUTPUT
+        echo "zone=zone" >> $GITHUB_OUTPUT
+
+    - name: Step with complex interpolation
+      id: complex
+      env:
+        CHOICE_A: ${{ github.event.inputs.choice-a }}
+        STRING_B: ${{ github.event.inputs.string-b }}
+        STRING_C: ${{ github.event.inputs.string-c }}
+        LIST_D: ${{ github.event.inputs.list-d }}
+        LIST_E: ${{ github.event.inputs.list-e }}
+        CHOICE_F: ${{ github.event.inputs.choice-f }}
+        REGION: ${{ steps.produce-values.outputs.region }}
+        ZONE: ${{ steps.produce-values.outputs.zone }}
+        DRY_TEST_JSON: ${{ fromJSON(env.DRY_TEST) }}
+        FUNCTION_NAME: my-function
+        USER_EMAIL: 'example@example.com'
+        TYPE: type
+        RANGE: '0-100'
+
+      run: |
+        comma_separated_list_d=$(echo "${LIST_D}" | sed "s/ /\",\"/g")
+        comma_separated_list_e=$(echo "${LIST_E}" | sed "s/ /\",\"/g")
+        c1=$(echo "${STRING_C}" | cut -d "-" -f 1)
+        c2=$(echo "${STRING_C}" | cut -d "-" -f 2)
+        # Similar commands that use JSON payloads with string interpolation.
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":["'"${comma_separated_list_e}"'"],"dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+      shell: bash

actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms10.yml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/ai-inference

actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms8.yml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/deploy-pages

actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms9.yml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/delete-package-versions

actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected

@@ -3,3 +3,6 @@
 | .github/workflows/perms5.yml:7:5:10:32 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
 | .github/workflows/perms6.yml:7:5:11:39 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, id-token: write, pages: write} |
 | .github/workflows/perms7.yml:7:5:10:38 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {} |
+| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
+| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
+| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |

cpp/bulk_generation_targets.yml

@@ -0,0 +1,10 @@
+language: cpp
+strategy: dca
+destination: cpp/ql/lib/ext/generated
+targets:
+- name: openssl
+  with-sinks: false
+  with-sources: false
+- name: sqlite
+  with-sinks: false
+  with-sources: false

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/lambdas.ql

@@ -0,0 +1,7 @@
+class LambdaExpr extends @lambdaexpr {
+  string toString() { none() }
+}
+
+from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
+where lambdas(lambda, default_capture, has_explicit_return_type, _)
+select lambda, default_capture, has_explicit_return_type

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/upgrade.properties

@@ -0,0 +1,3 @@
+description: capture whether a lambda has an explicitly specified parameter list.
+compatibility: full
+lambdas.rel: run lambdas.qlo

cpp/downgrades/59cb96ca699929b63941e81905f9b8de7eed59a6/preprocdirects.ql

@@ -11,7 +11,7 @@ int getKind(int kind) {
   if kind = 14
   then result = 6 // Represent MSFT #import as #include
   else
-    if kind = 15 or kind = 6
+    if kind = 15 or kind = 16
     then result = 3 // Represent #elifdef and #elifndef as #elif
     else result = kind
 }

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/builtintypes.ql

@@ -0,0 +1,9 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType id, string name, int kind, int new_kind, int size, int sign, int alignment
+where
+  builtintypes(id, name, kind, size, sign, alignment) and
+  if kind = 62 then new_kind = 1 else new_kind = kind
+select id, name, new_kind, size, sign, alignment

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties

@@ -0,0 +1,3 @@
+description: Support __mfp8 type
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo

cpp/ql/integration-tests/query-suite/not_included_in_qls.expected

@@ -299,6 +299,7 @@ ql/cpp/ql/src/experimental/cryptography/inventory/new_models/SigningAlgorithms.q
 ql/cpp/ql/src/experimental/cryptography/inventory/new_models/SymmetricEncryptionAlgorithms.ql
 ql/cpp/ql/src/experimental/cryptography/inventory/new_models/SymmetricPaddingAlgorithms.ql
 ql/cpp/ql/src/experimental/cryptography/inventory/new_models/UnknownAsymmetricKeyGeneration.ql
+ql/cpp/ql/src/experimental/quantum/PrintCBOMGraph.ql
 ql/cpp/ql/src/external/examples/filters/BumpMetricBy10.ql
 ql/cpp/ql/src/external/examples/filters/EditDefectMessage.ql
 ql/cpp/ql/src/external/examples/filters/ExcludeGeneratedCode.ql

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,39 @@
+## 5.1.0
+
+### New Features
+
+* Added a predicate `getReferencedMember` to `UsingDeclarationEntry`, which yields a member depending on a type template parameter.
+
+## 5.0.0
+
+### Breaking Changes
+
+* Deleted the deprecated `userInputArgument` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputReturned` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputReturn` predicate from the `Security.qll`.
+* Deleted the deprecated `isUserInput` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputArgument` predicate from the `SecurityOptions.qll`.
+* Deleted the deprecated `userInputReturned` predicate from the `SecurityOptions.qll`.
+
+### New Features
+
+* Added local flow source models for `ReadFile`, `ReadFileEx`, `MapViewOfFile`, `MapViewOfFile2`, `MapViewOfFile3`, `MapViewOfFile3FromApp`, `MapViewOfFileEx`, `MapViewOfFileFromApp`, `MapViewOfFileNuma2`, and `NtReadFile`.
+* Added the `pCmdLine` arguments of `WinMain` and `wWinMain` as local flow sources.
+* Added source models for `GetCommandLineA`, `GetCommandLineW`, `GetEnvironmentStringsA`, `GetEnvironmentStringsW`, `GetEnvironmentVariableA`, and `GetEnvironmentVariableW`.
+* Added summary models for `CommandLineToArgvA` and `CommandLineToArgvW`.
+* Added support for `wmain` as part of the ArgvSource model.
+
+### Bug Fixes
+
+* Fixed a problem where `asExpr()` on `DataFlow::Node` would never return `ArrayAggregateLiteral`s.
+* Fixed a problem where `asExpr()` on `DataFlow::Node` would never return `ClassAggregateLiteral`s.
+
+## 4.3.1
+
+### Bug Fixes
+
+* Fixed an infinite loop in `semmle.code.cpp.rangeanalysis.new.RangeAnalysis` when computing ranges in very large and complex function bodies.
+
 ## 4.3.0
 
 ### New Features

cpp/ql/lib/change-notes/2025-06-06-lambda-parameters.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a predicate `hasParameterList` to `LambdaExpression` to capture whether a lambda has an explicitly specified parameter list.

cpp/ql/lib/change-notes/released/4.3.1.md

@@ -0,0 +1,5 @@
+## 4.3.1
+
+### Bug Fixes
+
+* Fixed an infinite loop in `semmle.code.cpp.rangeanalysis.new.RangeAnalysis` when computing ranges in very large and complex function bodies.

cpp/ql/lib/change-notes/released/5.0.0.md

@@ -0,0 +1,23 @@
+## 5.0.0
+
+### Breaking Changes
+
+* Deleted the deprecated `userInputArgument` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputReturned` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputReturn` predicate from the `Security.qll`.
+* Deleted the deprecated `isUserInput` predicate and its convenience accessor from the `Security.qll`.
+* Deleted the deprecated `userInputArgument` predicate from the `SecurityOptions.qll`.
+* Deleted the deprecated `userInputReturned` predicate from the `SecurityOptions.qll`.
+
+### New Features
+
+* Added local flow source models for `ReadFile`, `ReadFileEx`, `MapViewOfFile`, `MapViewOfFile2`, `MapViewOfFile3`, `MapViewOfFile3FromApp`, `MapViewOfFileEx`, `MapViewOfFileFromApp`, `MapViewOfFileNuma2`, and `NtReadFile`.
+* Added the `pCmdLine` arguments of `WinMain` and `wWinMain` as local flow sources.
+* Added source models for `GetCommandLineA`, `GetCommandLineW`, `GetEnvironmentStringsA`, `GetEnvironmentStringsW`, `GetEnvironmentVariableA`, and `GetEnvironmentVariableW`.
+* Added summary models for `CommandLineToArgvA` and `CommandLineToArgvW`.
+* Added support for `wmain` as part of the ArgvSource model.
+
+### Bug Fixes
+
+* Fixed a problem where `asExpr()` on `DataFlow::Node` would never return `ArrayAggregateLiteral`s.
+* Fixed a problem where `asExpr()` on `DataFlow::Node` would never return `ClassAggregateLiteral`s.

cpp/ql/lib/change-notes/released/5.1.0.md

@@ -0,0 +1,5 @@
+## 5.1.0
+
+### New Features
+
+* Added a predicate `getReferencedMember` to `UsingDeclarationEntry`, which yields a member depending on a type template parameter.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.3.0
+lastReleaseVersion: 5.1.0

cpp/ql/lib/experimental/quantum/Language.qll

@@ -0,0 +1,129 @@
+private import cpp as Language
+import semmle.code.cpp.dataflow.new.TaintTracking
+import codeql.quantum.experimental.Model
+private import OpenSSL.GenericSourceCandidateLiteral
+
+module CryptoInput implements InputSig<Language::Location> {
+  class DataFlowNode = DataFlow::Node;
+
+  class LocatableElement = Language::Locatable;
+
+  class UnknownLocation = Language::UnknownDefaultLocation;
+
+  LocatableElement dfn_to_element(DataFlow::Node node) {
+    result = node.asExpr() or
+    result = node.asParameter() or
+    result = node.asVariable()
+  }
+
+  string locationToFileBaseNameAndLineNumberString(Location location) {
+    result = location.getFile().getBaseName() + ":" + location.getStartLine()
+  }
+
+  predicate artifactOutputFlowsToGenericInput(
+    DataFlow::Node artifactOutput, DataFlow::Node otherInput
+  ) {
+    ArtifactFlow::flow(artifactOutput, otherInput)
+  }
+}
+
+module Crypto = CryptographyBase<Language::Location, CryptoInput>;
+
+module ArtifactFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source = any(Crypto::ArtifactInstance artifact).getOutputNode()
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    sink = any(Crypto::FlowAwareElement other).getInputNode()
+  }
+
+  predicate isBarrierOut(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getInputNode()
+  }
+
+  predicate isBarrierIn(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getOutputNode()
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    node1.(AdditionalFlowInputStep).getOutput() = node2
+  }
+}
+
+module ArtifactFlow = DataFlow::Global<ArtifactFlowConfig>;
+
+/**
+ * Artifact output to node input configuration
+ */
+abstract class AdditionalFlowInputStep extends DataFlow::Node {
+  abstract DataFlow::Node getOutput();
+
+  final DataFlow::Node getInput() { result = this }
+}
+
+/**
+ * Generic data source to node input configuration
+ */
+module GenericDataSourceFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source = any(Crypto::GenericSourceInstance i).getOutputNode()
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    sink = any(Crypto::FlowAwareElement other).getInputNode()
+  }
+
+  predicate isBarrierOut(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getInputNode()
+  }
+
+  predicate isBarrierIn(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getOutputNode()
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    node1.(AdditionalFlowInputStep).getOutput() = node2
+  }
+}
+
+module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig>;
+
+private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
+  ConstantDataSource() { this instanceof OpenSSLGenericSourceCandidateLiteral }
+
+  override DataFlow::Node getOutputNode() { result.asExpr() = this }
+
+  override predicate flowsTo(Crypto::FlowAwareElement other) {
+    // TODO: separate config to avoid blowing up data-flow analysis
+    GenericDataSourceFlow::flow(this.getOutputNode(), other.getInputNode())
+  }
+
+  override string getAdditionalDescription() { result = this.toString() }
+}
+
+module ArtifactUniversalFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source = any(Crypto::ArtifactInstance artifact).getOutputNode()
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    sink = any(Crypto::FlowAwareElement other).getInputNode()
+  }
+
+  predicate isBarrierOut(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getInputNode()
+  }
+
+  predicate isBarrierIn(DataFlow::Node node) {
+    node = any(Crypto::FlowAwareElement element).getOutputNode()
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    node1.(AdditionalFlowInputStep).getOutput() = node2
+  }
+}
+
+module ArtifactUniversalFlow = DataFlow::Global<ArtifactUniversalFlowConfig>;
+
+import OpenSSL.OpenSSL

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

@@ -0,0 +1,173 @@
+import cpp
+private import experimental.quantum.Language
+private import semmle.code.cpp.dataflow.new.DataFlow
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import PaddingAlgorithmInstance
+
+/**
+ * Traces 'known algorithms' to AVCs, specifically
+ * algorithms that are in the set of known algorithm constants.
+ * Padding-specific consumers exist that have their own values that
+ * overlap with the known algorithm constants.
+ * Padding consumers (specific padding consumers) are excluded from the set of sinks.
+ */
+module KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source.asExpr() instanceof KnownOpenSSLAlgorithmConstant
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(OpenSSLAlgorithmValueConsumer c |
+      c.getInputNode() = sink and
+      // exclude padding algorithm consumers, since
+      // these consumers take in different constant values
+      // not in the typical "known algorithm" set
+      not c instanceof PaddingAlgorithmValueConsumer
+    )
+  }
+
+  predicate isBarrier(DataFlow::Node node) {
+    // False positive reducer, don't flow out through argv
+    exists(VariableAccess va, Variable v |
+      v.getAnAccess() = va and va = node.asExpr()
+      or
+      va = node.asIndirectExpr()
+    |
+      v.getName().matches("%argv")
+    )
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    knownPassThroughStep(node1, node2)
+  }
+}
+
+module KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow =
+  DataFlow::Global<KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig>;
+
+module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSSLPaddingLiteral }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(PaddingAlgorithmValueConsumer c | c.getInputNode() = sink)
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    knownPassThroughStep(node1, node2)
+  }
+}
+
+module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
+  DataFlow::Global<RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
+
+class OpenSSLAlgorithmAdditionalFlowStep extends AdditionalFlowInputStep {
+  OpenSSLAlgorithmAdditionalFlowStep() { exists(AlgorithmPassthroughCall c | c.getInNode() = this) }
+
+  override DataFlow::Node getOutput() {
+    exists(AlgorithmPassthroughCall c | c.getInNode() = this and c.getOutNode() = result)
+  }
+}
+
+abstract class AlgorithmPassthroughCall extends Call {
+  abstract DataFlow::Node getInNode();
+
+  abstract DataFlow::Node getOutNode();
+}
+
+class CopyAndDupAlgorithmPassthroughCall extends AlgorithmPassthroughCall {
+  DataFlow::Node inNode;
+  DataFlow::Node outNode;
+
+  CopyAndDupAlgorithmPassthroughCall() {
+    // Flow out through any return or other argument of the same type
+    // Assume flow in and out is asIndirectExpr or asDefinitingArgument since a pointer is assumed
+    // to be involved
+    // NOTE: not attempting to detect openssl specific copy/dup functions, but anything suspected to be copy/dup
+    this.getTarget().getName().toLowerCase().matches(["%_dup%", "%_copy%"]) and
+    exists(Expr inArg, Type t |
+      inArg = this.getAnArgument() and t = inArg.getUnspecifiedType().stripType()
+    |
+      inNode.asIndirectExpr() = inArg and
+      (
+        // Case 1: flow through another argument as an out arg of the same type
+        exists(Expr outArg |
+          outArg = this.getAnArgument() and
+          outArg != inArg and
+          outArg.getUnspecifiedType().stripType() = t
+        |
+          outNode.asDefiningArgument() = outArg
+        )
+        or
+        // Case 2: flow through the return value if the result is the same as the intput type
+        exists(Expr outArg | outArg = this and outArg.getUnspecifiedType().stripType() = t |
+          outNode.asIndirectExpr() = outArg
+        )
+      )
+    )
+  }
+
+  override DataFlow::Node getInNode() { result = inNode }
+
+  override DataFlow::Node getOutNode() { result = outNode }
+}
+
+class NIDToPointerPassthroughCall extends AlgorithmPassthroughCall {
+  DataFlow::Node inNode;
+  DataFlow::Node outNode;
+
+  NIDToPointerPassthroughCall() {
+    this.getTarget().getName() in ["OBJ_nid2obj", "OBJ_nid2ln", "OBJ_nid2sn"] and
+    inNode.asExpr() = this.getArgument(0) and
+    outNode.asExpr() = this
+    //outNode.asIndirectExpr() = this
+  }
+
+  override DataFlow::Node getInNode() { result = inNode }
+
+  override DataFlow::Node getOutNode() { result = outNode }
+}
+
+class PointerToPointerPassthroughCall extends AlgorithmPassthroughCall {
+  DataFlow::Node inNode;
+  DataFlow::Node outNode;
+
+  PointerToPointerPassthroughCall() {
+    this.getTarget().getName() = "OBJ_txt2obj" and
+    inNode.asIndirectExpr() = this.getArgument(0) and
+    outNode.asIndirectExpr() = this
+    or
+    //outNode.asExpr() = this
+    this.getTarget().getName() in ["OBJ_obj2txt", "i2t_ASN1_OBJECT"] and
+    inNode.asIndirectExpr() = this.getArgument(2) and
+    outNode.asDefiningArgument() = this.getArgument(0)
+  }
+
+  override DataFlow::Node getInNode() { result = inNode }
+
+  override DataFlow::Node getOutNode() { result = outNode }
+}
+
+class PointerToNIDPassthroughCall extends AlgorithmPassthroughCall {
+  DataFlow::Node inNode;
+  DataFlow::Node outNode;
+
+  PointerToNIDPassthroughCall() {
+    this.getTarget().getName() in ["OBJ_obj2nid", "OBJ_ln2nid", "OBJ_sn2nid", "OBJ_txt2nid"] and
+    (
+      inNode.asIndirectExpr() = this.getArgument(0)
+      or
+      inNode.asExpr() = this.getArgument(0)
+    ) and
+    outNode.asExpr() = this
+  }
+
+  override DataFlow::Node getInNode() { result = inNode }
+
+  override DataFlow::Node getOutNode() { result = outNode }
+}
+
+// TODO: pkeys pass through EVP_PKEY_CTX_new and any similar variant
+predicate knownPassThroughStep(DataFlow::Node node1, DataFlow::Node node2) {
+  exists(AlgorithmPassthroughCall c | c.getInNode() = node1 and c.getOutNode() = node2)
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

@@ -0,0 +1,81 @@
+import cpp
+private import experimental.quantum.Language
+private import OpenSSLAlgorithmInstanceBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import AlgToAVCFlow
+
+/**
+ * Given a `KnownOpenSSLBlockModeAlgorithmConstant`, converts this to a block family type.
+ * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
+ */
+predicate knownOpenSSLConstantToBlockModeFamilyType(
+  KnownOpenSSLBlockModeAlgorithmConstant e, Crypto::TBlockCipherModeOfOperationType type
+) {
+  exists(string name |
+    name = e.getNormalizedName() and
+    (
+      name.matches("CBC") and type instanceof Crypto::CBC
+      or
+      name.matches("CFB%") and type instanceof Crypto::CFB
+      or
+      name.matches("CTR") and type instanceof Crypto::CTR
+      or
+      name.matches("GCM") and type instanceof Crypto::GCM
+      or
+      name.matches("OFB") and type instanceof Crypto::OFB
+      or
+      name.matches("XTS") and type instanceof Crypto::XTS
+      or
+      name.matches("CCM") and type instanceof Crypto::CCM
+      or
+      name.matches("GCM") and type instanceof Crypto::GCM
+      or
+      name.matches("CCM") and type instanceof Crypto::CCM
+      or
+      name.matches("ECB") and type instanceof Crypto::ECB
+    )
+  )
+}
+
+class KnownOpenSSLBlockModeConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::ModeOfOperationAlgorithmInstance instanceof KnownOpenSSLBlockModeAlgorithmConstant
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+
+  KnownOpenSSLBlockModeConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof Literal and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+  }
+
+  override Crypto::TBlockCipherModeOfOperationType getModeType() {
+    knownOpenSSLConstantToBlockModeFamilyType(this, result)
+    or
+    not knownOpenSSLConstantToBlockModeFamilyType(this, _) and result = Crypto::OtherMode()
+  }
+
+  // NOTE: I'm not going to attempt to parse out the mode specific part, so returning
+  // the same as the raw name for now.
+  override string getRawModeAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

@@ -0,0 +1,128 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import Crypto::KeyOpAlg as KeyOpAlg
+private import OpenSSLAlgorithmInstanceBase
+private import PaddingAlgorithmInstance
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
+private import AlgToAVCFlow
+private import BlockAlgorithmInstance
+
+/**
+ * Given a `KnownOpenSSLCipherAlgorithmConstant`, converts this to a cipher family type.
+ * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
+ */
+predicate knownOpenSSLConstantToCipherFamilyType(
+  KnownOpenSSLCipherAlgorithmConstant e, Crypto::KeyOpAlg::TAlgorithm type
+) {
+  exists(string name |
+    name = e.getNormalizedName() and
+    (
+      name.matches("AES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::AES())
+      or
+      name.matches("ARIA%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::ARIA())
+      or
+      name.matches("BLOWFISH%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::BLOWFISH())
+      or
+      name.matches("BF%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::BLOWFISH())
+      or
+      name.matches("CAMELLIA%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CAMELLIA())
+      or
+      name.matches("CHACHA20%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CHACHA20())
+      or
+      name.matches("CAST5%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::CAST5())
+      or
+      name.matches("2DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DoubleDES())
+      or
+      name.matches("3DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::TripleDES())
+      or
+      name.matches("DES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DES())
+      or
+      name.matches("DESX%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::DESX())
+      or
+      name.matches("GOST%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::GOST())
+      or
+      name.matches("IDEA%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::IDEA())
+      or
+      name.matches("KUZNYECHIK%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::KUZNYECHIK())
+      or
+      name.matches("MAGMA%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::MAGMA())
+      or
+      name.matches("RC2%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC2())
+      or
+      name.matches("RC4%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC4())
+      or
+      name.matches("RC5%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::RC5())
+      or
+      name.matches("RSA%") and type = KeyOpAlg::TAsymmetricCipher(KeyOpAlg::RSA())
+      or
+      name.matches("SEED%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::SEED())
+      or
+      name.matches("SM4%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::SM4())
+    )
+  )
+}
+
+class KnownOpenSSLCipherConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::KeyOperationAlgorithmInstance instanceof KnownOpenSSLCipherAlgorithmConstant
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+
+  KnownOpenSSLCipherConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof Literal and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+  }
+
+  override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() {
+    // if there is a block mode associated with the same element, then that's the block mode
+    // note, if none are associated, we may need to parse if the cipher is a block cipher
+    // to determine if this is an unknown vs not relevant.
+    result = this
+  }
+
+  override Crypto::PaddingAlgorithmInstance getPaddingAlgorithm() {
+    //TODO: the padding is either self, or it flows through getter ctx to a set padding call
+    // like EVP_PKEY_CTX_set_rsa_padding
+    result = this
+    // TODO or trace through getter ctx to set padding
+  }
+
+  override string getRawAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override int getKeySizeFixed() {
+    this.(KnownOpenSSLCipherAlgorithmConstant).getExplicitKeySize() = result
+  }
+
+  override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
+    knownOpenSSLConstantToCipherFamilyType(this, result)
+    or
+    not knownOpenSSLConstantToCipherFamilyType(this, _) and
+    result = Crypto::KeyOpAlg::TUnknownKeyOperationAlgorithmType()
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+
+  override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
+    // TODO: trace to any key size initializer, symmetric and asymmetric
+    none()
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

@@ -0,0 +1,53 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import OpenSSLAlgorithmInstanceBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
+private import AlgToAVCFlow
+
+class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::EllipticCurveInstance instanceof KnownOpenSSLEllipticCurveAlgorithmConstant
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+
+  KnownOpenSSLEllipticCurveConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof Literal and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+
+  override string getRawEllipticCurveName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override Crypto::TEllipticCurveType getEllipticCurveType() {
+    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.getParsedEllipticCurveName(), _, result)
+  }
+
+  override string getParsedEllipticCurveName() {
+    result = this.(KnownOpenSSLEllipticCurveAlgorithmConstant).getNormalizedName()
+  }
+
+  override int getKeySize() {
+    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant)
+          .getNormalizedName(), result, _)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

@@ -0,0 +1,88 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import AlgToAVCFlow
+
+predicate knownOpenSSLConstantToHashFamilyType(
+  KnownOpenSSLHashAlgorithmConstant e, Crypto::THashType type
+) {
+  exists(string name |
+    name = e.getNormalizedName() and
+    (
+      name.matches("BLAKE2B") and type instanceof Crypto::BLAKE2B
+      or
+      name.matches("BLAKE2S") and type instanceof Crypto::BLAKE2S
+      or
+      name.matches("GOST%") and type instanceof Crypto::GOSTHash
+      or
+      name.matches("MD2") and type instanceof Crypto::MD2
+      or
+      name.matches("MD4") and type instanceof Crypto::MD4
+      or
+      name.matches("MD5") and type instanceof Crypto::MD5
+      or
+      name.matches("MDC2") and type instanceof Crypto::MDC2
+      or
+      name.matches("POLY1305") and type instanceof Crypto::POLY1305
+      or
+      name.matches(["SHA", "SHA1"]) and type instanceof Crypto::SHA1
+      or
+      name.matches("SHA+%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
+      or
+      name.matches("SHA3-%") and type instanceof Crypto::SHA3
+      or
+      name.matches(["SHAKE"]) and type instanceof Crypto::SHAKE
+      or
+      name.matches("SM3") and type instanceof Crypto::SM3
+      or
+      name.matches("RIPEMD160") and type instanceof Crypto::RIPEMD160
+      or
+      name.matches("WHIRLPOOL") and type instanceof Crypto::WHIRLPOOL
+    )
+  )
+}
+
+class KnownOpenSSLHashConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::HashAlgorithmInstance instanceof KnownOpenSSLHashAlgorithmConstant
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+
+  KnownOpenSSLHashConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof Literal and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+
+  override Crypto::THashType getHashFamily() {
+    knownOpenSSLConstantToHashFamilyType(this, result)
+    or
+    not knownOpenSSLConstantToHashFamilyType(this, _) and result = Crypto::OtherHashType()
+  }
+
+  override string getRawHashAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override int getFixedDigestLength() {
+    this.(KnownOpenSSLHashAlgorithmConstant).getExplicitDigestLength() = result
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KeyAgreementAlgorithmInstance.qll

@@ -0,0 +1,63 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import AlgToAVCFlow
+
+predicate knownOpenSSLConstantToKeyAgreementFamilyType(
+  KnownOpenSSLKeyAgreementAlgorithmConstant e, Crypto::TKeyAgreementType type
+) {
+  exists(string name |
+    name = e.getNormalizedName() and
+    (
+      name = "ECDH" and type = Crypto::ECDH()
+      or
+      name = "DH" and type = Crypto::DH()
+      or
+      name = "EDH" and type = Crypto::EDH()
+      or
+      name = "ESDH" and type = Crypto::EDH()
+    )
+  )
+}
+
+class KnownOpenSSLHashConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::KeyAgreementAlgorithmInstance instanceof KnownOpenSSLKeyAgreementAlgorithmConstant
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+
+  KnownOpenSSLHashConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof Literal and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+
+  override Crypto::TKeyAgreementType getKeyAgreementType() {
+    knownOpenSSLConstantToKeyAgreementFamilyType(this, result)
+    or
+    not knownOpenSSLConstantToKeyAgreementFamilyType(this, _) and
+    result = Crypto::OtherKeyAgreementType()
+  }
+
+  override string getRawKeyAgreementAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/OpenSSLAlgorithmInstanceBase.qll

@@ -0,0 +1,6 @@
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+
+abstract class OpenSSLAlgorithmInstance extends Crypto::AlgorithmInstance {
+  abstract OpenSSLAlgorithmValueConsumer getAVC();
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/OpenSSLAlgorithmInstances.qll

@@ -0,0 +1,6 @@
+import OpenSSLAlgorithmInstanceBase
+import CipherAlgorithmInstance
+import PaddingAlgorithmInstance
+import BlockAlgorithmInstance
+import HashAlgorithmInstance
+import EllipticCurveAlgorithmInstance

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll

@@ -0,0 +1,178 @@
+import cpp
+private import experimental.quantum.Language
+private import OpenSSLAlgorithmInstanceBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import AlgToAVCFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+
+/**
+ * A class to define padding specific integer values.
+ * from rsa.h in openssl:
+ *     # define RSA_PKCS1_PADDING          1
+ *     # define RSA_NO_PADDING             3
+ *     # define RSA_PKCS1_OAEP_PADDING     4
+ *     # define RSA_X931_PADDING           5
+ *     # define RSA_PKCS1_PSS_PADDING      6
+ *     # define RSA_PKCS1_WITH_TLS_PADDING 7
+ *     # define RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING 8
+ */
+class OpenSSLPaddingLiteral extends Literal {
+  // TODO: we can be more specific about where the literal is in a larger expression
+  // to avoid literals that are clealy not representing an algorithm, e.g., array indices.
+  OpenSSLPaddingLiteral() { this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8] }
+}
+
+/**
+ * Given a `KnownOpenSSLPaddingAlgorithmConstant`, converts this to a padding family type.
+ * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
+ */
+predicate knownOpenSSLConstantToPaddingFamilyType(
+  KnownOpenSSLPaddingAlgorithmConstant e, Crypto::TPaddingType type
+) {
+  exists(string name |
+    name = e.getNormalizedName() and
+    (
+      name.matches("OAEP") and type = Crypto::OAEP()
+      or
+      name.matches("PSS") and type = Crypto::PSS()
+      or
+      name.matches("PKCS7") and type = Crypto::PKCS7()
+      or
+      name.matches("PKCS1V15") and type = Crypto::PKCS1_v1_5()
+    )
+  )
+}
+
+//abstract class OpenSSLPaddingAlgorithmInstance extends OpenSSLAlgorithmInstance, Crypto::PaddingAlgorithmInstance{}
+// TODO: need to alter this to include known padding constants which don't have the
+// same mechanics as those with known nids
+class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+  Crypto::PaddingAlgorithmInstance instanceof Expr
+{
+  OpenSSLAlgorithmValueConsumer getterCall;
+  boolean isPaddingSpecificConsumer;
+
+  KnownOpenSSLPaddingConstantAlgorithmInstance() {
+    // three possibilities:
+    // 1) The source is a 'typical' literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 3) the source is a padding-specific literal flowing to a padding-specific consumer
+    // Possibility 1:
+    this instanceof Literal and
+    this instanceof KnownOpenSSLPaddingAlgorithmConstant and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink) and
+      isPaddingSpecificConsumer = false
+    )
+    or
+    // Possibility 2:
+    this instanceof DirectAlgorithmValueConsumer and
+    getterCall = this and
+    this instanceof KnownOpenSSLPaddingAlgorithmConstant and
+    isPaddingSpecificConsumer = false
+    or
+    // Possibility 3: padding-specific literal
+    this instanceof OpenSSLPaddingLiteral and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a padding-specific consumer
+      RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow::flow(src, sink)
+    ) and
+    isPaddingSpecificConsumer = true
+  }
+
+  override string getRawPaddingAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+
+  Crypto::TPaddingType getKnownPaddingType() {
+    this.(Literal).getValue().toInt() in [1, 7, 8] and result = Crypto::PKCS1_v1_5()
+    or
+    this.(Literal).getValue().toInt() = 3 and result = Crypto::NoPadding()
+    or
+    this.(Literal).getValue().toInt() = 4 and result = Crypto::OAEP()
+    or
+    this.(Literal).getValue().toInt() = 5 and result = Crypto::ANSI_X9_23()
+    or
+    this.(Literal).getValue().toInt() = 6 and result = Crypto::PSS()
+  }
+
+  override Crypto::TPaddingType getPaddingType() {
+    isPaddingSpecificConsumer = true and
+    (
+      result = this.getKnownPaddingType()
+      or
+      not exists(this.getKnownPaddingType()) and result = Crypto::OtherPadding()
+    )
+    or
+    isPaddingSpecificConsumer = false and
+    knownOpenSSLConstantToPaddingFamilyType(this, result)
+  }
+}
+
+// // Values used for EVP_PKEY_CTX_set_rsa_padding, these are
+// // not the same as 'typical' constants found in the set of known algorithm constants
+// // they do not have an NID
+// // TODO: what about setting the padding directly?
+// class KnownRSAPaddingConstant extends OpenSSLPaddingAlgorithmInstance, Crypto::PaddingAlgorithmInstance instanceof Literal
+// {
+//   KnownRSAPaddingConstant() {
+//     // from rsa.h in openssl:
+//     // # define RSA_PKCS1_PADDING          1
+//     // # define RSA_NO_PADDING             3
+//     // # define RSA_PKCS1_OAEP_PADDING     4
+//     // # define RSA_X931_PADDING           5
+//     // /* EVP_PKEY_ only */
+//     // # define RSA_PKCS1_PSS_PADDING      6
+//     // # define RSA_PKCS1_WITH_TLS_PADDING 7
+//     // /* internal RSA_ only */
+//     // # define RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING 8
+//     this instanceof Literal and
+//     this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8]
+//     // TODO: trace to padding-specific consumers
+//     RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow
+//   }
+//   override string getRawPaddingAlgorithmName() { result = this.(Literal).getValue().toString() }
+//   override Crypto::TPaddingType getPaddingType() {
+//     if this.(Literal).getValue().toInt() in [1, 6, 7, 8]
+//     then result = Crypto::PKCS1_v1_5()
+//     else
+//       if this.(Literal).getValue().toInt() = 3
+//       then result = Crypto::NoPadding()
+//       else
+//         if this.(Literal).getValue().toInt() = 4
+//         then result = Crypto::OAEP()
+//         else
+//           if this.(Literal).getValue().toInt() = 5
+//           then result = Crypto::ANSI_X9_23()
+//           else result = Crypto::OtherPadding()
+//   }
+// }
+class OAEPPaddingAlgorithmInstance extends Crypto::OAEPPaddingAlgorithmInstance,
+  KnownOpenSSLPaddingConstantAlgorithmInstance
+{
+  OAEPPaddingAlgorithmInstance() {
+    this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = Crypto::OAEP()
+  }
+
+  override Crypto::HashAlgorithmInstance getOAEPEncodingHashAlgorithm() {
+    none() //TODO
+  }
+
+  override Crypto::HashAlgorithmInstance getMGF1HashAlgorithm() {
+    none() //TODO
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/CipherAlgorithmValueConsumer.qll

@@ -0,0 +1,37 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import OpenSSLAlgorithmValueConsumerBase
+
+abstract class CipherAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+// https://www.openssl.org/docs/manmaster/man3/EVP_CIPHER_fetch.html
+class EVPCipherAlgorithmValueConsumer extends CipherAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPCipherAlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    (
+      this.(Call).getTarget().getName() in [
+          "EVP_get_cipherbyname", "EVP_get_cipherbyobj", "EVP_get_cipherbynid"
+        ] and
+      valueArgNode.asExpr() = this.(Call).getArgument(0)
+      or
+      this.(Call).getTarget().getName() in ["EVP_CIPHER_fetch", "EVP_ASYM_CIPHER_fetch"] and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+    )
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  // override DataFlow::Node getInputNode() { result = valueArgNode }
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    //TODO: As a potential alternative, for OpenSSL only, add a generic source node for literals and only create flow (flowsTo) to
+    // OpenSSL AVCs... the unknown literal sources would have to be any literals not in the known set.
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/DirectAlgorithmValueConsumer.qll

@@ -0,0 +1,35 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+
+/**
+ * Cases like EVP_MD5(),
+ * there is no input, rather it directly gets an algorithm
+ * and returns it.
+ */
+class DirectAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer {
+  DataFlow::Node resultNode;
+  Expr resultExpr;
+
+  DirectAlgorithmValueConsumer() {
+    this instanceof KnownOpenSSLAlgorithmConstant and
+    this instanceof Call and
+    resultExpr = this and
+    resultNode.asExpr() = resultExpr
+  }
+
+  /**
+   * These cases take in no explicit value (the value is implicit)
+   */
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  //   override DataFlow::Node getOutputNode() { result = resultNode }
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    // Note: algorithm source definitions enforces that
+    // this class will be a known algorithm source
+    result = this
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/EllipticCurveAlgorithmValueConsumer.qll

@@ -0,0 +1,34 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
+
+abstract class EllipticCurveValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+//https://docs.openssl.org/3.0/man3/EC_KEY_new/#name
+class EVPEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPEllipticCurveAlgorithmConsumer() {
+    resultNode.asExpr() = this.(Call) and // in all cases the result is the return
+    (
+      this.(Call).getTarget().getName() in ["EVP_EC_gen", "EC_KEY_new_by_curve_name"] and
+      valueArgNode.asExpr() = this.(Call).getArgument(0)
+      or
+      this.(Call).getTarget().getName() in [
+          "EC_KEY_new_by_curve_name_ex", "EVP_PKEY_CTX_set_ec_paramgen_curve_nid"
+        ] and
+      valueArgNode.asExpr() = this.(Call).getArgument(2)
+    )
+  }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll

@@ -0,0 +1,58 @@
+import cpp
+private import experimental.quantum.Language
+private import semmle.code.cpp.dataflow.new.DataFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
+
+abstract class HashAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+/**
+ * EVP_Q_Digest directly consumes algorithm constant values
+ */
+class EVP_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
+  EVP_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() {
+    result.asExpr() = this.(Call).getArgument(1)
+  }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+
+  override DataFlow::Node getResultNode() {
+    // EVP_Q_Digest directly consumes the algorithm constant value and performs the operation, there is no
+    // algorithm result
+    none()
+  }
+}
+
+/**
+ * The EVP digest algorithm getters
+ * https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
+ */
+class EVPDigestAlgorithmValueConsumer extends HashAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPDigestAlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    (
+      this.(Call).getTarget().getName() in [
+          "EVP_get_digestbyname", "EVP_get_digestbynid", "EVP_get_digestbyobj"
+        ] and
+      valueArgNode.asExpr() = this.(Call).getArgument(0)
+      or
+      this.(Call).getTarget().getName() = "EVP_MD_fetch" and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+    )
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/KEMAlgorithmValueConsumer.qll

@@ -0,0 +1,28 @@
+import cpp
+private import experimental.quantum.Language
+private import semmle.code.cpp.dataflow.new.DataFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
+
+abstract class KEMAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+class EVPKEMAlgorithmValueConsumer extends KEMAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPKEMAlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    (
+      this.(Call).getTarget().getName() = "EVP_KEM_fetch" and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+    )
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/KeyExchangeAlgorithmValueConsumer.qll

@@ -0,0 +1,28 @@
+import cpp
+private import experimental.quantum.Language
+private import semmle.code.cpp.dataflow.new.DataFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
+
+abstract class KeyExchangeAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+class EVPKeyExchangeAlgorithmValueConsumer extends KeyExchangeAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPKeyExchangeAlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    (
+      this.(Call).getTarget().getName() = "EVP_KEYEXCH_fetch" and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+    )
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/OpenSSLAlgorithmValueConsumerBase.qll

@@ -0,0 +1,8 @@
+private import experimental.quantum.Language
+
+abstract class OpenSSLAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer instanceof Call {
+  /**
+   * Returns the node representing the resulting algorithm
+   */
+  abstract DataFlow::Node getResultNode();
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/OpenSSLAlgorithmValueConsumers.qll

@@ -0,0 +1,7 @@
+import OpenSSLAlgorithmValueConsumerBase
+import CipherAlgorithmValueConsumer
+import DirectAlgorithmValueConsumer
+import PaddingAlgorithmValueConsumer
+import HashAlgorithmValueConsumer
+import EllipticCurveAlgorithmValueConsumer
+import PKeyAlgorithmValueConsumer

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PKeyAlgorithmValueConsumer.qll

@@ -0,0 +1,55 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
+
+abstract class PKeyValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+class EVPPKeyAlgorithmConsumer extends PKeyValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVPPKeyAlgorithmConsumer() {
+    resultNode.asExpr() = this.(Call) and // in all cases the result is the return
+    (
+      // NOTE: some of these consumers are themselves key gen operations,
+      // in these cases, the operation will be created separately for the same function.
+      this.(Call).getTarget().getName() in [
+          "EVP_PKEY_CTX_new_id", "EVP_PKEY_new_raw_private_key", "EVP_PKEY_new_raw_public_key",
+          "EVP_PKEY_new_mac_key"
+        ] and
+      valueArgNode.asExpr() = this.(Call).getArgument(0)
+      or
+      this.(Call).getTarget().getName() in [
+          "EVP_PKEY_CTX_new_from_name", "EVP_PKEY_new_raw_private_key_ex",
+          "EVP_PKEY_new_raw_public_key_ex", "EVP_PKEY_CTX_ctrl", "EVP_PKEY_CTX_set_group_name"
+        ] and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+      or
+      // argInd 2 is 'type' which can be RSA, or EC
+      // if RSA argInd 3 is the key size, else if EC argInd 3 is the curve name
+      // In all other cases there is no argInd 3, and argInd 2 is the algorithm.
+      // Since this is a key gen operation, handling the key size should be handled
+      // when the operation is again modeled as a key gen operation.
+      this.(Call).getTarget().getName() = "EVP_PKEY_Q_keygen" and
+      (
+        // Elliptic curve case
+        // If the argInd 3 is a derived type (pointer or array) then assume it is a curve name
+        if this.(Call).getArgument(3).getType().getUnderlyingType() instanceof DerivedType
+        then valueArgNode.asExpr() = this.(Call).getArgument(3)
+        else
+          // All other cases
+          valueArgNode.asExpr() = this.(Call).getArgument(2)
+      )
+    )
+  }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PaddingAlgorithmValueConsumer.qll

@@ -0,0 +1,32 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import OpenSSLAlgorithmValueConsumerBase
+
+abstract class PaddingAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+
+// https://docs.openssl.org/master/man7/EVP_ASYM_CIPHER-RSA/#rsa-asymmetric-cipher-parameters
+// TODO: need to handle setting padding through EVP_PKEY_CTX_set_params, where modes like "OSSL_PKEY_RSA_PAD_MODE_OAEP"
+// are set.
+class EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer extends PaddingAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_rsa_padding" and
+    valueArgNode.asExpr() = this.(Call).getArgument(1)
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  // override DataFlow::Node getInputNode() { result = valueArgNode }
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    //TODO: As a potential alternative, for OpenSSL only, add a generic source node for literals and only create flow (flowsTo) to
+    // OpenSSL AVCs... the unknown literal sources would have to be any literals not in the known set.
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/CtxFlow.qll

@@ -0,0 +1,139 @@
+//TODO: model as data on open APIs should be able to get common flows, and obviate some of this
+// e.g., copy/dup calls, need to ingest those models for openSSL and refactor.
+/**
+ * In OpenSSL, flow between 'context' parameters is often used to
+ * store state/config of how an operation will eventually be performed.
+ * Tracing algorithms and configurations to operations therefore
+ * requires tracing context parameters for many OpenSSL apis.
+ *
+ * This library provides a dataflow analysis to track context parameters
+ * between any two functions accepting openssl context parameters.
+ * The dataflow takes into consideration flowing through duplication and copy calls
+ * as well as flow through flow killers (free/reset calls).
+ *
+ * TODO: we may need to revisit 'free' as a dataflow killer, depending on how
+ * we want to model use after frees.
+ *
+ * This library also provides classes to represent context Types and relevant
+ * arguments/expressions.
+ */
+
+import semmle.code.cpp.dataflow.new.DataFlow
+
+/**
+ * An openSSL CTX type, which is type for which the stripped underlying type
+ * matches the pattern 'evp_%ctx_%st'.
+ * This includes types like:
+ * - EVP_CIPHER_CTX
+ * - EVP_MD_CTX
+ * - EVP_PKEY_CTX
+ */
+private class CtxType extends Type {
+  CtxType() {
+    // It is possible for users to use the underlying type of the CTX variables
+    // these have a name matching 'evp_%ctx_%st
+    this.getUnspecifiedType().stripType().getName().matches("evp_%ctx_%st")
+    or
+    // In principal the above check should be sufficient, but in case of build mode none issues
+    // i.e., if a typedef cannot be resolved,
+    // or issues with properly stubbing test cases, we also explicitly check for the wrapping type defs
+    // i.e., patterns matching 'EVP_%_CTX'
+    exists(Type base | base = this or base = this.(DerivedType).getBaseType() |
+      base.getName().matches("EVP_%_CTX")
+    )
+  }
+}
+
+/**
+ * A pointer to a CtxType
+ */
+private class CtxPointerExpr extends Expr {
+  CtxPointerExpr() {
+    this.getType() instanceof CtxType and
+    this.getType() instanceof PointerType
+  }
+}
+
+/**
+ * A call argument of type CtxPointerExpr.
+ */
+private class CtxPointerArgument extends CtxPointerExpr {
+  CtxPointerArgument() { exists(Call c | c.getAnArgument() = this) }
+
+  Call getCall() { result.getAnArgument() = this }
+}
+
+/**
+ * A call whose target contains 'free' or 'reset' and has an argument of type
+ * CtxPointerArgument.
+ */
+private class CtxClearCall extends Call {
+  CtxClearCall() {
+    this.getTarget().getName().toLowerCase().matches(["%free%", "%reset%"]) and
+    this.getAnArgument() instanceof CtxPointerArgument
+  }
+}
+
+/**
+ * A call whose target contains 'copy' and has an argument of type
+ * CtxPointerArgument.
+ */
+private class CtxCopyOutArgCall extends Call {
+  CtxCopyOutArgCall() {
+    this.getTarget().getName().toLowerCase().matches("%copy%") and
+    this.getAnArgument() instanceof CtxPointerArgument
+  }
+}
+
+/**
+ * A call whose target contains 'dup' and has an argument of type
+ * CtxPointerArgument.
+ */
+private class CtxCopyReturnCall extends Call, CtxPointerExpr {
+  CtxCopyReturnCall() {
+    this.getTarget().getName().toLowerCase().matches("%dup%") and
+    this.getAnArgument() instanceof CtxPointerArgument
+  }
+}
+
+/**
+ * Flow from any CtxPointerArgument to any other CtxPointerArgument
+ */
+module OpenSSLCtxArgumentFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof CtxPointerArgument }
+
+  predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof CtxPointerArgument }
+
+  predicate isBarrier(DataFlow::Node node) {
+    exists(CtxClearCall c | c.getAnArgument() = node.asExpr())
+  }
+
+  predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
+    exists(CtxCopyOutArgCall c |
+      c.getAnArgument() = node1.asExpr() and
+      c.getAnArgument() = node2.asExpr() and
+      node1.asExpr() != node2.asExpr() and
+      node2.asExpr().getType() instanceof CtxType
+    )
+    or
+    exists(CtxCopyReturnCall c |
+      c.getAnArgument() = node1.asExpr() and
+      c = node2.asExpr() and
+      node1.asExpr() != node2.asExpr() and
+      node2.asExpr().getType() instanceof CtxType
+    )
+  }
+}
+
+module OpenSSLCtxArgumentFlow = DataFlow::Global<OpenSSLCtxArgumentFlowConfig>;
+
+/**
+ * Holds if there is a context flow from the source to the sink.
+ */
+predicate ctxArgFlowsToCtxArg(CtxPointerArgument source, CtxPointerArgument sink) {
+  exists(DataFlow::Node a, DataFlow::Node b |
+    OpenSSLCtxArgumentFlow::flow(a, b) and
+    a.asExpr() = source and
+    b.asExpr() = sink
+  )
+}

cpp/ql/lib/experimental/quantum/OpenSSL/GenericSourceCandidateLiteral.qll

@@ -0,0 +1,122 @@
+import cpp
+private import semmle.code.cpp.models.Models
+private import semmle.code.cpp.models.interfaces.FormattingFunction
+
+private class IntLiteral extends Literal {
+  IntLiteral() {
+    //Heuristics for distinguishing int literals from other literals
+    exists(this.getValue().toInt()) and
+    not this instanceof CharLiteral and
+    not this instanceof StringLiteral
+  }
+}
+
+/**
+ * Holds if a StringLiteral could conceivably be used in some way for cryptography.
+ * Note: this predicate should only consider restrictions with respect to strings only.
+ * General restrictions are in the OpenSSLGenericSourceCandidateLiteral class.
+ */
+private predicate isOpenSSLStringLiteralGenericSourceCandidate(StringLiteral s) {
+  // 'EC' is a constant that may be used where typical algorithms are specified,
+  // but EC specifically means set up a default curve container, that will later be
+  //specified explicitly (or if not a default) curve is used.
+  s.getValue() != "EC" and
+  // Ignore empty strings
+  s.getValue() != "" and
+  // Filter out strings with "%", to filter out format strings
+  not s.getValue().matches("%\\%%") and
+  // Filter out strings in brackets or braces (commonly seen strings not relevant for crypto)
+  not s.getValue().matches(["[%]", "(%)"]) and
+  // Filter out all strings of length 1, since these are not algorithm names
+  // NOTE/ASSUMPTION: If a user legitimately passes a string of length 1 to some configuration
+  // we will assume this is generally unknown. We may need to reassess this in the future.
+  s.getValue().length() > 1 and
+  // Ignore all strings that are in format string calls outputing to a stream (e.g., stdout)
+  not exists(FormattingFunctionCall f |
+    exists(f.getOutputArgument(true)) and s = f.(Call).getAnArgument()
+  ) and
+  // Ignore all format string calls where there is no known out param (resulting string)
+  // i.e., ignore printf, since it will just output a string and not produce a new string
+  not exists(FormattingFunctionCall f |
+    // Note: using two ways of determining if there is an out param, since I'm not sure
+    // which way is canonical
+    not exists(f.getOutputArgument(false)) and
+    not f.getTarget().hasTaintFlow(_, _) and
+    f.(Call).getAnArgument() = s
+  )
+}
+
+/**
+ * Holds if a StringLiteral could conceivably be used in some way for cryptography.
+ * Note: this predicate should only consider restrictions with respect to integers only.
+ * General restrictions are in the OpenSSLGenericSourceCandidateLiteral class.
+ */
+private predicate isOpenSSLIntLiteralGenericSourceCandidate(IntLiteral l) {
+  // Ignore integer values of 0, commonly referring to NULL only (no known algorithm 0)
+  l.getValue().toInt() != 0 and
+  // ASSUMPTION, no negative numbers are allowed
+  // RATIONALE: this is a performance improvement to avoid having to trace every number
+  not exists(UnaryMinusExpr u | u.getOperand() = l) and
+  //  OPENSSL has a special macro for getting every line, ignore it
+  not exists(MacroInvocation mi | mi.getExpr() = l and mi.getMacroName() = "OPENSSL_LINE") and
+  // Filter out cases where an int is returned into a pointer, e.g., return NULL;
+  not exists(ReturnStmt r |
+    r.getExpr() = l and
+    r.getEnclosingFunction().getType().getUnspecifiedType() instanceof DerivedType
+  ) and
+  // A literal as an array index should not be relevant for crypo
+  not exists(ArrayExpr op | op.getArrayOffset() = l) and
+  // A literal used in a bitwise should not be relevant for crypto
+  not exists(BinaryBitwiseOperation op | op.getAnOperand() = l) and
+  not exists(AssignBitwiseOperation op | op.getAnOperand() = l) and
+  //Filter out cases where an int is assigned or initialized into a pointer, e.g., char* x = NULL;
+  not exists(Assignment a |
+    a.getRValue() = l and
+    a.getLValue().getType().getUnspecifiedType() instanceof DerivedType
+  ) and
+  not exists(Initializer i |
+    i.getExpr() = l and
+    i.getDeclaration().getADeclarationEntry().getUnspecifiedType() instanceof DerivedType
+  ) and
+  // Filter out cases where the literal is used in any kind of arithmetic operation
+  not exists(BinaryArithmeticOperation op | op.getAnOperand() = l) and
+  not exists(UnaryArithmeticOperation op | op.getOperand() = l) and
+  not exists(AssignArithmeticOperation op | op.getAnOperand() = l) and
+  // If a literal has no parent ignore it, this is a workaround for the current inability
+  // to find a literal in an array declaration: int x[100];
+  // NOTE/ASSUMPTION: this value might actually be relevant for finding hard coded sizes
+  // consider size as inferred through the allocation of a buffer.
+  // In these cases, we advise that the source is not generic and must be traced explicitly.
+  exists(l.getParent())
+}
+
+/**
+ * Any literal that may be conceivably be used in some way for cryptography.
+ * The set of all literals is restricted by this class to cases where there is higher
+ * plausibility that the literal could be used as a source of configuration.
+ * Literals are filtered, for example, if they are used in a way no indicative of an algorithm use
+ * such as in an array index, bitwise operation, or logical operation.
+ * Note a case like this:
+ *      if(algVal == "AES")
+ *
+ * "AES" may be a legitimate algorithm literal, but the literal will not be used for an operation directly
+ * since it is in a equality comparison, hence this case would also be filtered.
+ */
+class OpenSSLGenericSourceCandidateLiteral extends Literal {
+  OpenSSLGenericSourceCandidateLiteral() {
+    (
+      isOpenSSLIntLiteralGenericSourceCandidate(this) or
+      isOpenSSLStringLiteralGenericSourceCandidate(this)
+    ) and
+    // ********* General filters beyond what is filtered for strings and ints *********
+    // An algorithm literal in a switch case will not be directly applied to an operation.
+    not exists(SwitchCase sc | sc.getExpr() = this) and
+    // A literal in a logical operation may be an algorithm, but not a candidate
+    // for the purposes of finding applied algorithms
+    not exists(BinaryLogicalOperation op | op.getAnOperand() = this) and
+    not exists(UnaryLogicalOperation op | op.getOperand() = this) and
+    // A literal in a comparison operation may be an algorithm, but not a candidate
+    // for the purposes of finding applied algorithms
+    not exists(ComparisonOperation op | op.getAnOperand() = this)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/LibraryDetector.qll

@@ -0,0 +1,7 @@
+import cpp
+
+predicate isPossibleOpenSSLFunction(Function f) {
+  isPossibleOpenSSLLocation(f.getADeclarationLocation())
+}
+
+predicate isPossibleOpenSSLLocation(Location l) { l.toString().toLowerCase().matches("%openssl%") }

cpp/ql/lib/experimental/quantum/OpenSSL/OpenSSL.qll

@@ -0,0 +1,7 @@
+module OpenSSLModel {
+  import AlgorithmInstances.OpenSSLAlgorithmInstances
+  import AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+  import Operations.OpenSSLOperations
+  import Random
+  import GenericSourceCandidateLiteral
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll

@@ -0,0 +1,34 @@
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import OpenSSLOperationBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import semmle.code.cpp.dataflow.new.DataFlow
+
+class ECKeyGenOperation extends OpenSSLOperation, Crypto::KeyGenerationOperationInstance {
+  ECKeyGenOperation() { this.(Call).getTarget().getName() = "EC_KEY_generate_key" }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(0) }
+
+  override Crypto::KeyArtifactType getOutputKeyType() { result = Crypto::TAsymmetricKeyType() }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputKeyArtifact() {
+    result.asExpr() = this.(Call).getArgument(0)
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
+    none() // no explicit key size, inferred from algorithm
+  }
+
+  override int getKeySizeFixed() {
+    none()
+    // TODO: marked as none as the operation itself has no key size, it
+    // comes from the algorithm source, but note we could grab the
+    // algorithm source and get the key size (see below).
+    // We may need to reconsider what is the best approach here.
+    // result =
+    //   this.getAnAlgorithmValueConsumer()
+    //       .getAKnownAlgorithmSource()
+    //       .(Crypto::EllipticCurveInstance)
+    //       .getKeySize()
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherInitializer.qll

@@ -0,0 +1,117 @@
+/**
+ * see: https://docs.openssl.org/master/man3/EVP_EncryptInit/
+ * Models cipher initialization for EVP cipher operations.
+ */
+
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import OpenSSLOperationBase
+
+module EncValToInitEncArgConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source.asExpr().getValue().toInt() in [0, 1] }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(EVP_Cipher_Initializer initCall | sink.asExpr() = initCall.getOperationSubtypeArg())
+  }
+}
+
+module EncValToInitEncArgFlow = DataFlow::Global<EncValToInitEncArgConfig>;
+
+int getEncConfigValue(Expr e) {
+  exists(EVP_Cipher_Initializer initCall | e = initCall.getOperationSubtypeArg()) and
+  exists(DataFlow::Node a, DataFlow::Node b |
+    EncValToInitEncArgFlow::flow(a, b) and b.asExpr() = e and result = a.asExpr().getValue().toInt()
+  )
+}
+
+bindingset[i]
+Crypto::KeyOperationSubtype intToCipherOperationSubtype(int i) {
+  if i = 0
+  then result instanceof Crypto::TEncryptMode
+  else
+    if i = 1
+    then result instanceof Crypto::TDecryptMode
+    else result instanceof Crypto::TUnknownKeyOperationMode
+}
+
+// TODO: need to add key consumer
+abstract class EVP_Cipher_Initializer extends EVPInitialize {
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+
+  abstract Expr getOperationSubtypeArg();
+
+  override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
+    if this.(Call).getTarget().getName().toLowerCase().matches("%encrypt%")
+    then result instanceof Crypto::TEncryptMode
+    else
+      if this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%")
+      then result instanceof Crypto::TDecryptMode
+      else
+        if exists(getEncConfigValue(this.getOperationSubtypeArg()))
+        then result = intToCipherOperationSubtype(getEncConfigValue(this.getOperationSubtypeArg()))
+        else result instanceof Crypto::TUnknownKeyOperationMode
+  }
+}
+
+abstract class EVP_EX_Initializer extends EVP_Cipher_Initializer {
+  override Expr getKeyArg() { result = this.(Call).getArgument(3) }
+
+  override Expr getIVArg() { result = this.(Call).getArgument(4) }
+}
+
+abstract class EVP_EX2_Initializer extends EVP_Cipher_Initializer {
+  override Expr getKeyArg() { result = this.(Call).getArgument(2) }
+
+  override Expr getIVArg() { result = this.(Call).getArgument(3) }
+}
+
+class EVP_Cipher_EX_Init_Call extends EVP_EX_Initializer {
+  EVP_Cipher_EX_Init_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptInit_ex", "EVP_DecryptInit_ex", "EVP_CipherInit_ex"
+      ]
+  }
+
+  override Expr getOperationSubtypeArg() {
+    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
+    result = this.(Call).getArgument(5)
+  }
+}
+
+class EVP_Cipher_EX2_or_Simple_Init_Call extends EVP_EX2_Initializer {
+  EVP_Cipher_EX2_or_Simple_Init_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptInit_ex2", "EVP_DecryptInit_ex2", "EVP_CipherInit_ex2", "EVP_EncryptInit",
+        "EVP_DecryptInit", "EVP_CipherInit"
+      ]
+  }
+
+  override Expr getOperationSubtypeArg() {
+    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
+    result = this.(Call).getArgument(4)
+  }
+}
+
+class EVP_CipherInit_SKEY_Call extends EVP_EX2_Initializer {
+  EVP_CipherInit_SKEY_Call() { this.(Call).getTarget().getName() in ["EVP_CipherInit_SKEY"] }
+
+  override Expr getOperationSubtypeArg() { result = this.(Call).getArgument(5) }
+}
+
+class EVPCipherInitializerAlgorithmArgument extends Expr {
+  EVPCipherInitializerAlgorithmArgument() {
+    exists(EVP_Cipher_Initializer initCall | this = initCall.getAlgorithmArg())
+  }
+}
+
+class EVPCipherInitializerKeyArgument extends Expr {
+  EVPCipherInitializerKeyArgument() {
+    exists(EVP_Cipher_Initializer initCall | this = initCall.getKeyArg())
+  }
+}
+
+class EVPCipherInitializerIVArgument extends Expr {
+  EVPCipherInitializerIVArgument() {
+    exists(EVP_Cipher_Initializer initCall | this = initCall.getIVArg())
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherOperation.qll

@@ -0,0 +1,77 @@
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import EVPCipherInitializer
+private import OpenSSLOperationBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+
+class EVP_Cipher_Update_Call extends EVPUpdate {
+  EVP_Cipher_Update_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptUpdate", "EVP_DecryptUpdate", "EVP_CipherUpdate"
+      ]
+  }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(3) }
+
+  override Expr getOutputArg() { result = this.(Call).getArgument(1) }
+}
+
+/**
+ * see: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
+ * Base configuration for all EVP cipher operations.
+ */
+abstract class EVP_Cipher_Operation extends EVPOperation, Crypto::KeyOperationInstance {
+  override Expr getOutputArg() { result = this.(Call).getArgument(1) }
+
+  override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
+    result instanceof Crypto::TEncryptMode and
+    this.(Call).getTarget().getName().toLowerCase().matches("%encrypt%")
+    or
+    result instanceof Crypto::TDecryptMode and
+    this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%")
+    or
+    result = this.getInitCall().getKeyOperationSubtype() and
+    this.(Call).getTarget().getName().toLowerCase().matches("%cipher%")
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getNonceConsumer() {
+    this.getInitCall().getIVArg() = result.asExpr()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getKeyConsumer() {
+    this.getInitCall().getKeyArg() = result.asExpr()
+    // todo: or track to the EVP_PKEY_CTX_new
+  }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = EVPOperation.super.getOutputArtifact()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = EVPOperation.super.getInputConsumer()
+  }
+}
+
+class EVP_Cipher_Call extends EVPOperation, EVP_Cipher_Operation {
+  EVP_Cipher_Call() { this.(Call).getTarget().getName() = "EVP_Cipher" }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(2) }
+}
+
+class EVP_Cipher_Final_Call extends EVPFinal, EVP_Cipher_Operation {
+  EVP_Cipher_Final_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptFinal_ex", "EVP_DecryptFinal_ex", "EVP_CipherFinal_ex", "EVP_EncryptFinal",
+        "EVP_DecryptFinal", "EVP_CipherFinal"
+      ]
+  }
+
+  /**
+   * Output is both from update calls and from the final call.
+   */
+  override Expr getOutputArg() {
+    result = EVPFinal.super.getOutputArg()
+    or
+    result = EVP_Cipher_Operation.super.getOutputArg()
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPHashInitializer.qll

@@ -0,0 +1,14 @@
+import cpp
+private import OpenSSLOperationBase
+
+abstract class EVP_Hash_Initializer extends EVPInitialize { }
+
+class EVP_DigestInit_Variant_Calls extends EVP_Hash_Initializer {
+  EVP_DigestInit_Variant_Calls() {
+    this.(Call).getTarget().getName() in [
+        "EVP_DigestInit", "EVP_DigestInit_ex", "EVP_DigestInit_ex2"
+      ]
+  }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPHashOperation.qll

@@ -0,0 +1,85 @@
+/**
+ * https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
+ */
+
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import OpenSSLOperationBase
+private import EVPHashInitializer
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+
+class EVP_Digest_Update_Call extends EVPUpdate {
+  EVP_Digest_Update_Call() { this.(Call).getTarget().getName() = "EVP_DigestUpdate" }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(1) }
+}
+
+//https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
+class EVP_Q_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance {
+  EVP_Q_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+
+  override EVP_Hash_Initializer getInitCall() {
+    // This variant of digest does not use an init
+    // and even if it were used, the init would be ignored/undefined
+    none()
+  }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(3) }
+
+  override Expr getOutputArg() { result = this.(Call).getArgument(5) }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = EVPOperation.super.getOutputArtifact()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = EVPOperation.super.getInputConsumer()
+  }
+}
+
+class EVP_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance {
+  EVP_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Digest" }
+
+  // There is no context argument for this function
+  override Expr getContextArg() { none() }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(4) }
+
+  override EVP_Hash_Initializer getInitCall() {
+    // This variant of digest does not use an init
+    // and even if it were used, the init would be ignored/undefined
+    none()
+  }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(0) }
+
+  override Expr getOutputArg() { result = this.(Call).getArgument(2) }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = EVPOperation.super.getOutputArtifact()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = EVPOperation.super.getInputConsumer()
+  }
+}
+
+class EVP_Digest_Final_Call extends EVPFinal, Crypto::HashOperationInstance {
+  EVP_Digest_Final_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_DigestFinal", "EVP_DigestFinal_ex", "EVP_DigestFinalXOF"
+      ]
+  }
+
+  override Expr getOutputArg() { result = this.(Call).getArgument(1) }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = EVPFinal.super.getOutputArtifact()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = EVPFinal.super.getInputConsumer()
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperationBase.qll

@@ -0,0 +1,162 @@
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+
+/**
+ * A class for all OpenSSL operations.
+ */
+abstract class OpenSSLOperation extends Crypto::OperationInstance instanceof Call {
+  /**
+   * Expression that specifies the algorithm for the operation.
+   * Will be an argument of the operation in the simplest case.
+   */
+  abstract Expr getAlgorithmArg();
+
+  /**
+   * Algorithm is specified in initialization call or is implicitly established by the key.
+   */
+  override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
+    AlgGetterToAlgConsumerFlow::flow(result.(OpenSSLAlgorithmValueConsumer).getResultNode(),
+      DataFlow::exprNode(this.getAlgorithmArg()))
+  }
+}
+
+/**
+ * A Call to initialization functions from the EVP API.
+ * These are not operations in the sense of Crypto::OperationInstance,
+ * but they are used to initialize the context for the operation.
+ */
+abstract class EVPInitialize extends Call {
+  /**
+   * Gets the context argument that ties together initialization, updates and/or final calls.
+   */
+  Expr getContextArg() { result = this.(Call).getArgument(0) }
+
+  /**
+   * Gets the type of key operation, none if not applicable.
+   */
+  Crypto::KeyOperationSubtype getKeyOperationSubtype() { none() }
+
+  /**
+   * Explicitly specified algorithm or none if implicit (e.g., established by the key).
+   * None if not applicable.
+   */
+  Expr getAlgorithmArg() { none() }
+
+  /**
+   * Gets the key for the operation, none if not applicable.
+   */
+  Expr getKeyArg() { none() }
+
+  /**
+   * Gets the IV/nonce, none if not applicable.
+   */
+  Expr getIVArg() { none() }
+}
+
+/**
+ * A Call to update functions from the EVP API.
+ * These are not operations in the sense of Crypto::OperationInstance,
+ * but they are used to update the context for the operation.
+ */
+abstract class EVPUpdate extends Call {
+  /**
+   * Gets the context argument that ties together initialization, updates and/or final calls.
+   */
+  Expr getContextArg() { result = this.(Call).getArgument(0) }
+
+  /**
+   * Update calls always have some input data like plaintext or message digest.
+   */
+  abstract Expr getInputArg();
+
+  /**
+   * Update calls sometimes have some output data like a plaintext.
+   */
+  Expr getOutputArg() { none() }
+}
+
+/**
+ * Flows from algorithm values to operations, specific to OpenSSL
+ */
+private module AlgGetterToAlgConsumerConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    exists(OpenSSLAlgorithmValueConsumer c | c.getResultNode() = source)
+  }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(EVPOperation c | c.getAlgorithmArg() = sink.asExpr())
+  }
+}
+
+private module AlgGetterToAlgConsumerFlow = DataFlow::Global<AlgGetterToAlgConsumerConfig>;
+
+/**
+ * The base class for all operations of the EVP API.
+ * This captures one-shot APIs (with and without an initilizer call) and final calls.
+ * Provides some default methods for Crypto::KeyOperationInstance class
+ */
+abstract class EVPOperation extends OpenSSLOperation {
+  /**
+   * Gets the context argument that ties together initialization, updates and/or final calls.
+   */
+  Expr getContextArg() { result = this.(Call).getArgument(0) }
+
+  /**
+   * Some input data like plaintext or message digest.
+   * Either argument provided direcly in the call or all arguments that were provided in update calls.
+   */
+  abstract Expr getInputArg();
+
+  /**
+   * Some output data like ciphertext or signature.
+   */
+  abstract Expr getOutputArg();
+
+  /**
+   * Overwrite with an explicitly specified algorithm or leave base implementation to find it in the initialization call.
+   */
+  override Expr getAlgorithmArg() { result = this.getInitCall().getAlgorithmArg() }
+
+  /**
+   * Finds the initialization call, may be none.
+   */
+  EVPInitialize getInitCall() {
+    CTXFlow::ctxArgFlowsToCtxArg(result.getContextArg(), this.getContextArg())
+  }
+
+  Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = DataFlow::exprNode(this.getOutputArg())
+  }
+
+  /**
+   * Input consumer is the input argument of the call.
+   */
+  Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = DataFlow::exprNode(this.getInputArg())
+  }
+}
+
+/**
+ * The final calls of the EVP API.
+ */
+abstract class EVPFinal extends EVPOperation {
+  /**
+   * All update calls that were executed before this final call.
+   */
+  EVPUpdate getUpdateCalls() {
+    CTXFlow::ctxArgFlowsToCtxArg(result.getContextArg(), this.getContextArg())
+  }
+
+  /**
+   * Gets the input data provided to all update calls.
+   * If more input data was provided in the final call, override the method.
+   */
+  override Expr getInputArg() { result = this.getUpdateCalls().getInputArg() }
+
+  /**
+   * Gets the output data provided to all update calls.
+   * If more output data was provided in the final call, override the method.
+   */
+  override Expr getOutputArg() { result = this.getUpdateCalls().getOutputArg() }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll

@@ -0,0 +1,4 @@
+import OpenSSLOperationBase
+import EVPCipherOperation
+import EVPHashOperation
+import ECKeyGenOperation

cpp/ql/lib/experimental/quantum/OpenSSL/Random.qll

@@ -0,0 +1,18 @@
+import cpp
+private import experimental.quantum.Language
+private import LibraryDetector
+private import semmle.code.cpp.dataflow.new.DataFlow
+
+class OpenSSLRandomNumberGeneratorInstance extends Crypto::RandomNumberGenerationInstance instanceof Call
+{
+  OpenSSLRandomNumberGeneratorInstance() {
+    this.(Call).getTarget().getName() in ["RAND_bytes", "RAND_pseudo_bytes"] and
+    isPossibleOpenSSLFunction(this.(Call).getTarget())
+  }
+
+  override Crypto::DataFlowNode getOutputNode() {
+    result.asDefiningArgument() = this.(Call).getArgument(0)
+  }
+
+  override string getGeneratorName() { result = this.(Call).getTarget().getName() }
+}

cpp/ql/lib/ext/Boost.Asio.model.yml

@@ -1,4 +1,4 @@
-  # partial model of the Boost::Asio network library
+# partial model of the Boost::Asio network library
 extensions:
   - addsTo:
       pack: codeql/cpp-all

cpp/ql/lib/ext/Windows.model.yml

@@ -0,0 +1,35 @@
+# partial model of windows system calls
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: sourceModel
+    data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
+      # processenv.h
+      - ["", "", False, "GetCommandLineA", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "GetCommandLineW", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "GetEnvironmentStringsA", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "GetEnvironmentStringsW", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "GetEnvironmentVariableA", "", "", "Argument[*1]", "local", "manual"]
+      - ["", "", False, "GetEnvironmentVariableW", "", "", "Argument[*1]", "local", "manual"]
+      # fileapi.h
+      - ["", "", False, "ReadFile", "", "", "Argument[*1]", "local", "manual"]
+      - ["", "", False, "ReadFileEx", "", "", "Argument[*1]", "local", "manual"]
+      # memoryapi.h
+      - ["", "", False, "MapViewOfFile", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFile2", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFile3", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFile3FromApp", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFileEx", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFileFromApp", "", "", "ReturnValue[*]", "local", "manual"]
+      - ["", "", False, "MapViewOfFileNuma2", "", "", "ReturnValue[*]", "local", "manual"]
+      # ntifs.h
+      - ["", "", False, "NtReadFile", "", "", "Argument[*5]", "local", "manual"]
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      # shellapi.h
+      - ["", "", False, "CommandLineToArgvA", "", "", "Argument[*0]", "ReturnValue[**]", "taint", "manual"]
+      - ["", "", False, "CommandLineToArgvW", "", "", "Argument[*0]", "ReturnValue[**]", "taint", "manual"]
+      # fileapi.h
+      - ["", "", False, "ReadFileEx", "", "", "Argument[*3].Field[@hEvent]", "Argument[4].Parameter[*2].Field[@hEvent]", "value", "manual"]

cpp/ql/lib/ext/generated/sqlite/sqlite.model.yml

@@ -0,0 +1,948 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "", True, "Action_add", "(action **,e_action,symbol *,char *)", "", "Argument[**0]", "Argument[**0].Field[**next]", "value", "dfc-generated"]
+      - ["", "", True, "Action_add", "(action **,e_action,symbol *,char *)", "", "Argument[*0]", "Argument[**0].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "Action_add", "(action **,e_action,symbol *,char *)", "", "Argument[0]", "Argument[**0].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Action_add", "(action **,e_action,symbol *,char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Configcmp", "(const char *,const char *)", "", "Argument[*0].Field[**rp].Field[*index]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Configcmp", "(const char *,const char *)", "", "Argument[*0].Field[*dot]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Configcmp", "(const char *,const char *)", "", "Argument[*1].Field[**rp].Field[*index]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Configcmp", "(const char *,const char *)", "", "Argument[*1].Field[*dot]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Configlist_add", "(rule *,int)", "", "Argument[*0]", "ReturnValue[*].Field[**rp]", "value", "dfc-generated"]
+      - ["", "", True, "Configlist_add", "(rule *,int)", "", "Argument[0]", "ReturnValue[*].Field[*rp]", "value", "dfc-generated"]
+      - ["", "", True, "Configlist_add", "(rule *,int)", "", "Argument[1]", "ReturnValue[*].Field[*dot]", "value", "dfc-generated"]
+      - ["", "", True, "Configlist_addbasis", "(rule *,int)", "", "Argument[*0]", "ReturnValue[*].Field[**rp]", "value", "dfc-generated"]
+      - ["", "", True, "Configlist_addbasis", "(rule *,int)", "", "Argument[0]", "ReturnValue[*].Field[*rp]", "value", "dfc-generated"]
+      - ["", "", True, "Configlist_addbasis", "(rule *,int)", "", "Argument[1]", "ReturnValue[*].Field[*dot]", "value", "dfc-generated"]
+      - ["", "", True, "JimDefaultAllocator", "(void *,size_t)", "", "Argument[**0]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "JimDefaultAllocator", "(void *,size_t)", "", "Argument[*0]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "JimDefaultAllocator", "(void *,size_t)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "JimDefaultAllocator", "(void *,size_t)", "", "Argument[0]", "ReturnValue[**]", "taint", "dfc-generated"]
+      - ["", "", True, "JimDefaultAllocator", "(void *,size_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "JimStringReplaceObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "JimStringReplaceObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_AioFilehandle", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_AioFilehandle", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_AppendObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[*2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_AppendString", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[*2]", "Argument[*1].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_AppendString", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[2]", "Argument[*1].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_AppendString", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[3]", "Argument[*1].Field[*length]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CallSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[**2]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[**2]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[*2]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[*2]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[*2]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[2]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CheckShowCommands", "(Jim_Interp *,Jim_Obj *,const char *const *)", "", "Argument[2]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*1]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*1]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*2]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*2]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*3]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*3]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[2]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[2]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[2]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[3]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[3]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Jim_CommandMatchObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[3]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "Jim_CompareStringImmediate", "(Jim_Interp *,Jim_Obj *,const char *)", "", "Argument[*2]", "Argument[*1].Field[*internalRep].Union[**(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_CompareStringImmediate", "(Jim_Interp *,Jim_Obj *,const char *)", "", "Argument[2]", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ConcatObj", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[**2].Field[*length]", "ReturnValue[*].Field[*length]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ConcatObj", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ConcatObj", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[1]", "ReturnValue[*].Field[*length]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommand", "(Jim_Interp *,const char *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommand", "(Jim_Interp *,const char *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[*1]", "Argument[*0].Field[**liveList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommand", "(Jim_Interp *,const char *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommand", "(Jim_Interp *,const char *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[1]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommandObj", "(Jim_Interp *,Jim_Obj *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_CreateCommandObj", "(Jim_Interp *,Jim_Obj *,Jim_CmdProc *,void *,Jim_DelCmdProc *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_DeleteCommand", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_DeleteCommand", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_DictAddElement", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictAddElement", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictInfo", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictKey", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[*0]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictKey", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictKey", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[*0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictKey", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[*2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj **,int)", "", "Argument[*1]", "Argument[**4]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_DictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj **,int)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_DictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj **,int)", "", "Argument[1]", "Argument[*4]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_DictMatchTypes", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,int,int)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DictMerge", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_DictPairs", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_DictSize", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DuplicateObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_DuplicateObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_DuplicateObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_Eval", "(Jim_Interp *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_Eval", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_Eval", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalExpression", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalExpression", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFile", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**currentFilenameObj].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFile", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFile", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0].Field[**currentFilenameObj].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFile", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFileGlobal", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**currentFilenameObj].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFileGlobal", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFileGlobal", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0].Field[**currentFilenameObj].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_EvalFileGlobal", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_EvalGlobal", "(Jim_Interp *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalGlobal", "(Jim_Interp *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalGlobal", "(Jim_Interp *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**evalFrame].Field[*scriptObj]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalObjList", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalObjList", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[**3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[**3]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[**3]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[**3]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[3]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjPrefix", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[3]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[**2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*0]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "value", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalObjVector", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_EvalSource", "(Jim_Interp *,const char *,int,const char *)", "", "Argument[*3]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_EvalSource", "(Jim_Interp *,const char *,int,const char *)", "", "Argument[3]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_FileStoreStatData", "(Jim_Interp *,Jim_Obj *,const jim_stat_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_FindHashEntry", "(Jim_HashTable *,const void *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_FindHashEntry", "(Jim_HashTable *,const void *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_FormatString", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_FreeObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_FreeObj", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GenHashFunction", "(const unsigned char *,int)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GenHashFunction", "(const unsigned char *,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GenHashFunction", "(const unsigned char *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetBoolFromExpr", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetBoolFromExpr", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetBoolFromExpr", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetBoolFromExpr", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetBoolean", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetCallFrameByLevel", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*1].Field[**bytes]", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetCallFrameByLevel", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*1].Field[*bytes]", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetCommand", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetCommand", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetDouble", "(Jim_Interp *,Jim_Obj *,double *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetEnum", "(Jim_Interp *,Jim_Obj *,const char *const *,int *,const char *,int)", "", "Argument[**2]", "Argument[*1].Field[*internalRep].Union[**(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetEnum", "(Jim_Interp *,Jim_Obj *,const char *const *,int *,const char *,int)", "", "Argument[*2]", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetEnum", "(Jim_Interp *,Jim_Obj *,const char *const *,int *,const char *,int)", "", "Argument[*2]", "Argument[*1].Field[*internalRep].Union[**(unnamed class/struct/union)]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetEnum", "(Jim_Interp *,Jim_Obj *,const char *const *,int *,const char *,int)", "", "Argument[2]", "Argument[*1].Field[*internalRep].Union[*(unnamed class/struct/union)]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetEnum", "(Jim_Interp *,Jim_Obj *,const char *const *,int *,const char *,int)", "", "Argument[2]", "Argument[*1].Field[*internalRep].Union[**(unnamed class/struct/union)]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_GetExitCode", "(Jim_Interp *)", "", "Argument[*0].Field[*exitCode]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetGlobalVariable", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariable", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetGlobalVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetHashTableIterator", "(Jim_HashTable *)", "", "Argument[*0]", "ReturnValue[*].Field[**ht]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetHashTableIterator", "(Jim_HashTable *)", "", "Argument[0]", "ReturnValue[*].Field[*ht]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetIndex", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetIndex", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetIndex", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetIndex", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetIndex", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetLong", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetReturnCode", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetSourceInfo", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetSourceInfo", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetSourceInfo", "(Jim_Interp *,Jim_Obj *,int *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetString", "(Jim_Obj *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetString", "(Jim_Obj *,int *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetString", "(Jim_Obj *,int *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariable", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Jim_GetVariable", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetVariableStr", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWide", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_GetWideExpr", "(Jim_Interp *,Jim_Obj *,long *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_InitHashTable", "(Jim_HashTable *,const Jim_HashTableType *,void *)", "", "Argument[**2]", "Argument[*0].Field[***privdata]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_InitHashTable", "(Jim_HashTable *,const Jim_HashTableType *,void *)", "", "Argument[*1]", "Argument[*0].Field[**type]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_InitHashTable", "(Jim_HashTable *,const Jim_HashTableType *,void *)", "", "Argument[*2]", "Argument[*0].Field[**privdata]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_InitHashTable", "(Jim_HashTable *,const Jim_HashTableType *,void *)", "", "Argument[1]", "Argument[*0].Field[*type]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_InitHashTable", "(Jim_HashTable *,const Jim_HashTableType *,void *)", "", "Argument[2]", "Argument[*0].Field[*privdata]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_IntHashFunction", "(unsigned int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_InteractivePrompt", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_Length", "(Jim_Obj *)", "", "Argument[*0].Field[*length]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListAppendElement", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListAppendElement", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListAppendList", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListAppendList", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListGetIndex", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ListIndex", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj **,int)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ListIndex", "(Jim_Interp *,Jim_Obj *,int,Jim_Obj **,int)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ListInsertElements", "(Jim_Interp *,Jim_Obj *,int,int,Jim_Obj *const *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListInsertElements", "(Jim_Interp *,Jim_Obj *,int,int,Jim_Obj *const *)", "", "Argument[*4]", "Argument[**4]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListInsertElements", "(Jim_Interp *,Jim_Obj *,int,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[**4]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListInsertElements", "(Jim_Interp *,Jim_Obj *,int,int,Jim_Obj *const *)", "", "Argument[3]", "Argument[**4]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListInsertElements", "(Jim_Interp *,Jim_Obj *,int,int,Jim_Obj *const *)", "", "Argument[4]", "Argument[**4]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListJoin", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[*2]", "ReturnValue[*].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListJoin", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[2]", "ReturnValue[*].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ListJoin", "(Jim_Interp *,Jim_Obj *,const char *,int)", "", "Argument[3]", "ReturnValue[*].Field[*length]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ListLength", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ListRange", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListRange", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListSetIndex", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListSetIndex", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ListSetIndex", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[*result]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_MakeGlobalNamespaceName", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_MakeGlobalNamespaceName", "(Jim_Interp *,Jim_Obj *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_MakeTempFile", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_MakeTempFile", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**result].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_MakeTempFile", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_MakeTempFile", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_NewDictObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[*1]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_NewDoubleObj", "(Jim_Interp *,double)", "", "Argument[1]", "ReturnValue[*].Field[*internalRep].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewIntObj", "(Jim_Interp *,long)", "", "Argument[1]", "ReturnValue[*].Field[*internalRep].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewListObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewListObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewListObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[*1]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewListObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[1]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewListObj", "(Jim_Interp *,Jim_Obj *const *,int)", "", "Argument[2]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewObj", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewObj", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_NewStringObj", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue[*].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObj", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue[*].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObj", "(Jim_Interp *,const char *,int)", "", "Argument[2]", "ReturnValue[*].Field[*length]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjNoAlloc", "(Jim_Interp *,char *,int)", "", "Argument[*1]", "ReturnValue[*].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjNoAlloc", "(Jim_Interp *,char *,int)", "", "Argument[1]", "ReturnValue[*].Field[*bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjNoAlloc", "(Jim_Interp *,char *,int)", "", "Argument[2]", "ReturnValue[*].Field[*length]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjUtf8", "(Jim_Interp *,const char *,int)", "", "Argument[*1]", "ReturnValue[*].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjUtf8", "(Jim_Interp *,const char *,int)", "", "Argument[1]", "ReturnValue[*].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_NewStringObjUtf8", "(Jim_Interp *,const char *,int)", "", "Argument[2]", "ReturnValue[*].Field[*length]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_NextHashEntry", "(Jim_HashTableIterator *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_NextHashEntry", "(Jim_HashTableIterator *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ParseSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Jim_ParseSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[*3]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ParseSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ParseSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ParseSubCmd", "(Jim_Interp *,const jim_subcmd_type *,int,Jim_Obj *const *)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ReaddirCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[**2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*0]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegexpCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[**2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*0]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RegsubCmd", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_RenameCommand", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[2]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_RenameCommand", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[2]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_ReturnCode", "(int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_ScanString", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_ScanString", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ScanString", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_ScriptIsComplete", "(Jim_Interp *,Jim_Obj *,char *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Jim_SetDictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *,int)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetDictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetDictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetDictKeysVector", "(Jim_Interp *,Jim_Obj *,Jim_Obj *const *,int,Jim_Obj *,int)", "", "Argument[1]", "Argument[*0].Field[*result]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**liveList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**result].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetGlobalVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetResultFormatted", "(Jim_Interp *,const char *,...)", "", "Argument[*1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetResultFormatted", "(Jim_Interp *,const char *,...)", "", "Argument[1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariable", "(Jim_Interp *,Jim_Obj *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_SetVariableLink", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_CallFrame *)", "", "Argument[2]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableLink", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_CallFrame *)", "", "Argument[2]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**liveList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[*1]", "Argument[*0].Field[**result].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStr", "(Jim_Interp *,const char *,Jim_Obj *)", "", "Argument[1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**liveList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**result].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[*2]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SetVariableStrWithStr", "(Jim_Interp *,const char *,const char *)", "", "Argument[2]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SignalId", "(int)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_StackLen", "(Jim_Stack *)", "", "Argument[*0].Field[*len]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StackPeek", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPeek", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPeek", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPop", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPop", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPop", "(Jim_Stack *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Jim_StackPush", "(Jim_Stack *,void *)", "", "Argument[*1]", "Argument[*0].Field[***vector]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StackPush", "(Jim_Stack *,void *)", "", "Argument[1]", "Argument[*0].Field[**vector]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StrDup", "(const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StrDup", "(const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_StrDupLen", "(const char *,int)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StrDupLen", "(const char *,int)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_String", "(Jim_Obj *)", "", "Argument[*0].Field[**bytes]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_String", "(Jim_Obj *)", "", "Argument[*0].Field[*bytes]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StringByteRangeObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Jim_StringByteRangeObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StringRangeObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Jim_StringRangeObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj *,Jim_Obj *)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_StringToDouble", "(const char *,double *)", "", "Argument[*0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_StringToDouble", "(const char *,double *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_StringToWide", "(const char *,long *,int)", "", "Argument[*0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_StringToWide", "(const char *,long *,int)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SubCmdProc", "(Jim_Interp *,int,Jim_Obj *const *)", "", "Argument[*2]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_SubstObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[1]", "Argument[*0].Field[**freeList].Field[*prevObjPtr]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SubstObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[1]", "Argument[*0].Field[*freeList]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_SubstObj", "(Jim_Interp *,Jim_Obj *,Jim_Obj **,int)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_UnsetVariable", "(Jim_Interp *,Jim_Obj *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Jim_Utf8Length", "(Jim_Interp *,Jim_Obj *)", "", "Argument[*1].Field[*length]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[*3]", "Argument[*0].Field[**freeList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[*3]", "Argument[*0].Field[**liveList].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[*3]", "Argument[*0].Field[**result].Field[**bytes]", "value", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[3]", "Argument[*0].Field[**freeList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[3]", "Argument[*0].Field[**liveList].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_WrongNumArgs", "(Jim_Interp *,int,Jim_Obj *const *,const char *)", "", "Argument[3]", "Argument[*0].Field[**result].Field[**bytes]", "taint", "dfc-generated"]
+      - ["", "", True, "Jim_bootstrapInit", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_globInit", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_initjimshInit", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_stdlibInit", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Jim_tclcompatInit", "(Jim_Interp *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "OptInit", "(char **,s_options *,FILE *)", "", "Argument[**0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "OptInit", "(char **,s_options *,FILE *)", "", "Argument[*0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "OptInit", "(char **,s_options *,FILE *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "OptInit", "(char **,s_options *,FILE *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Plink_add", "(plink **,config *)", "", "Argument[**0]", "Argument[**0].Field[**next]", "value", "dfc-generated"]
+      - ["", "", True, "Plink_add", "(plink **,config *)", "", "Argument[*0]", "Argument[**0].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "Plink_add", "(plink **,config *)", "", "Argument[0]", "Argument[**0].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Plink_add", "(plink **,config *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[**0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[*0]", "Argument[**0]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[*1]", "Argument[**0]", "value", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[0]", "Argument[**0]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[1]", "Argument[**0]", "taint", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[1]", "Argument[*0]", "value", "df-generated"]
+      - ["", "", True, "Plink_copy", "(plink **,plink *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Plink_delete", "(plink *)", "", "Argument[0]", "Argument[*0].Field[**next].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "Plink_delete", "(plink *)", "", "Argument[0]", "Argument[*0].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "PrintAction", "(action *,FILE *,int)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "ResortStates", "(lemon *)", "", "Argument[*0].Field[*nstate]", "Argument[*0].Field[*nxstate]", "value", "dfc-generated"]
+      - ["", "", True, "RulePrint", "(FILE *,rule *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "SHA1Transform", "(unsigned int[5],const unsigned char[64])", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "SHA1Transform", "(unsigned int[5],const unsigned char[64])", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "SHA1Transform", "(unsigned int[5],const unsigned char[64])", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "State_find", "(config *)", "", "Argument[*0].Field[**bp].Field[**bp]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "State_find", "(config *)", "", "Argument[*0].Field[**bp]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "State_insert", "(state *,config *)", "", "Argument[*1].Field[**bp].Field[**bp]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "State_insert", "(state *,config *)", "", "Argument[*1].Field[**bp]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "Strsafe", "(const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Strsafe", "(const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Symbol_Nth", "(int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Symbol_Nth", "(int)", "", "Argument[0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Symbol_new", "(const char *)", "", "Argument[*0]", "ReturnValue[*].Field[**name]", "value", "dfc-generated"]
+      - ["", "", True, "Symbol_new", "(const char *)", "", "Argument[0]", "ReturnValue[*].Field[**name]", "taint", "dfc-generated"]
+      - ["", "", True, "Symbolcmpp", "(const void *,const void *)", "", "Argument[**0].Field[*index]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Symbolcmpp", "(const void *,const void *)", "", "Argument[**1].Field[*index]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "acttab_action", "(acttab *,int,int)", "", "Argument[1]", "Argument[*0].Field[**aLookahead].Field[*lookahead]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_action", "(acttab *,int,int)", "", "Argument[1]", "Argument[*0].Field[*mnLookahead]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_action", "(acttab *,int,int)", "", "Argument[1]", "Argument[*0].Field[*mxLookahead]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_action", "(acttab *,int,int)", "", "Argument[2]", "Argument[*0].Field[**aLookahead].Field[*action]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_action", "(acttab *,int,int)", "", "Argument[2]", "Argument[*0].Field[*mnAction]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_action_size", "(acttab *)", "", "Argument[*0].Field[*nAction]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "acttab_alloc", "(int,int)", "", "Argument[0]", "ReturnValue[*].Field[*nsymbol]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_alloc", "(int,int)", "", "Argument[1]", "ReturnValue[*].Field[*nterminal]", "value", "dfc-generated"]
+      - ["", "", True, "acttab_insert", "(acttab *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "append_str", "(const char *,int,int,int)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "append_str", "(const char *,int,int,int)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "append_str", "(const char *,int,int,int)", "", "Argument[1]", "ReturnValue[*].Field[*sz]", "taint", "dfc-generated"]
+      - ["", "", True, "append_str", "(const char *,int,int,int)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "close_db", "(sqlite3 *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "compute_action", "(lemon *,action *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "confighash", "(config *)", "", "Argument[*0].Field[**rp].Field[*index]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "confighash", "(config *)", "", "Argument[*0].Field[*dot]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "defossilize", "(char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "emit_code", "(FILE *,rule *,lemon *,int *)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "emit_code", "(FILE *,rule *,lemon *,int *)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "emit_code", "(FILE *,rule *,lemon *,int *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "emit_destructor_code", "(FILE *,symbol *,lemon *,int *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "file_makename", "(lemon *,const char *)", "", "Argument[*0].Field[**filename]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "file_makename", "(lemon *,const char *)", "", "Argument[*0].Field[*filename]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "file_makename", "(lemon *,const char *)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "file_makename", "(lemon *,const char *)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "file_open", "(lemon *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**outname]", "value", "dfc-generated"]
+      - ["", "", True, "file_open", "(lemon *,const char *,const char *)", "", "Argument[*1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "file_open", "(lemon *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[**outname]", "taint", "dfc-generated"]
+      - ["", "", True, "file_open", "(lemon *,const char *,const char *)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "getstate", "(lemon *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "has_destructor", "(symbol *,lemon *)", "", "Argument[*1].Field[*tokendest]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "jim_regcomp", "(regex_t *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**regparse]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regcomp", "(regex_t *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[*regparse]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regcomp", "(regex_t *,const char *,int)", "", "Argument[2]", "Argument[*0].Field[*cflags]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regerror", "(int,const regex_t *,char *,size_t)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[*1]", "Argument[*0].Field[**regbol]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[*1]", "Argument[*0].Field[**reginput]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[*1]", "Argument[*0].Field[**start]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[*3]", "Argument[*0].Field[**pmatch]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[2]", "Argument[*0].Field[*nmatch]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[3]", "Argument[*0].Field[*pmatch]", "value", "dfc-generated"]
+      - ["", "", True, "jim_regexec", "(regex_t *,const char *,size_t,regmatch_t[],int)", "", "Argument[4]", "Argument[*0].Field[*eflags]", "value", "dfc-generated"]
+      - ["", "", True, "print_stack_union", "(FILE *,lemon *,int *,int)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[**4]", "ReturnValue[*].Field[***pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[*1]", "ReturnValue[*].Field[**zDb]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[*2]", "ReturnValue[*].Field[**zUri]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[*4]", "ReturnValue[*].Field[**pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[**zDb].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[**zUri].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[1]", "ReturnValue[*].Field[**zDb]", "taint", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[2]", "ReturnValue[*].Field[**zUri]", "taint", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[3]", "ReturnValue[*].Field[*xSql]", "value", "dfc-generated"]
+      - ["", "", True, "recoverInit", "(sqlite3 *,const char *,const char *,..(*)(..),void *)", "", "Argument[4]", "ReturnValue[*].Field[*pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "registerUDFs", "(sqlite3 *,sqlite3 *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "registerUDFs", "(sqlite3 *,sqlite3 *)", "", "Argument[1]", "Argument[*1].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "rule_print", "(FILE *,rule *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sha1sum_file", "(const char *,char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sha3sum_file", "(const char *,char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "shellReset", "(int *,sqlite3_stmt *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3CompletionVtabInit", "(sqlite3 *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_aggregate_context", "(sqlite3_context *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_aggregate_context", "(sqlite3_context *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_aggregate_count", "(sqlite3_context *)", "", "Argument[*0].Field[**pMem].Field[*n]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_autovacuum_pages", "(sqlite3 *,..(*)(..),void *,..(*)(..))", "", "Argument[**2]", "Argument[*0].Field[***pAutovacPagesArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_autovacuum_pages", "(sqlite3 *,..(*)(..),void *,..(*)(..))", "", "Argument[*2]", "Argument[*0].Field[**pAutovacPagesArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_autovacuum_pages", "(sqlite3 *,..(*)(..),void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*xAutovacPages]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_autovacuum_pages", "(sqlite3 *,..(*)(..),void *,..(*)(..))", "", "Argument[2]", "Argument[*0].Field[*pAutovacPagesArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_autovacuum_pages", "(sqlite3 *,..(*)(..),void *,..(*)(..))", "", "Argument[3]", "Argument[*0].Field[*xAutovacDestr]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_finish", "(sqlite3_backup *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_backup_init", "(sqlite3 *,const char *,sqlite3 *,const char *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_init", "(sqlite3 *,const char *,sqlite3 *,const char *)", "", "Argument[0]", "ReturnValue[*].Field[*pDestDb]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_init", "(sqlite3 *,const char *,sqlite3 *,const char *)", "", "Argument[2]", "ReturnValue[*].Field[*pSrcDb]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_pagecount", "(sqlite3_backup *)", "", "Argument[*0].Field[*nPagecount]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_remaining", "(sqlite3_backup *)", "", "Argument[*0].Field[*nRemaining]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_backup_step", "(sqlite3_backup *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_base64_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_base85_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_blob64", "(sqlite3_stmt *,int,const void *,sqlite3_uint64,..(*)(..))", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_blob", "(sqlite3_stmt *,int,const void *,int,..(*)(..))", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_double", "(sqlite3_stmt *,int,double)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_int64", "(sqlite3_stmt *,int,sqlite3_int64,sqlite_int64)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_int", "(sqlite3_stmt *,int,int)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_parameter_count", "(sqlite3_stmt *)", "", "Argument[*0].Field[*nVar]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_parameter_index", "(sqlite3_stmt *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_parameter_name", "(sqlite3_stmt *,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_parameter_name", "(sqlite3_stmt *,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_pointer", "(sqlite3_stmt *,int,void *,const char *,..(*)(..))", "", "Argument[*2]", "Argument[*0].Field[**aVar].Field[**z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_pointer", "(sqlite3_stmt *,int,void *,const char *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_pointer", "(sqlite3_stmt *,int,void *,const char *,..(*)(..))", "", "Argument[2]", "Argument[*0].Field[**aVar].Field[*z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_pointer", "(sqlite3_stmt *,int,void *,const char *,..(*)(..))", "", "Argument[4]", "Argument[*0].Field[**aVar].Field[*xDel]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_text16", "(sqlite3_stmt *,int,const void *,int,..(*)(..))", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_text64", "(sqlite3_stmt *,int,const char *,sqlite3_uint64,..(*)(..),unsigned char)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_text", "(sqlite3_stmt *,int,const char *,int,..(*)(..))", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_bind_value", "(sqlite3_stmt *,int,const sqlite3_value *)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_zeroblob64", "(sqlite3_stmt *,int,sqlite3_uint64)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_bind_zeroblob", "(sqlite3_stmt *,int,int)", "", "Argument[1]", "Argument[*0].Field[**aVar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_bytes", "(sqlite3_blob *)", "", "Argument[*0].Field[*nByte]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_close", "(sqlite3_blob *)", "", "Argument[*0].Field[**pStmt].Field[*rc]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[*2]", "Argument[**6].Field[**pTab].Field[**zName]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[*3]", "Argument[**6].Field[*iCol]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[*3]", "Argument[**6].Field[*iOffset]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[*3]", "Argument[**6].Field[*nByte]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[2]", "Argument[**6].Field[**pTab].Field[**zName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[3]", "Argument[**6].Field[*iCol]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[3]", "Argument[**6].Field[*iOffset]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_open", "(sqlite3 *,const char *,const char *,const char *,sqlite3_int64,sqlite_int64,int,sqlite3_blob **)", "", "Argument[3]", "Argument[**6].Field[*nByte]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_read", "(sqlite3_blob *,void *,int,int)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_read", "(sqlite3_blob *,void *,int,int)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_read", "(sqlite3_blob *,void *,int,int)", "", "Argument[3]", "Argument[*0].Field[**pCsr].Field[**aOverflow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_read", "(sqlite3_blob *,void *,int,int)", "", "Argument[3]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_reopen", "(sqlite3_blob *,sqlite3_int64)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_blob_write", "(sqlite3_blob *,const void *,int,int)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_write", "(sqlite3_blob *,const void *,int,int)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_write", "(sqlite3_blob *,const void *,int,int)", "", "Argument[3]", "Argument[*0].Field[**pCsr].Field[**aOverflow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_blob_write", "(sqlite3_blob *,const void *,int,int)", "", "Argument[3]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_handler", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[*busyHandler].Field[***pBusyArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_handler", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[*busyHandler].Field[**pBusyArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_handler", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*busyHandler].Field[*xBusyHandler]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_handler", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*busyHandler].Field[*pBusyArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_timeout", "(sqlite3 *,int)", "", "Argument[*0]", "Argument[*0].Field[*busyHandler].Field[**pBusyArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_timeout", "(sqlite3 *,int)", "", "Argument[0]", "Argument[*0].Field[*busyHandler].Field[*pBusyArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_busy_timeout", "(sqlite3 *,int)", "", "Argument[1]", "Argument[*0].Field[*busyTimeout]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_changes64", "(sqlite3 *)", "", "Argument[*0].Field[*nChange]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_changes", "(sqlite3 *)", "", "Argument[*0].Field[*nChange]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_close", "(sqlite3 *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed16", "(sqlite3 *,void *,..(*)(..))", "", "Argument[**1]", "Argument[*0].Field[***pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed16", "(sqlite3 *,void *,..(*)(..))", "", "Argument[*1]", "Argument[*0].Field[**pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed16", "(sqlite3 *,void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed16", "(sqlite3 *,void *,..(*)(..))", "", "Argument[2]", "Argument[*0].Field[*xCollNeeded16]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed", "(sqlite3 *,void *,..(*)(..))", "", "Argument[**1]", "Argument[*0].Field[***pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed", "(sqlite3 *,void *,..(*)(..))", "", "Argument[*1]", "Argument[*0].Field[**pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed", "(sqlite3 *,void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*pCollNeededArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_collation_needed", "(sqlite3 *,void *,..(*)(..))", "", "Argument[2]", "Argument[*0].Field[*xCollNeeded]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_blob", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_bytes16", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_bytes", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_count", "(sqlite3_stmt *)", "", "Argument[*0].Field[*nResColumn]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_decltype16", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**aColName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_decltype", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**aColName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_double", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_int64", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_int", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_name16", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**aColName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_name16", "(sqlite3_stmt *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_name16", "(sqlite3_stmt *,int)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_name", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**aColName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_name", "(sqlite3_stmt *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_text16", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_text", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_type", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[**pResultRow]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_value", "(sqlite3_stmt *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_column_value", "(sqlite3_stmt *,int)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_commit_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pCommitArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_commit_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pCommitArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_commit_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xCommitCallback]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_commit_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pCommitArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_compileoption_get", "(int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_completion_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_context_db_handle", "(sqlite3_context *)", "", "Argument[*0].Field[**pOut].Field[**db]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_context_db_handle", "(sqlite3_context *)", "", "Argument[*0].Field[**pOut].Field[*db]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_collation16", "(sqlite3 *,const void *,int,void *,..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_collation", "(sqlite3 *,const char *,int,void *,..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_collation_v2", "(sqlite3 *,const char *,int,void *,..(*)(..),..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function16", "(sqlite3 *,const void *,int,int,void *,..(*)(..),..(*)(..),..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function_v2", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function_v2", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_function_v2", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_module", "(sqlite3 *,const char *,const sqlite3_module *,void *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_module", "(sqlite3 *,const char *,const sqlite3_module *,void *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_module", "(sqlite3 *,const char *,const sqlite3_module *,void *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_module_v2", "(sqlite3 *,const char *,const sqlite3_module *,void *,..(*)(..))", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_module_v2", "(sqlite3 *,const char *,const sqlite3_module *,void *,..(*)(..))", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_module_v2", "(sqlite3 *,const char *,const sqlite3_module *,void *,..(*)(..))", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_create_window_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_window_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_create_window_function", "(sqlite3 *,const char *,int,int,void *,..(*)(..),..(*)(..),..(*)(..),..(*)(..),..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_data_count", "(sqlite3_stmt *)", "", "Argument[*0].Field[*nResColumn]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_handle", "(sqlite3_stmt *)", "", "Argument[*0].Field[**db]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_handle", "(sqlite3_stmt *)", "", "Argument[*0].Field[*db]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_mutex", "(sqlite3 *)", "", "Argument[*0].Field[**mutex]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_mutex", "(sqlite3 *)", "", "Argument[*0].Field[*mutex]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_name", "(sqlite3 *,int)", "", "Argument[*0].Field[**aDb].Field[**zDbSName]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_name", "(sqlite3 *,int)", "", "Argument[*0].Field[**aDb].Field[*zDbSName]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_status", "(sqlite3 *,int,int *,int *,int)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_db_status", "(sqlite3 *,int,int *,int *,int)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_dbdata_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_decimal_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_declare_vtab", "(sqlite3 *,const char *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_deserialize", "(sqlite3 *,const char *,unsigned char *,sqlite3_int64,sqlite3_int64,unsigned int)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_errcode", "(sqlite3 *)", "", "Argument[*0].Field[*errCode]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_errcode", "(sqlite3 *)", "", "Argument[*0].Field[*errMask]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_errmsg16", "(sqlite3 *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_errmsg", "(sqlite3 *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_errmsg", "(sqlite3 *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_error_offset", "(sqlite3 *)", "", "Argument[*0].Field[*errByteOffset]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_errstr", "(int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[*1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[*1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_exec", "(sqlite3 *,const char *,..(*)(..),sqlite3_callback,void *,char **)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_expanded_sql", "(sqlite3_stmt *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_expert_analyze", "(sqlite3expert *,char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_count", "(sqlite3expert *)", "", "Argument[*0].Field[**pStatement].Field[*iId]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_new", "(sqlite3 *,char **)", "", "Argument[0]", "ReturnValue[*].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_new", "(sqlite3 *,char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_report", "(sqlite3expert *,int,int)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_expert_report", "(sqlite3expert *,int,int)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_expert_sql", "(sqlite3expert *,const char *,char **)", "", "Argument[*1]", "Argument[*0].Field[**pStatement].Field[**zSql]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_sql", "(sqlite3expert *,const char *,char **)", "", "Argument[1]", "Argument[*0].Field[**pStatement].Field[**zSql]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_expert_sql", "(sqlite3expert *,const char *,char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_extended_errcode", "(sqlite3 *)", "", "Argument[*0].Field[*errCode]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_file_control", "(sqlite3 *,const char *,int,void *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_fileio_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_database", "(const char *,sqlite3_filename)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_database", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_database", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_journal", "(const char *,sqlite3_filename)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_journal", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_journal", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_wal", "(const char *,sqlite3_filename)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_wal", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_filename_wal", "(const char *,sqlite3_filename)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_finalize", "(sqlite3_stmt *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_free_filename", "(const char *,sqlite3_filename)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_free_table", "(char **)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_free_table", "(char **)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_free_table", "(char **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_autocommit", "(sqlite3 *)", "", "Argument[*0].Field[*autoCommit]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_clientdata", "(sqlite3 *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_get_clientdata", "(sqlite3 *,const char *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_get_clientdata", "(sqlite3 *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[*1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[*1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_get_table", "(sqlite3 *,const char *,char ***,int *,int *,char **)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_ieee_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_error", "(sqlite3_intck *,const char **)", "", "Argument[*0]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_error", "(sqlite3_intck *,const char **)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_error", "(sqlite3_intck *,const char **)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_message", "(sqlite3_intck *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_message", "(sqlite3_intck *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_open", "(sqlite3 *,const char *,sqlite3_intck **)", "", "Argument[*1]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_open", "(sqlite3 *,const char *,sqlite3_intck **)", "", "Argument[0]", "Argument[**2].Field[**zDb].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_open", "(sqlite3 *,const char *,sqlite3_intck **)", "", "Argument[0]", "Argument[**2].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_open", "(sqlite3 *,const char *,sqlite3_intck **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_open", "(sqlite3 *,const char *,sqlite3_intck **)", "", "Argument[1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_intck_step", "(sqlite3_intck *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_test_sql", "(sqlite3_intck *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_test_sql", "(sqlite3_intck *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_intck_unlock", "(sqlite3_intck *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_keyword_name", "(int,const char **,int *)", "", "Argument[0]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_keyword_name", "(int,const char **,int *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_keyword_name", "(int,const char **,int *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_last_insert_rowid", "(sqlite3 *)", "", "Argument[*0].Field[*lastRowid]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_limit", "(sqlite3 *,int,int)", "", "Argument[*0].Field[*aLimit]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_limit", "(sqlite3 *,int,int)", "", "Argument[1]", "Argument[*0].Field[*aLimit]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_limit", "(sqlite3 *,int,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_limit", "(sqlite3 *,int,int)", "", "Argument[2]", "Argument[*0].Field[*aLimit]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_load_extension", "(sqlite3 *,const char *,const char *,char **)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_next_stmt", "(sqlite3 *,sqlite3_stmt *)", "", "Argument[*1].Field[**pVNext]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_next_stmt", "(sqlite3 *,sqlite3_stmt *)", "", "Argument[*1].Field[*pVNext]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_open16", "(const void *,sqlite3 **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_open_v2", "(const char *,sqlite3 **,int,const char *)", "", "Argument[2]", "Argument[**1].Field[*openFlags]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_overload_function", "(sqlite3 *,const char *,int)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_overload_function", "(sqlite3 *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_overload_function", "(sqlite3 *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_percentile_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[*1]", "Argument[**4]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v2", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[*1]", "Argument[**4]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v2", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v2", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v2", "(sqlite3 *,const void *,int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v3", "(sqlite3 *,const void *,int,unsigned int,sqlite3_stmt **,const void **)", "", "Argument[*1]", "Argument[**5]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v3", "(sqlite3 *,const void *,int,unsigned int,sqlite3_stmt **,const void **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v3", "(sqlite3 *,const void *,int,unsigned int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[**5]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v3", "(sqlite3 *,const void *,int,unsigned int,sqlite3_stmt **,const void **)", "", "Argument[1]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare16_v3", "(sqlite3 *,const void *,int,unsigned int,sqlite3_stmt **,const void **)", "", "Argument[3]", "Argument[**4].Field[*prepFlags]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[*1]", "Argument[**4]", "value", "df-generated"]
+      - ["", "", True, "sqlite3_prepare", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v2", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[*1]", "Argument[**4]", "value", "df-generated"]
+      - ["", "", True, "sqlite3_prepare_v2", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v2", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v2", "(sqlite3 *,const char *,int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v3", "(sqlite3 *,const char *,int,unsigned int,sqlite3_stmt **,const char **)", "", "Argument[*1]", "Argument[**5]", "value", "df-generated"]
+      - ["", "", True, "sqlite3_prepare_v3", "(sqlite3 *,const char *,int,unsigned int,sqlite3_stmt **,const char **)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v3", "(sqlite3 *,const char *,int,unsigned int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[**5]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v3", "(sqlite3 *,const char *,int,unsigned int,sqlite3_stmt **,const char **)", "", "Argument[2]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_prepare_v3", "(sqlite3 *,const char *,int,unsigned int,sqlite3_stmt **,const char **)", "", "Argument[3]", "Argument[**4].Field[*prepFlags]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_profile", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pProfileArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_profile", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pProfileArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_profile", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xProfile]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_profile", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pProfileArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_progress_handler", "(sqlite3 *,int,..(*)(..),void *)", "", "Argument[**3]", "Argument[*0].Field[***pProgressArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_progress_handler", "(sqlite3 *,int,..(*)(..),void *)", "", "Argument[*3]", "Argument[*0].Field[**pProgressArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_progress_handler", "(sqlite3 *,int,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*nProgressOps]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_progress_handler", "(sqlite3 *,int,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*xProgress]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_progress_handler", "(sqlite3 *,int,..(*)(..),void *)", "", "Argument[3]", "Argument[*0].Field[*pProgressArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_randomness", "(int,void *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc64", "(void *,sqlite3_uint64)", "", "Argument[**0]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc64", "(void *,sqlite3_uint64)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc64", "(void *,sqlite3_uint64)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc", "(void *,int)", "", "Argument[**0]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc", "(void *,int)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_realloc", "(void *,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_config", "(sqlite3_recover *,int,void *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_recover_config", "(sqlite3_recover *,int,void *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_recover_config", "(sqlite3_recover *,int,void *)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_recover_errcode", "(sqlite3_recover *)", "", "Argument[*0].Field[*errCode]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_errmsg", "(sqlite3_recover *)", "", "Argument[*0].Field[**zErrMsg]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_errmsg", "(sqlite3_recover *)", "", "Argument[*0].Field[*zErrMsg]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_finish", "(sqlite3_recover *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[*1]", "ReturnValue[*].Field[**zDb]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[*2]", "ReturnValue[*].Field[**zUri]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[0]", "ReturnValue[*].Field[**zDb].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[0]", "ReturnValue[*].Field[**zUri].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[0]", "ReturnValue[*].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[1]", "ReturnValue[*].Field[**zDb]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init", "(sqlite3 *,const char *,const char *)", "", "Argument[2]", "ReturnValue[*].Field[**zUri]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[**3]", "ReturnValue[*].Field[***pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[*1]", "ReturnValue[*].Field[**zDb]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[*3]", "ReturnValue[*].Field[**pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[**zDb].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[**zUri].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[0]", "ReturnValue[*].Field[*dbIn]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[1]", "ReturnValue[*].Field[**zDb]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[2]", "ReturnValue[*].Field[*xSql]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_init_sql", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[3]", "ReturnValue[*].Field[*pSqlCtx]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_recover_run", "(sqlite3_recover *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_recover_step", "(sqlite3_recover *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_regexp_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_reset", "(sqlite3_stmt *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[*1]", "Argument[*0].Field[**pOut].Field[**zMalloc]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[*1]", "Argument[*0].Field[**pOut].Field[**z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[**z]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[*zMalloc]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[*z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[2]", "Argument[*0].Field[**pOut].Field[**z]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error16", "(sqlite3_context *,const void *,int)", "", "Argument[2]", "Argument[*0].Field[**pOut].Field[*n]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**pOut].Field[**zMalloc]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**pOut].Field[**z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[**z]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[*zMalloc]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**pOut].Field[*z]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[2]", "Argument[*0].Field[**pOut].Field[**z]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error", "(sqlite3_context *,const char *,int)", "", "Argument[2]", "Argument[*0].Field[**pOut].Field[*n]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_result_error_code", "(sqlite3_context *,int)", "", "Argument[1]", "Argument[*0].Field[*isError]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rollback_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pRollbackArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rollback_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pRollbackArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rollback_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xRollbackCallback]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rollback_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pRollbackArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_geometry_callback", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_geometry_callback", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_geometry_callback", "(sqlite3 *,const char *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_query_callback", "(sqlite3 *,const char *,..(*)(..),void *,..(*)(..))", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_query_callback", "(sqlite3 *,const char *,..(*)(..),void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_rtree_query_callback", "(sqlite3 *,const char *,..(*)(..),void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*lookaside].Field[**pSmallFree]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_serialize", "(sqlite3 *,const char *,sqlite3_int64 *,unsigned int)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_series_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_set_authorizer", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pAuthArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_authorizer", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pAuthArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_authorizer", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xAuth]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_authorizer", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pAuthArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_clientdata", "(sqlite3 *,const char *,void *,..(*)(..))", "", "Argument[*1]", "Argument[*0].Field[**pDbData].Field[*zName]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_clientdata", "(sqlite3 *,const char *,void *,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[**pDbData].Field[*zName]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_set_last_insert_rowid", "(sqlite3 *,sqlite3_int64)", "", "Argument[1]", "Argument[*0].Field[*lastRowid]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_sha_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_shathree_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_snprintf", "(int,char *,const char *,...)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_snprintf", "(int,char *,const char *,...)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_sql", "(sqlite3_stmt *)", "", "Argument[*0].Field[**zSql]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_sql", "(sqlite3_stmt *)", "", "Argument[*0].Field[*zSql]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_sqlar_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_status64", "(int,sqlite3_int64 *,sqlite3_int64 *,int)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_status64", "(int,sqlite3_int64 *,sqlite3_int64 *,int)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_status", "(int,int *,int *,int)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_status", "(int,int *,int *,int)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_step", "(sqlite3_stmt *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_step", "(sqlite3_stmt *)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_step", "(sqlite3_stmt *)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_stmt_explain", "(sqlite3_stmt *,int)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmt_explain", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[*explain]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmt_explain", "(sqlite3_stmt *,int)", "", "Argument[1]", "Argument[*0].Field[*nResColumn]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmt_isexplain", "(sqlite3_stmt *)", "", "Argument[*0].Field[*explain]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmt_readonly", "(sqlite3_stmt *)", "", "Argument[*0].Field[*readOnly]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmt_status", "(sqlite3_stmt *,int,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stmtrand_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_append", "(sqlite3_str *,const char *,int)", "", "Argument[*1]", "Argument[*0].Field[**zText]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_append", "(sqlite3_str *,const char *,int)", "", "Argument[1]", "Argument[*0].Field[**zText]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_append", "(sqlite3_str *,const char *,int)", "", "Argument[2]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_append", "(sqlite3_str *,const char *,int)", "", "Argument[2]", "Argument[*0].Field[*nChar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendall", "(sqlite3_str *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**zText]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendall", "(sqlite3_str *,const char *)", "", "Argument[1]", "Argument[*0].Field[**zText]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendchar", "(sqlite3_str *,int,char)", "", "Argument[1]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendchar", "(sqlite3_str *,int,char)", "", "Argument[2]", "Argument[*0].Field[**zText]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[*1]", "Argument[*0].Field[**zText]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[*1]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[*1]", "Argument[*0].Field[*nChar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[1]", "Argument[*0].Field[**zText]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[1]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_appendf", "(StrAccum *,sqlite3_str *,const char *,...)", "", "Argument[1]", "Argument[*0].Field[*nChar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_errcode", "(sqlite3_str *)", "", "Argument[*0].Field[*accError]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_finish", "(sqlite3_str *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_str_finish", "(sqlite3_str *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_str_length", "(sqlite3_str *)", "", "Argument[*0].Field[*nChar]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_new", "(sqlite3 *)", "", "Argument[*0].Field[*aLimit]", "ReturnValue[*].Field[*mxAlloc]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_value", "(sqlite3_str *)", "", "Argument[*0].Field[**zText]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_value", "(sqlite3_str *)", "", "Argument[*0].Field[*zText]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[*1]", "Argument[*0].Field[**zText]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[*1]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[*1]", "Argument[*0].Field[*nChar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[1]", "Argument[*0].Field[**zText]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[1]", "Argument[*0].Field[*nAlloc]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_str_vappendf", "(sqlite3_str *,const char *,va_list)", "", "Argument[1]", "Argument[*0].Field[*nChar]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strglob", "(const char *,const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stricmp", "(const char *,const char *)", "", "Argument[*0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_stricmp", "(const char *,const char *)", "", "Argument[*1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stricmp", "(const char *,const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_stricmp", "(const char *,const char *)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strlike", "(const char *,const char *,unsigned int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strnicmp", "(const char *,const char *,int)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strnicmp", "(const char *,const char *,int)", "", "Argument[*1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strnicmp", "(const char *,const char *,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_strnicmp", "(const char *,const char *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_system_errno", "(sqlite3 *)", "", "Argument[*0].Field[*iSysErrno]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_table_column_metadata", "(sqlite3 *,const char *,const char *,const char *,const char **,const char **,int *,int *,int *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_total_changes64", "(sqlite3 *)", "", "Argument[*0].Field[*nTotalChange]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_total_changes", "(sqlite3 *)", "", "Argument[*0].Field[*nTotalChange]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*trace].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace_v2", "(sqlite3 *,unsigned int,..(*)(..),void *)", "", "Argument[**3]", "Argument[*0].Field[***pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace_v2", "(sqlite3 *,unsigned int,..(*)(..),void *)", "", "Argument[*3]", "Argument[*0].Field[**pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace_v2", "(sqlite3 *,unsigned int,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*mTrace]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace_v2", "(sqlite3 *,unsigned int,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*trace].Union[*(unnamed class/struct/union)]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_trace_v2", "(sqlite3 *,unsigned int,..(*)(..),void *)", "", "Argument[3]", "Argument[*0].Field[*pTraceArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_transfer_bindings", "(sqlite3_stmt *,sqlite3_stmt *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_uint_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_update_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pUpdateArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_update_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pUpdateArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_update_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xUpdateCallback]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_update_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pUpdateArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_boolean", "(const char *,sqlite3_filename,const char *,int)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_boolean", "(const char *,sqlite3_filename,const char *,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_boolean", "(const char *,sqlite3_filename,const char *,int)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_int64", "(const char *,sqlite3_filename,const char *,sqlite3_int64)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_int64", "(const char *,sqlite3_filename,const char *,sqlite3_int64)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_int64", "(const char *,sqlite3_filename,const char *,sqlite3_int64)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_key", "(const char *,sqlite3_filename,int)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_key", "(const char *,sqlite3_filename,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_key", "(const char *,sqlite3_filename,int)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_parameter", "(const char *,sqlite3_filename,const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_parameter", "(const char *,sqlite3_filename,const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_uri_parameter", "(const char *,sqlite3_filename,const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_user_data", "(sqlite3_context *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_user_data", "(sqlite3_context *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_user_data", "(sqlite3_context *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_blob", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_blob", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_bytes16", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_bytes", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_double", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_dup", "(const sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "sqlite3_value_dup", "(const sqlite3_value *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_encoding", "(sqlite3_value *)", "", "Argument[*0].Field[*enc]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_frombind", "(sqlite3_value *)", "", "Argument[*0].Field[*flags]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_int64", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_int", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_numeric_type", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_pointer", "(sqlite3_value *,const char *)", "", "Argument[*0].Field[**z]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_pointer", "(sqlite3_value *,const char *)", "", "Argument[*0].Field[*z]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_subtype", "(sqlite3_value *)", "", "Argument[*0].Field[*eSubtype]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_value_text16", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text16", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text16be", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text16be", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text16le", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text16le", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_text", "(sqlite3_value *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_value_type", "(sqlite3_value *)", "", "Argument[*0].Field[*flags]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vmprintf", "(const char *,va_list)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vsnprintf", "(int,char *,const char *,va_list)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vsnprintf", "(int,char *,const char *,va_list)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vsnprintf", "(int,char *,const char *,va_list)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_collation", "(sqlite3_index_info *,int)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "sqlite3_vtab_distinct", "(sqlite3_index_info *)", "", "Argument[*0].Field[*eDistinct]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_in", "(sqlite3_index_info *,int,int)", "", "Argument[1]", "Argument[*0].Field[*mHandleIn]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_in_first", "(sqlite3_value *,sqlite3_value **)", "", "Argument[*0].Field[**z].Field[**pOut]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_in_first", "(sqlite3_value *,sqlite3_value **)", "", "Argument[*0].Field[**z].Field[*pOut]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_in_next", "(sqlite3_value *,sqlite3_value **)", "", "Argument[*0].Field[**z].Field[**pOut]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_in_next", "(sqlite3_value *,sqlite3_value **)", "", "Argument[*0].Field[**z].Field[*pOut]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_on_conflict", "(sqlite3 *)", "", "Argument[*0].Field[*vtabOnConflict]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_rhs_value", "(sqlite3_index_info *,int,sqlite3_value **)", "", "Argument[1]", "Argument[*0].Field[*aRhs]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_vtab_rhs_value", "(sqlite3_index_info *,int,sqlite3_value **)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_autocheckpoint", "(sqlite3 *,int)", "", "Argument[1]", "Argument[*0].Field[*pWalArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_checkpoint", "(sqlite3 *,const char *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_checkpoint_v2", "(sqlite3 *,const char *,int,int *,int *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[**2]", "Argument[*0].Field[***pWalArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[*2]", "Argument[*0].Field[**pWalArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[1]", "Argument[*0].Field[*xWalCallback]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_wal_hook", "(sqlite3 *,..(*)(..),void *)", "", "Argument[2]", "Argument[*0].Field[*pWalArg]", "value", "dfc-generated"]
+      - ["", "", True, "sqlite3_zipfile_init", "(sqlite3 *,char **,const sqlite3_api_routines *)", "", "Argument[0]", "Argument[*0].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "statecmp", "(config *,config *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "statecmp", "(config *,config *)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "statehash", "(config *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "strhash", "(const char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "strhash", "(const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_linedir", "(FILE *,int,char *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_linedir", "(FILE *,int,char *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_print", "(FILE *,lemon *,char *,int *)", "", "Argument[*1].Field[*outname]", "Argument[*1].Field[**outname]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_print", "(FILE *,lemon *,char *,int *)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_print", "(FILE *,lemon *,char *,int *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_print", "(FILE *,lemon *,char *,int *)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_print", "(FILE *,lemon *,char *,int *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_skip_header", "(FILE *,int *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_xfer", "(char *,FILE *,FILE *,int *)", "", "Argument[*0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_xfer", "(char *,FILE *,FILE *,int *)", "", "Argument[*1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_xfer", "(char *,FILE *,FILE *,int *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_xfer", "(char *,FILE *,FILE *,int *)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tplt_xfer", "(char *,FILE *,FILE *,int *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "useDummyCS", "(void *,sqlite3 *,int,const char *)", "", "Argument[1]", "Argument[*1].Field[**pErr].Field[*db]", "value", "dfc-generated"]
+      - ["", "", True, "utf8_fromunicode", "(char *,unsigned int)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "utf8_fromunicode", "(char *,unsigned int)", "", "Argument[1]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "zSkipValidUtf8", "(const char *,int,long)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "zSkipValidUtf8", "(const char *,int,long)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "zSkipValidUtf8", "(const char *,int,long)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 4.3.1-dev
+version: 5.1.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
@@ -8,6 +8,7 @@ upgrades: upgrades
 dependencies:
   codeql/dataflow: ${workspace}
   codeql/mad: ${workspace}
+  codeql/quantum: ${workspace}
   codeql/rangeanalysis: ${workspace}
   codeql/ssa: ${workspace}
   codeql/typeflow: ${workspace}
@@ -16,7 +17,7 @@ dependencies:
   codeql/xml: ${workspace}
 dataExtensions:
   - ext/*.model.yml
-  - ext/generated/*.model.yml
+  - ext/generated/**/*.model.yml
   - ext/deallocation/*.model.yml
   - ext/allocation/*.model.yml
 warnOnImplicitThis: true

cpp/ql/lib/semmle/code/cpp/Declaration.qll

@@ -88,7 +88,6 @@ class Declaration extends Locatable, @declaration {
    *
    * See the 3-argument `hasQualifiedName` for examples.
    */
-  pragma[noinline]
   predicate hasQualifiedName(string namespaceQualifier, string baseName) {
     this.hasQualifiedName(namespaceQualifier, "", baseName)
   }

cpp/ql/lib/semmle/code/cpp/Namespace.qll

@@ -174,7 +174,27 @@ class UsingDeclarationEntry extends UsingEntry {
    */
   Declaration getDeclaration() { usings(underlyingElement(this), unresolveElement(result), _, _) }
 
-  override string toString() { result = "using " + this.getDeclaration().getDescription() }
+  /**
+   * Gets the member that is referenced by this using declaration, where the member depends on a
+   * type template parameter.
+   *
+   * For example:
+   * ```
+   * template <typename T>
+   * class A {
+   *   using T::m;
+   * };
+   * ```
+   * Here, `getReferencedMember()` yields the member `m` of `T`. Observe that,
+   * as `T` is not instantiated, `m` is represented by a `Literal` and not
+   * a `Declaration`.
+   */
+  Literal getReferencedMember() { usings(underlyingElement(this), unresolveElement(result), _, _) }
+
+  override string toString() {
+    result = "using " + this.getDeclaration().getDescription() or
+    result = "using " + this.getReferencedMember()
+  }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -839,6 +839,9 @@ private predicate floatingPointTypeMapping(
   or
   // _Complex _Float128
   kind = 61 and base = 2 and domain = TComplexDomain() and realKind = 49 and extended = false
+  or
+  // __mfp8
+  kind = 62 and base = 2 and domain = TRealDomain() and realKind = 62 and extended = false
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll

@@ -98,19 +98,6 @@ class Node extends TNode {
   /** Gets the location of this element. */
   Location getLocation() { none() } // overridden by subclasses
 
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  deprecated predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /**
    * Gets an upper bound on the type of this node.
    */

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -22,7 +22,11 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   ArgumentPosition callbackSelfParameterPosition() { result = TDirectPosition(-1) }
 
-  ReturnKind getStandardReturnValueKind() { result.(NormalReturnKind).getIndirectionIndex() = 0 }
+  ReturnKind getStandardReturnValueKind() { result = getReturnValueKind("") }
+
+  ReturnKind getReturnValueKind(string arg) {
+    arg = repeatStars(result.(NormalReturnKind).getIndirectionIndex())
+  }
 
   string encodeParameterPosition(ParameterPosition pos) { result = pos.toString() }
 

cpp/ql/lib/semmle/code/cpp/exprs/Lambda.qll

@@ -41,12 +41,17 @@ class LambdaExpression extends Expr, @lambdaexpr {
    *   - "&" if capture-by-reference is the default for implicit captures.
    *   - "=" if capture-by-value is the default for implicit captures.
    */
-  string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _) }
+  string getDefaultCaptureMode() { lambdas(underlyingElement(this), result, _, _) }
 
   /**
    * Holds if the return type (of the call operator of the resulting object) was explicitly specified.
    */
-  predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true) }
+  predicate returnTypeIsExplicit() { lambdas(underlyingElement(this), _, true, _) }
+
+  /**
+   * Holds if the lambda has an explicitly specified parameter list, even when empty.
+   */
+  predicate hasParameterList() { lambdas(underlyingElement(this), _, _, true) }
 
   /**
    * Gets the function which will be invoked when the resulting object is called.

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

@@ -1143,6 +1143,10 @@ private newtype TDataFlowCall =
     FlowSummaryImpl::Private::summaryCallbackRange(c, receiver)
   }
 
+private predicate summarizedCallableIsManual(SummarizedCallable sc) {
+  sc.asSummarizedCallable().applyManualModel()
+}
+
 /**
  * A function call relevant for data flow. This includes calls from source
  * code and calls inside library callables with a flow summary.
@@ -1164,15 +1168,27 @@ class DataFlowCall extends TDataFlowCall {
   Function getStaticCallSourceTarget() { none() }
 
   /**
-   * Gets the target of this call. If a summarized callable exists for the
-   * target this is chosen, and otherwise the callable is the implementation
-   * from the source code.
+   * Gets the target of this call. We use the following strategy for deciding
+   * between the source callable and a summarized callable:
+   * - If there is a manual summary then we always use the manual summary.
+   * - If there is a source callable and we only have generated summaries
+   * we use the source callable.
+   * - If there is no source callable then we use the summary regardless of
+   * whether is it manual or generated.
    */
-  DataFlowCallable getStaticCallTarget() {
+  final DataFlowCallable getStaticCallTarget() {
     exists(Function target | target = this.getStaticCallSourceTarget() |
-      not exists(TSummarizedCallable(target)) and
+      // Don't use the source callable if there is a manual model for the
+      // target
+      not exists(SummarizedCallable sc |
+        sc.asSummarizedCallable() = target and
+        summarizedCallableIsManual(sc)
+      ) and
       result.asSourceCallable() = target
       or
+      // When there is no function body, or when we have a manual model then
+      // we dispatch to the summary.
+      (not target.hasDefinition() or summarizedCallableIsManual(result)) and
       result.asSummarizedCallable() = target
     )
   }
@@ -1567,7 +1583,7 @@ private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, Parame
         |
           exists(Ssa::UseImpl use | use.hasIndexInBlock(useblock, _, sv))
           or
-          exists(Ssa::DefImpl def | def.hasIndexInBlock(useblock, _, sv))
+          exists(Ssa::DefImpl def | def.hasIndexInBlock(sv, useblock, _))
         )
       )
   )
@@ -1814,7 +1830,7 @@ module IteratorFlow {
      */
     private predicate isIteratorWrite(Instruction write, Operand address) {
       exists(Ssa::DefImpl writeDef, IRBlock bb, int i |
-        writeDef.hasIndexInBlock(bb, i, _) and
+        writeDef.hasIndexInBlock(_, bb, i) and
         bb.getInstruction(i) = write and
         address = writeDef.getAddressOperand()
       )
@@ -1887,6 +1903,10 @@ module IteratorFlow {
     predicate allowFlowIntoUncertainDef(IteratorSsa::UncertainWriteDefinition def) { any() }
 
     class Guard extends Void {
+      predicate hasBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
+        none()
+      }
+
       predicate controlsBranchEdge(
         SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch
       ) {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

@@ -538,19 +538,6 @@ class Node extends TIRDataFlowNode {
     none() // overridden by subclasses
   }
 
-  /**
-   * Holds if this element is at the specified location.
-   * The location spans column `startcolumn` of line `startline` to
-   * column `endcolumn` of line `endline` in file `filepath`.
-   * For more information, see
-   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
-   */
-  deprecated predicate hasLocationInfo(
-    string filepath, int startline, int startcolumn, int endline, int endcolumn
-  ) {
-    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-  }
-
   /** Gets a textual representation of this element. */
   cached
   final string toString() {

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ExprNodes.qll

@@ -45,6 +45,28 @@ private module Cached {
     )
   }
 
+  private Expr getRankedElementExpr(ArrayAggregateLiteral aggr, int rnk) {
+    result =
+      rank[rnk + 1](Expr e, int elementIndex, int position |
+        e = aggr.getElementExpr(elementIndex, position)
+      |
+        e order by elementIndex, position
+      )
+  }
+
+  private class LastArrayAggregateStore extends StoreInstruction {
+    ArrayAggregateLiteral aggr;
+
+    LastArrayAggregateStore() {
+      exists(int rnk |
+        this.getSourceValue().getUnconvertedResultExpression() = getRankedElementExpr(aggr, rnk) and
+        not exists(getRankedElementExpr(aggr, rnk + 1))
+      )
+    }
+
+    ArrayAggregateLiteral getArrayAggregateLiteral() { result = aggr }
+  }
+
   private Expr getConvertedResultExpressionImpl0(Instruction instr) {
     // IR construction inserts an additional cast to a `size_t` on the extent
     // of a `new[]` expression. The resulting `ConvertInstruction` doesn't have
@@ -95,6 +117,16 @@ private module Cached {
       tco.producesExprResult() and
       result = asDefinitionImpl0(instr)
     )
+    or
+    // IR construction breaks an array aggregate literal `{1, 2, 3}` into a
+    // sequence of `StoreInstruction`s. So there's no instruction `i` for which
+    // `i.getUnconvertedResultExpression() instanceof ArrayAggregateLiteral`.
+    // So we map the instruction node corresponding to the last `Store`
+    // instruction of the sequence to the result of the array aggregate
+    // literal. This makes sense since this store will immediately flow into
+    // the indirect node representing the array. So this node does represent
+    // the array after it has been fully initialized.
+    result = instr.(LastArrayAggregateStore).getArrayAggregateLiteral()
   }
 
   private Expr getConvertedResultExpressionImpl(Instruction instr) {
@@ -264,6 +296,41 @@ private module Cached {
     e = getConvertedResultExpression(node.asInstruction(), n)
   }
 
+  /**
+   * The IR doesn't have an instruction `i` for which this holds:
+   * ```
+   * i.getUnconvertedResultExpression() instanceof ClassAggregateLiteral
+   * ```
+   * and thus we don't automatically get a dataflow node for which:
+   * ```
+   * node.asExpr() instanceof ClassAggregateLiteral
+   * ```
+   * This is because the IR represents a `ClassAggregateLiteral` as a sequence
+   * of field writes. To work around this we map `asExpr` on the
+   * `PostUpdateNode` for the last field write to the class aggregate literal.
+   */
+  private class ClassAggregateInitializerPostUpdateNode extends PostFieldUpdateNode {
+    ClassAggregateLiteral aggr;
+
+    ClassAggregateInitializerPostUpdateNode() {
+      exists(Node node1, FieldContent fc, int position, StoreInstruction store |
+        store.getSourceValue().getUnconvertedResultExpression() =
+          aggr.getFieldExpr(fc.getField(), position) and
+        node1.asInstruction() = store and
+        // This is the last field write from the aggregate initialization.
+        not exists(aggr.getFieldExpr(_, position + 1)) and
+        storeStep(node1, fc, this)
+      )
+    }
+
+    ClassAggregateLiteral getClassAggregateLiteral() { result = aggr }
+  }
+
+  private predicate exprNodeShouldBePostUpdateNode(Node node, Expr e, int n) {
+    node.(ClassAggregateInitializerPostUpdateNode).getClassAggregateLiteral() = e and
+    n = 0
+  }
+
   /** Holds if `node` should be an `IndirectInstruction` that maps `node.asIndirectExpr()` to `e`. */
   private predicate indirectExprNodeShouldBeIndirectInstruction(
     IndirectInstruction node, Expr e, int n, int indirectionIndex
@@ -294,7 +361,8 @@ private module Cached {
     exprNodeShouldBeInstruction(_, e, n) or
     exprNodeShouldBeOperand(_, e, n) or
     exprNodeShouldBeIndirectOutNode(_, e, n) or
-    exprNodeShouldBeIndirectOperand(_, e, n)
+    exprNodeShouldBeIndirectOperand(_, e, n) or
+    exprNodeShouldBePostUpdateNode(_, e, n)
   }
 
   private class InstructionExprNode extends ExprNodeBase, InstructionNode {
@@ -442,6 +510,12 @@ private module Cached {
     final override Expr getConvertedExpr(int n) { exprNodeShouldBeIndirectOperand(this, result, n) }
   }
 
+  private class PostUpdateExprNode extends ExprNodeBase instanceof PostUpdateNode {
+    PostUpdateExprNode() { exprNodeShouldBePostUpdateNode(this, _, _) }
+
+    final override Expr getConvertedExpr(int n) { exprNodeShouldBePostUpdateNode(this, result, n) }
+  }
+
   /**
    * An expression, viewed as a node in a data flow graph.
    */

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

@@ -191,7 +191,7 @@ abstract class DefImpl extends TDefImpl {
    * Holds if this definition (or use) has index `index` in block `block`,
    * and is a definition (or use) of the variable `sv`
    */
-  final predicate hasIndexInBlock(IRBlock block, int index, SourceVariable sv) {
+  final predicate hasIndexInBlock(SourceVariable sv, IRBlock block, int index) {
     this.hasIndexInBlock(block, index) and
     sv = this.getSourceVariable()
   }
@@ -891,12 +891,12 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {
   predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
     DataFlowImplCommon::forceCachingInSameStage() and
     (
-      exists(DefImpl def | def.hasIndexInBlock(bb, i, v) |
+      exists(DefImpl def | def.hasIndexInBlock(v, bb, i) |
         if def.isCertain() then certain = true else certain = false
       )
       or
       exists(GlobalDefImpl global |
-        global.hasIndexInBlock(bb, i, v) and
+        global.hasIndexInBlock(v, bb, i) and
         certain = true
       )
     )
@@ -934,10 +934,11 @@ module SsaCached {
 }
 
 /** Gets the `DefImpl` corresponding to `def`. */
+pragma[nomagic]
 private DefImpl getDefImpl(SsaImpl::Definition def) {
   exists(SourceVariable sv, IRBlock bb, int i |
     def.definesAt(sv, bb, i) and
-    result.hasIndexInBlock(bb, i, sv)
+    result.hasIndexInBlock(sv, bb, i)
   )
 }
 
@@ -990,13 +991,17 @@ private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationI
   class Guard instanceof IRGuards::IRGuardCondition {
     string toString() { result = super.toString() }
 
-    predicate controlsBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
+    predicate hasBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
       exists(EdgeKind kind |
         super.getBlock() = bb1 and
         kind = getConditionalEdge(branch) and
         bb1.getSuccessor(kind) = bb2
       )
     }
+
+    predicate controlsBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
+      this.hasBranchEdge(bb1, bb2, branch)
+    }
   }
 
   predicate guardDirectlyControlsBlock(Guard guard, SsaInput::BasicBlock bb, boolean branch) {

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll

@@ -58,4 +58,12 @@ class IRFunction extends IRFunctionBase {
    * Gets all blocks in this function.
    */
   final IRBlock getABlock() { result.getEnclosingIRFunction() = this }
+
+  /**
+   * Holds if this function may have incomplete def-use information.
+   *
+   * Def-use information may be omitted for a function when it is too expensive
+   * to compute.
+   */
+  final predicate hasIncompleteSsa() { Construction::hasIncompleteSsa(this) }
 }