Merge pull request #19860 from github/release-prep/2.22.1

Release preparation for version 2.22.1

.github/workflows/python-tooling.yml

@@ -1,10 +1,11 @@
-name: Codegen
+name: Python tooling
 
 on:
   pull_request:
     paths:
       - "misc/bazel/**"
       - "misc/codegen/**"
+      - "misc/scripts/models-as-data/bulk_generate_mad.py"
       - "*.bazel*"
       - .github/workflows/codegen.yml
       - .pre-commit-config.yaml
@@ -17,17 +18,17 @@ permissions:
   contents: read
 
 jobs:
-  codegen:
+  check-python-tooling:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
-          python-version-file: 'misc/codegen/.python-version'
+          python-version: '3.12'
       - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507
         name: Check that python code is properly formatted
         with:
-          extra_args: autopep8 --all-files
+          extra_args: black --all-files
       - name: Run codegen tests
         shell: bash
         run: |

.pre-commit-config.yaml

@@ -1,5 +1,7 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
+default_language_version:
+  python: python3.12
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v3.2.0
@@ -7,18 +9,18 @@ repos:
       - id: trailing-whitespace
         exclude: /test/.*$(?<!\.qlref)|.*\.patch$|.*\.qll?$
       - id: end-of-file-fixer
-        exclude: /test/.*$(?<!\.qlref)|.*\.patch$|.*\.qll?$
+        exclude: Cargo.lock$|/test/.*$(?<!\.qlref)|.*\.patch$|.*\.qll?$
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
     rev: v17.0.6
     hooks:
       - id: clang-format
 
-  - repo: https://github.com/pre-commit/mirrors-autopep8
-    rev: v2.0.4
+  - repo: https://github.com/psf/black
+    rev: 25.1.0
     hooks:
-      - id: autopep8
-        files: ^misc/codegen/.*\.py
+      - id: black
+        files: ^(misc/codegen/.*|misc/scripts/models-as-data/.*)\.py$
 
   - repo: local
     hooks:

Cargo.toml

@@ -11,8 +11,3 @@ members = [
     "rust/autobuild",
 ]
 exclude = ["mad-generation-build"]
-
-[patch.crates-io]
-# patch for build script bug preventing bazel build
-# see https://github.com/rust-lang/rustc_apfloat/pull/17
-rustc_apfloat = { git = "https://github.com/redsun82/rustc_apfloat.git", rev = "32968f16ef1b082243f9bf43a3fbd65c381b3e27" }

MODULE.bazel

@@ -37,7 +37,7 @@ bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True
 # the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.
 RUST_EDITION = "2024"
 
-RUST_VERSION = "1.85.0"
+RUST_VERSION = "1.86.0"
 
 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
 rust.toolchain(
@@ -71,11 +71,11 @@ use_repo(
 tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
 use_repo(
     tree_sitter_extractors_deps,
-    "vendor_ts__anyhow-1.0.97",
+    "vendor_ts__anyhow-1.0.98",
     "vendor_ts__argfile-0.2.1",
-    "vendor_ts__chalk-ir-0.100.0",
-    "vendor_ts__chrono-0.4.40",
-    "vendor_ts__clap-4.5.35",
+    "vendor_ts__chalk-ir-0.103.0",
+    "vendor_ts__chrono-0.4.41",
+    "vendor_ts__clap-4.5.40",
     "vendor_ts__dunce-1.0.5",
     "vendor_ts__either-1.15.0",
     "vendor_ts__encoding-0.2.33",
@@ -87,33 +87,33 @@ use_repo(
     "vendor_ts__lazy_static-1.5.0",
     "vendor_ts__mustache-0.9.0",
     "vendor_ts__num-traits-0.2.19",
-    "vendor_ts__num_cpus-1.16.0",
-    "vendor_ts__proc-macro2-1.0.94",
+    "vendor_ts__num_cpus-1.17.0",
+    "vendor_ts__proc-macro2-1.0.95",
     "vendor_ts__quote-1.0.40",
-    "vendor_ts__ra_ap_base_db-0.0.273",
-    "vendor_ts__ra_ap_cfg-0.0.273",
-    "vendor_ts__ra_ap_hir-0.0.273",
-    "vendor_ts__ra_ap_hir_def-0.0.273",
-    "vendor_ts__ra_ap_hir_expand-0.0.273",
-    "vendor_ts__ra_ap_hir_ty-0.0.273",
-    "vendor_ts__ra_ap_ide_db-0.0.273",
-    "vendor_ts__ra_ap_intern-0.0.273",
-    "vendor_ts__ra_ap_load-cargo-0.0.273",
-    "vendor_ts__ra_ap_parser-0.0.273",
-    "vendor_ts__ra_ap_paths-0.0.273",
-    "vendor_ts__ra_ap_project_model-0.0.273",
-    "vendor_ts__ra_ap_span-0.0.273",
-    "vendor_ts__ra_ap_stdx-0.0.273",
-    "vendor_ts__ra_ap_syntax-0.0.273",
-    "vendor_ts__ra_ap_vfs-0.0.273",
-    "vendor_ts__rand-0.9.0",
+    "vendor_ts__ra_ap_base_db-0.0.288",
+    "vendor_ts__ra_ap_cfg-0.0.288",
+    "vendor_ts__ra_ap_hir-0.0.288",
+    "vendor_ts__ra_ap_hir_def-0.0.288",
+    "vendor_ts__ra_ap_hir_expand-0.0.288",
+    "vendor_ts__ra_ap_hir_ty-0.0.288",
+    "vendor_ts__ra_ap_ide_db-0.0.288",
+    "vendor_ts__ra_ap_intern-0.0.288",
+    "vendor_ts__ra_ap_load-cargo-0.0.288",
+    "vendor_ts__ra_ap_parser-0.0.288",
+    "vendor_ts__ra_ap_paths-0.0.288",
+    "vendor_ts__ra_ap_project_model-0.0.288",
+    "vendor_ts__ra_ap_span-0.0.288",
+    "vendor_ts__ra_ap_stdx-0.0.288",
+    "vendor_ts__ra_ap_syntax-0.0.288",
+    "vendor_ts__ra_ap_vfs-0.0.288",
+    "vendor_ts__rand-0.9.1",
     "vendor_ts__rayon-1.10.0",
     "vendor_ts__regex-1.11.1",
     "vendor_ts__serde-1.0.219",
     "vendor_ts__serde_json-1.0.140",
-    "vendor_ts__serde_with-3.12.0",
-    "vendor_ts__syn-2.0.100",
-    "vendor_ts__toml-0.8.20",
+    "vendor_ts__serde_with-3.13.0",
+    "vendor_ts__syn-2.0.103",
+    "vendor_ts__toml-0.8.23",
     "vendor_ts__tracing-0.1.41",
     "vendor_ts__tracing-flame-0.2.0",
     "vendor_ts__tracing-subscriber-0.3.19",

actions/ql/integration-tests/query-suite/actions-code-quality-extended.qls.expected

@@ -0,0 +1 @@
+

actions/ql/integration-tests/query-suite/test.py

@@ -2,7 +2,7 @@ import runs_on
 import pytest
 from query_suites import *
 
-well_known_query_suites = ['actions-code-quality.qls', 'actions-security-and-quality.qls', 'actions-security-extended.qls', 'actions-code-scanning.qls']
+well_known_query_suites = ['actions-code-quality.qls', 'actions-code-quality-extended.qls', 'actions-security-and-quality.qls', 'actions-security-extended.qls', 'actions-code-scanning.qls']
 
 @runs_on.posix
 @pytest.mark.parametrize("query_suite", well_known_query_suites)

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.4.12
+
+### Minor Analysis Improvements
+
+* Fixed performance issues in the parsing of Bash scripts in workflow files,
+  which led to out-of-disk errors when analysing certain workflow files with
+  complex interpolations of shell commands or quoted strings.
+
 ## 0.4.11
 
 No user-facing changes.

actions/ql/lib/change-notes/released/0.4.12.md

@@ -0,0 +1,7 @@
+## 0.4.12
+
+### Minor Analysis Improvements
+
+* Fixed performance issues in the parsing of Bash scripts in workflow files,
+  which led to out-of-disk errors when analysing certain workflow files with
+  complex interpolations of shell commands or quoted strings.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.11
+lastReleaseVersion: 0.4.12

actions/ql/lib/codeql/actions/Bash.qll

@@ -8,35 +8,64 @@ class BashShellScript extends ShellScript {
     )
   }
 
-  private string lineProducer(int i) {
-    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", i)
+  /**
+   * Gets the line at 0-based index `lineIndex` within this shell script,
+   * assuming newlines as separators.
+   */
+  private string lineProducer(int lineIndex) {
+    result = this.getRawScript().regexpReplaceAll("\\\\\\s*\n", "").splitAt("\n", lineIndex)
   }
 
-  private predicate cmdSubstitutionReplacement(string cmdSubs, string id, int k) {
-    exists(string line | line = this.lineProducer(k) |
-      exists(int i, int j |
-        cmdSubs =
-          // $() cmd substitution
-          line.regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", i, j)
-              .regexpReplaceAll("^\\$\\(", "")
-              .regexpReplaceAll("\\)$", "") and
-        id = "cmdsubs:" + k + ":" + i + ":" + j
-      )
-      or
-      exists(int i, int j |
-        // `...` cmd substitution
-        cmdSubs =
-          line.regexpFind("\\`[^\\`]+\\`", i, j)
-              .regexpReplaceAll("^\\`", "")
-              .regexpReplaceAll("\\`$", "") and
-        id = "cmd:" + k + ":" + i + ":" + j
-      )
+  private predicate cmdSubstitutionReplacement(string command, string id, int lineIndex) {
+    this.commandInSubstitution(lineIndex, command, id)
+    or
+    this.commandInBackticks(lineIndex, command, id)
+  }
+
+  /**
+   * Holds if there is a command substitution `$(command)` in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this command.
+   */
+  private predicate commandInSubstitution(int lineIndex, string command, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      command =
+        // Look for the command inside a $(...) command substitution
+        this.lineProducer(lineIndex)
+            .regexpFind("\\$\\((?:[^()]+|\\((?:[^()]+|\\([^()]*\\))*\\))*\\)", occurrenceIndex,
+              occurrenceOffset)
+            // trim starting $( - TODO do this in first regex
+            .regexpReplaceAll("^\\$\\(", "")
+            // trim ending ) - TODO do this in first regex
+            .regexpReplaceAll("\\)$", "") and
+      id = "cmdsubs:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
     )
   }
 
-  private predicate rankedCmdSubstitutionReplacements(int i, string old, string new) {
-    old = rank[i](string old2 | this.cmdSubstitutionReplacement(old2, _, _) | old2) and
-    this.cmdSubstitutionReplacement(old, new, _)
+  /**
+   * Holds if `command` is a command in backticks `` `...` `` in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this command.
+   */
+  private predicate commandInBackticks(int lineIndex, string command, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      command =
+        this.lineProducer(lineIndex)
+            .regexpFind("\\`[^\\`]+\\`", occurrenceIndex, occurrenceOffset)
+            // trim leading backtick - TODO do this in first regex
+            .regexpReplaceAll("^\\`", "")
+            // trim trailing backtick - TODO do this in first regex
+            .regexpReplaceAll("\\`$", "") and
+      id = "cmd:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset
+    )
+  }
+
+  private predicate rankedCmdSubstitutionReplacements(int i, string command, string commandId) {
+    // rank commands by their unique IDs
+    commandId = rank[i](string c, string id | this.cmdSubstitutionReplacement(c, id, _) | id) and
+    // since we cannot output (command, ID) tuples from the rank operation,
+    // we need to work out the specific command associated with the resulting ID
+    this.cmdSubstitutionReplacement(command, commandId, _)
   }
 
   private predicate doReplaceCmdSubstitutions(int line, int round, string old, string new) {
@@ -64,31 +93,56 @@ class BashShellScript extends ShellScript {
     this.cmdSubstitutionReplacement(result, _, i)
   }
 
+  /**
+   * Holds if `quotedStr` is a string in double quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate doubleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // double quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
+  /**
+   * Holds if `quotedStr` is a string in single quotes in
+   * the line at `lineIndex` in the shell script,
+   * and `id` is a unique identifier for this quoted string.
+   */
+  private predicate singleQuotedString(int lineIndex, string quotedStr, string id) {
+    exists(int occurrenceIndex, int occurrenceOffset |
+      // single quoted string
+      quotedStr =
+        this.cmdSubstitutedLineProducer(lineIndex)
+            .regexpFind("'((?:\\\\.|[^'\\\\])*)'", occurrenceIndex, occurrenceOffset) and
+      id =
+        "qstr:" + lineIndex + ":" + occurrenceIndex + ":" + occurrenceOffset + ":" +
+          quotedStr.length() + ":" + quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
+    )
+  }
+
   private predicate quotedStringReplacement(string quotedStr, string id) {
-    exists(string line, int k | line = this.cmdSubstitutedLineProducer(k) |
-      exists(int i, int j |
-        // double quoted string
-        quotedStr = line.regexpFind("\"((?:[^\"\\\\]|\\\\.)*)\"", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
+    exists(int lineIndex |
+      this.doubleQuotedString(lineIndex, quotedStr, id)
       or
-      exists(int i, int j |
-        // single quoted string
-        quotedStr = line.regexpFind("'((?:\\\\.|[^'\\\\])*)'", i, j) and
-        id =
-          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
-            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
-      )
+      this.singleQuotedString(lineIndex, quotedStr, id)
     ) and
     // Only do this for strings that might otherwise disrupt subsequent parsing
     quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
   }
 
-  private predicate rankedQuotedStringReplacements(int i, string old, string new) {
-    old = rank[i](string old2 | this.quotedStringReplacement(old2, _) | old2) and
-    this.quotedStringReplacement(old, new)
+  private predicate rankedQuotedStringReplacements(int i, string quotedString, string quotedStringId) {
+    // rank quoted strings by their nearly-unique IDs
+    quotedStringId = rank[i](string s, string id | this.quotedStringReplacement(s, id) | id) and
+    // since we cannot output (string, ID) tuples from the rank operation,
+    // we need to work out the specific string associated with the resulting ID
+    this.quotedStringReplacement(quotedString, quotedStringId)
   }
 
   private predicate doReplaceQuotedStrings(int line, int round, string old, string new) {

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -214,6 +214,10 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
       )
     )
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */

actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll

@@ -16,6 +16,10 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll

@@ -15,6 +15,10 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.11
+version: 0.4.12
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.4
+
+No user-facing changes.
+
 ## 0.6.3
 
 No user-facing changes.

actions/ql/src/Models/CompositeActionsSinks.ql

@@ -24,6 +24,10 @@ private module MyConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     sink instanceof CodeInjectionSink and not madSink(sink, "code-injection")
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSources.ql

@@ -34,6 +34,10 @@ private module MyConfig implements DataFlow::ConfigSig {
     isSink(node) and
     set instanceof DataFlow::FieldContent
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/CompositeActionsSummaries.ql

@@ -25,6 +25,10 @@ private module MyConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     exists(CompositeAction c | c.getAnOutputExpr() = sink.asExpr())
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSinks.ql

@@ -24,6 +24,10 @@ private module MyConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     sink instanceof CodeInjectionSink and not madSink(sink, "code-injection")
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSources.ql

@@ -34,6 +34,10 @@ private module MyConfig implements DataFlow::ConfigSig {
     isSink(node) and
     set instanceof DataFlow::FieldContent
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/Models/ReusableWorkflowsSummaries.ql

@@ -25,6 +25,10 @@ private module MyConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     exists(ReusableWorkflow w | w.getAnOutputExpr() = sink.asExpr())
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module MyFlow = TaintTracking::Global<MyConfig>;

actions/ql/src/change-notes/released/0.6.4.md

@@ -0,0 +1,3 @@
+## 0.6.4
+
+No user-facing changes.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.3
+lastReleaseVersion: 0.6.4

actions/ql/src/codeql-suites/actions-code-quality-extended.qls

@@ -0,0 +1,3 @@
+- queries: .
+- apply: code-quality-extended-selectors.yml
+  from: codeql/suite-helpers

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.3
+version: 0.6.4
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

actions/ql/test/query-tests/Security/CWE-094/.github/workflows/interpolation.yml

@@ -0,0 +1,81 @@
+name: Workflow with complex interpolation
+on: 
+  workflow_dispatch:
+    inputs:
+      choice-a:
+        required: true
+        type: choice
+        description: choice-a
+        default: a1
+        options: 
+        - a1
+        - a2
+        - a3
+      string-b:
+        required: false
+        type: string
+        description: string-b
+      string-c:
+        required: false
+        type: string
+        description: string-c
+      list-d:
+        required: true
+        type: string
+        default: d1 d2
+        description: list-d whitespace separated
+      list-e:
+        required: false
+        type: string
+        description: list-e whitespace separated
+      choice-f:
+        required: true
+        type: choice
+        description: choice-f
+        options: 
+        - false
+        - true
+          
+env:
+  DRY_TEST: false
+  B: ${{ github.event.inputs.string-b }}
+
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Produce values
+      id: produce-values
+      run: |
+        echo "region=region" >> $GITHUB_OUTPUT
+        echo "zone=zone" >> $GITHUB_OUTPUT
+
+    - name: Step with complex interpolation
+      id: complex
+      env:
+        CHOICE_A: ${{ github.event.inputs.choice-a }}
+        STRING_B: ${{ github.event.inputs.string-b }}
+        STRING_C: ${{ github.event.inputs.string-c }}
+        LIST_D: ${{ github.event.inputs.list-d }}
+        LIST_E: ${{ github.event.inputs.list-e }}
+        CHOICE_F: ${{ github.event.inputs.choice-f }}
+        REGION: ${{ steps.produce-values.outputs.region }}
+        ZONE: ${{ steps.produce-values.outputs.zone }}
+        DRY_TEST_JSON: ${{ fromJSON(env.DRY_TEST) }}
+        FUNCTION_NAME: my-function
+        USER_EMAIL: 'example@example.com'
+        TYPE: type
+        RANGE: '0-100'
+
+      run: |
+        comma_separated_list_d=$(echo "${LIST_D}" | sed "s/ /\",\"/g")
+        comma_separated_list_e=$(echo "${LIST_E}" | sed "s/ /\",\"/g")
+        c1=$(echo "${STRING_C}" | cut -d "-" -f 1)
+        c2=$(echo "${STRING_C}" | cut -d "-" -f 2)
+        # Similar commands that use JSON payloads with string interpolation.
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":["'"${comma_separated_list_d}"'"],"listE":"","dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+        response=$(aws lambda invoke --invocation-type RequestResponse --function-name "${FUNCTION_NAME}" --region "${REGION}" --cli-read-timeout 0 --cli-binary-format raw-in-base64-out --payload '{"appName":"my-app","chA":"'"${CHOICE_A}"'","c1":"'"${c1}"'","c2":"'"${c2}"'","a":"${CHOICE_A}","bValue":"${B}","zone":"${ZONE}","userEmail":"'"${USER_EMAIL}"'","region":"${REGION}","range":"${RANGE}","type":"${TYPE}","b":"${STRING_B}","listD":"","listE":["'"${comma_separated_list_e}"'"],"dryTest":'"${DRY_TEST_JSON}"',"f":"${CHOICE_F}"}' ./config.json --log-type Tail)
+      shell: bash

config/add-overlay-annotations.py

@@ -0,0 +1,274 @@
+# This script is used to annotate .qll files without any existing overlay annotations
+# with overlay[local?] and overlay[caller?] annotations. Maintenance of overlay annotations
+# in annotated files will be handled by QL-for-QL queries.
+
+# It will walk the directory tree and annotate most .qll files, skipping only
+# some specific cases (e.g., empty files, files that configure dataflow for queries).
+
+# The script takes a list of languages and processes the corresponding directories.
+# If the optional --check argument is provided, the script checks for missing annotations,
+# but does not modify any files.
+
+# Usage: python3 add-overlay-annotations.py [--check] <language1> <language2> ...
+
+# The script will modify the files in place and print the changes made.
+# The script is designed to be run from the root of the repository.
+
+#!/usr/bin/python3
+import sys
+import os
+from difflib import context_diff
+
+
+def has_overlay_annotations(lines):
+    '''
+    Check whether the given lines contain any overlay[...] annotations.
+    '''
+    overlays = ["local", "local?", "global", "caller", "caller?"]
+    annotations = [f"overlay[{t}]" for t in overlays]
+    return any(ann in line for ann in annotations for line in lines)
+
+
+def is_line_comment(line):
+    return line.startswith("//") or (line.startswith("/*") and line.endswith("*/"))
+
+
+def find_file_level_module_declaration(lines):
+    '''
+    Returns the index of the existing file-level module declaration if one
+    exists. Returns None otherwise.
+    '''
+    comment = False
+    for i, line in enumerate(lines):
+        trimmed = line.strip()
+
+        if is_line_comment(trimmed):
+            continue
+        elif trimmed.startswith("/*"):
+            comment = True
+        elif comment and trimmed.endswith("*/"):
+            comment = False
+        elif not comment and trimmed.endswith("module;"):
+            return i
+
+    return None
+
+
+def is_file_module_qldoc(i, lines):
+    '''
+    Assuming a qldoc ended on line i, determine if it belongs to the implicit
+    file-level module. If it is followed by another qldoc or imports, then it
+    does and if it is followed by any other non-empty, non-comment lines, then
+    we assume that is a declaration of some kind and the qldoc is attached to
+    that declaration.
+    '''
+    comment = False
+
+    for line in lines[i+1:]:
+        trimmed = line.strip()
+
+        if trimmed.startswith("import ") or trimmed.startswith("private import ") or trimmed.startswith("/**"):
+             return True
+        elif is_line_comment(trimmed) or not trimmed:
+             continue
+        elif trimmed.startswith("/*"):
+             comment = True
+        elif comment and trimmed.endswith("*/"):
+             comment = False
+        elif not comment and trimmed:
+             return False
+
+    return True
+
+
+def find_file_module_qldoc_declaration(lines):
+    '''
+    Returns the index of last line of the implicit file module qldoc if one
+    exists. Returns None otherwise.
+    '''
+
+    qldoc = False
+    comment = False
+    for i, line in enumerate(lines):
+        trimmed = line.strip()
+
+        if trimmed.startswith("//"):
+            continue
+        elif (qldoc or trimmed.startswith("/**")) and trimmed.endswith("*/"):
+            # a qldoc just ended; determine if it belongs to the implicit file module
+            if is_file_module_qldoc(i, lines):
+                return i
+            else:
+                return None
+        elif trimmed.startswith("/**"):
+            qldoc = True
+        elif trimmed.startswith("/*"):
+            comment = True
+        elif comment and trimmed.endswith("*/"):
+            comment = False
+        elif (not qldoc and not comment) and trimmed:
+            return None
+
+    return None
+
+
+def only_comments(lines):
+    '''
+    Returns true if the lines contain only comments and empty lines.
+    '''
+    comment = False
+
+    for line in lines:
+        trimmed = line.strip()
+
+        if not trimmed or is_line_comment(trimmed):
+            continue
+        elif trimmed.startswith("/*"):
+            comment = True
+        elif comment and trimmed.endswith("*/"):
+            comment = False
+        elif comment:
+            continue
+        elif trimmed:
+            return False
+
+    return True
+
+
+def insert_toplevel_maybe_local_annotation(filename, lines):
+    '''
+    Find a suitable place to insert an overlay[local?] annotation at the top of the file.
+    Returns a pair consisting of description and the modified lines or None if no overlay
+    annotation is necessary (e.g., for files that only contain comments).
+    '''
+    if only_comments(lines):
+        return None
+
+    i = find_file_level_module_declaration(lines)
+    if not i == None:
+        out_lines = lines[:i]
+        out_lines.append("overlay[local?]\n")
+        out_lines.extend(lines[i:])
+        return (f"Annotating \"{filename}\" via existing file-level module statement", out_lines)
+
+    i = find_file_module_qldoc_declaration(lines)
+    if not i == None:
+        out_lines = lines[:i+1]
+        out_lines.append("overlay[local?]\n")
+        out_lines.append("module;\n")
+        out_lines.extend(lines[i+1:])
+        return (f"Annotating \"{filename}\" which has a file-level module qldoc", out_lines)
+
+    out_lines = ["overlay[local?]\n", "module;\n", "\n"] + lines
+    return (f"Annotating \"{filename}\" without file-level module qldoc", out_lines)
+
+
+def insert_overlay_caller_annotations(lines):
+    '''
+    Mark pragma[inline] predicates as overlay[caller?] if they are not declared private.
+    '''
+    out_lines = []
+    for i, line in enumerate(lines):
+        trimmed = line.strip()
+        if trimmed == "pragma[inline]":
+            if i + 1 < len(lines) and not "private" in lines[i+1]:
+                whitespace = line[0: line.find(trimmed)]
+                out_lines.append(f"{whitespace}overlay[caller?]\n")
+        out_lines.append(line)
+    return out_lines
+
+
+def annotate_as_appropriate(filename, lines):
+    '''
+    Insert new overlay[...] annotations according to heuristics in files without existing
+    overlay annotations.
+
+    Returns None if no annotations are needed. Otherwise, returns a pair consisting of a
+    string describing the action taken and the modified content as a list of lines.
+    '''
+    if has_overlay_annotations(lines):
+        return None
+
+    # These simple heuristics filter out those .qll files that we no _not_ want to annotate
+    # as overlay[local?].  It is not clear that these heuristics are exactly what we want,
+    # but they seem to work well enough for now (as determined by speed and accuracy numbers).
+    if (filename.endswith("Test.qll") or
+        ((filename.endswith("Query.qll") or filename.endswith("Config.qll")) and
+         any("implements DataFlow::ConfigSig" in line for line in lines))):
+        return None
+    elif not any(line for line in lines if line.strip()):
+        return None
+
+    lines = insert_overlay_caller_annotations(lines)
+    return insert_toplevel_maybe_local_annotation(filename, lines)
+
+
+def process_single_file(write, filename):
+    '''
+    Process a single file, annotating it as appropriate.
+    If write is set, the changes are written back to the file.
+    Returns True if the file requires changes.
+    '''
+    with open(filename) as f:
+        old = [line for line in f]
+
+    annotate_result = annotate_as_appropriate(filename, old)
+    if annotate_result is None:
+        return False
+
+    if not write:
+        return True
+
+    new = annotate_result[1]
+
+    diff = context_diff(old, new, fromfile=filename, tofile=filename)
+    diff = [line for line in diff]
+    if diff:
+        print(annotate_result[0])
+        for line in diff:
+            print(line.rstrip())
+        with open(filename, "w") as out_file:
+            for line in new:
+                out_file.write(line)
+
+    return True
+
+
+if len(sys.argv) > 1 and sys.argv[1] == "--check":
+  check = True
+  langs = sys.argv[2:]
+else:
+  check = False
+  langs = sys.argv[1:]
+
+dirs = []
+for lang in langs:
+    if lang in ["cpp", "go", "csharp", "java", "javascript", "python", "ruby", "rust", "swift"]:
+        dirs.append(f"{lang}/ql/lib")
+    else:
+        raise Exception(f"Unknown language \"{lang}\".")
+
+if dirs:
+    dirs.append("shared")
+
+missingAnnotations = []
+
+for roots in dirs:
+    for dirpath, dirnames, filenames in os.walk(roots):
+        for filename in filenames:
+            if filename.endswith(".qll") and not dirpath.endswith("tutorial"):
+                path = os.path.join(dirpath, filename)
+                res = process_single_file(not check, path)
+                if check and res:
+                    missingAnnotations.append(path)
+
+
+if len(missingAnnotations) > 0:
+    print("The following files have no overlay annotations:")
+    for path in missingAnnotations[:10]:
+      print("- " + path)
+    if len(missingAnnotations) > 10:
+      print("and " + str(len(missingAnnotations) - 10) + " additional files.")
+    print()
+    print("Please manually add overlay annotations or use the config/add-overlay-annotations.py script to automatically add sensible default overlay annotations.")
+    exit(1)

cpp/bulk_generation_targets.yml

@@ -0,0 +1,31 @@
+language: cpp
+strategy: dca
+destination: cpp/ql/lib/ext/generated
+targets:
+- name: zlib
+  with-sinks: false
+  with-sources: false
+- name: brotli
+  with-sinks: false
+  with-sources: false
+- name: libidn2
+  with-sinks: false
+  with-sources: false
+- name: libssh2
+  with-sinks: false
+  with-sources: false
+- name: sqlite
+  with-sinks: false
+  with-sources: false
+- name: openssl
+  with-sinks: false
+  with-sources: false
+- name: nghttp2
+  with-sinks: false
+  with-sources: false
+- name: libuv
+  with-sinks: false
+  with-sources: false
+- name: curl
+  with-sinks: false
+  with-sources: false

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/lambdas.ql

@@ -0,0 +1,7 @@
+class LambdaExpr extends @lambdaexpr {
+  string toString() { none() }
+}
+
+from LambdaExpr lambda, string default_capture, boolean has_explicit_return_type
+where lambdas(lambda, default_capture, has_explicit_return_type, _)
+select lambda, default_capture, has_explicit_return_type

cpp/downgrades/3c45f8b9e71ec723bf50c40581e1f18f4f25e290/upgrade.properties

@@ -0,0 +1,3 @@
+description: capture whether a lambda has an explicitly specified parameter list.
+compatibility: full
+lambdas.rel: run lambdas.qlo

cpp/downgrades/9baef67d1ffc1551429dbe1c1130815693e28218/upgrade.properties

@@ -0,0 +1,3 @@
+description: Add a predicate `getAnAttribute` to `Namespace`
+compatibility: full
+namespaceattributes.rel: delete

cpp/downgrades/a8c2176e9a5cf9be8d17053a4c8e7e56b5aced6d/stmts.ql

@@ -0,0 +1,13 @@
+class Stmt extends @stmt {
+  string toString() { none() }
+}
+
+class Location extends @location_stmt {
+  string toString() { none() }
+}
+
+from Stmt id, int kind, Location loc, int new_kind
+where
+  stmts(id, kind, loc) and
+  if kind = 40 then new_kind = 4 else new_kind = kind
+select id, new_kind, loc

cpp/downgrades/a8c2176e9a5cf9be8d17053a4c8e7e56b5aced6d/upgrade.properties

@@ -0,0 +1,3 @@
+description: Support `__leave` statement
+compatibility: full
+stmts.rel: run stmts.qlo

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/builtintypes.ql

@@ -0,0 +1,9 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType id, string name, int kind, int new_kind, int size, int sign, int alignment
+where
+  builtintypes(id, name, kind, size, sign, alignment) and
+  if kind = 62 then new_kind = 1 else new_kind = kind
+select id, name, new_kind, size, sign, alignment

cpp/downgrades/af887e83a815a9cefe774ffa80e2493a1365b9e2/upgrade.properties

@@ -0,0 +1,3 @@
+description: Support __mfp8 type
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo

cpp/downgrades/e38346051783182ea75822e4adf8d4c6a949bc37/builtintypes.ql

@@ -0,0 +1,9 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType id, string name, int kind, int new_kind, int size, int sign, int alignment
+where
+  builtintypes(id, name, kind, size, sign, alignment) and
+  if kind = 63 then /* @errortype */ new_kind = 1 else new_kind = kind
+select id, name, new_kind, size, sign, alignment

cpp/downgrades/e38346051783182ea75822e4adf8d4c6a949bc37/derivedtypes.ql

@@ -0,0 +1,9 @@
+class Type extends @type {
+  string toString() { none() }
+}
+
+from Type type, string name, int kind, int new_kind, Type type_id
+where
+  derivedtypes(type, name, kind, type_id) and
+  if kind = 11 then /* @gnu_vector */ new_kind = 5 else new_kind = kind
+select type, name, new_kind, type_id

cpp/downgrades/e38346051783182ea75822e4adf8d4c6a949bc37/upgrade.properties

@@ -0,0 +1,5 @@
+description: Arm scalable vector type support
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo
+derivedtypes.rel: run derivedtypes.qlo
+tupleelements.rel: delete

cpp/misc/bulk_generation_targets.json

@@ -1,9 +0,0 @@
-{
-  "strategy": "dca",
-  "language": "cpp",
-  "targets": [
-      { "name": "openssl", "with-sources": false, "with-sinks": false },
-      { "name": "sqlite", "with-sources": false, "with-sinks": false }
-  ],
-  "destination": "cpp/ql/lib/ext/generated"
-}

cpp/ql/integration-tests/query-suite/cpp-code-quality-extended.qls.expected

@@ -0,0 +1 @@
+

cpp/ql/integration-tests/query-suite/test.py

@@ -2,7 +2,7 @@ import runs_on
 import pytest
 from query_suites import *
 
-well_known_query_suites = ['cpp-code-quality.qls', 'cpp-security-and-quality.qls', 'cpp-security-extended.qls', 'cpp-code-scanning.qls']
+well_known_query_suites = ['cpp-code-quality.qls', 'cpp-code-quality-extended.qls', 'cpp-security-and-quality.qls', 'cpp-security-extended.qls', 'cpp-code-scanning.qls']
 
 @runs_on.posix
 @pytest.mark.parametrize("query_suite", well_known_query_suites)

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,20 @@
+## 5.2.0
+
+### Deprecated APIs
+
+* The `ThrowingFunction` class (`semmle.code.cpp.models.interfaces.Throwing`) has been deprecated. Please use the `AlwaysSehThrowingFunction` class instead.
+
+### New Features
+
+* Added a predicate `getAnAttribute` to `Namespace` to retrieve a namespace attribute.
+* The Microsoft-specific `__leave` statement is now supported.
+* A new class `LeaveStmt` extending `JumpStmt` was added to represent `__leave` statements.
+* Added a predicate `hasParameterList` to `LambdaExpression` to capture whether a lambda has an explicitly specified parameter list.
+
+### Bug Fixes
+
+* `resolveTypedefs` now properly resolves typedefs for `ArrayType`s.
+
 ## 5.1.0
 
 ### New Features

cpp/ql/lib/change-notes/released/5.2.0.md

@@ -0,0 +1,16 @@
+## 5.2.0
+
+### Deprecated APIs
+
+* The `ThrowingFunction` class (`semmle.code.cpp.models.interfaces.Throwing`) has been deprecated. Please use the `AlwaysSehThrowingFunction` class instead.
+
+### New Features
+
+* Added a predicate `getAnAttribute` to `Namespace` to retrieve a namespace attribute.
+* The Microsoft-specific `__leave` statement is now supported.
+* A new class `LeaveStmt` extending `JumpStmt` was added to represent `__leave` statements.
+* Added a predicate `hasParameterList` to `LambdaExpression` to capture whether a lambda has an explicitly specified parameter list.
+
+### Bug Fixes
+
+* `resolveTypedefs` now properly resolves typedefs for `ArrayType`s.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.1.0
+lastReleaseVersion: 5.2.0

cpp/ql/lib/experimental/quantum/Language.qll

@@ -13,7 +13,9 @@ module CryptoInput implements InputSig<Language::Location> {
   LocatableElement dfn_to_element(DataFlow::Node node) {
     result = node.asExpr() or
     result = node.asParameter() or
-    result = node.asVariable()
+    result = node.asVariable() or
+    result = node.asDefiningArgument()
+    // TODO: do we need asIndirectExpr()?
   }
 
   string locationToFileBaseNameAndLineNumberString(Location location) {
@@ -90,7 +92,7 @@ module GenericDataSourceFlowConfig implements DataFlow::ConfigSig {
 module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig>;
 
 private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
-  ConstantDataSource() { this instanceof OpenSSLGenericSourceCandidateLiteral }
+  ConstantDataSource() { this instanceof OpenSslGenericSourceCandidateLiteral }
 
   override DataFlow::Node getOutputNode() { result.asExpr() = this }
 

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

@@ -12,13 +12,15 @@ private import PaddingAlgorithmInstance
  * overlap with the known algorithm constants.
  * Padding consumers (specific padding consumers) are excluded from the set of sinks.
  */
-module KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
+module KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source.asExpr() instanceof KnownOpenSSLAlgorithmConstant
+    source.asExpr() instanceof KnownOpenSslAlgorithmExpr and
+    // No need to flow direct operations to AVCs
+    not source.asExpr() instanceof OpenSslDirectAlgorithmOperationCall
   }
 
   predicate isSink(DataFlow::Node sink) {
-    exists(OpenSSLAlgorithmValueConsumer c |
+    exists(OpenSslAlgorithmValueConsumer c |
       c.getInputNode() = sink and
       // exclude padding algorithm consumers, since
       // these consumers take in different constant values
@@ -43,11 +45,11 @@ module KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::
   }
 }
 
-module KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow =
-  DataFlow::Global<KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig>;
+module KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow =
+  DataFlow::Global<KnownOpenSslAlgorithmToAlgorithmValueConsumerConfig>;
 
 module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSSLPaddingLiteral }
+  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSslPaddingLiteral }
 
   predicate isSink(DataFlow::Node sink) {
     exists(PaddingAlgorithmValueConsumer c | c.getInputNode() = sink)
@@ -61,8 +63,8 @@ module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataF
 module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerFlow =
   DataFlow::Global<RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig>;
 
-class OpenSSLAlgorithmAdditionalFlowStep extends AdditionalFlowInputStep {
-  OpenSSLAlgorithmAdditionalFlowStep() { exists(AlgorithmPassthroughCall c | c.getInNode() = this) }
+class OpenSslAlgorithmAdditionalFlowStep extends AdditionalFlowInputStep {
+  OpenSslAlgorithmAdditionalFlowStep() { exists(AlgorithmPassthroughCall c | c.getInNode() = this) }
 
   override DataFlow::Node getOutput() {
     exists(AlgorithmPassthroughCall c | c.getInNode() = this and c.getOutNode() = result)

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/BlockAlgorithmInstance.qll

@@ -7,14 +7,14 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
 private import AlgToAVCFlow
 
 /**
- * Given a `KnownOpenSSLBlockModeAlgorithmConstant`, converts this to a block family type.
+ * Given a `KnownOpenSslBlockModeAlgorithmExpr`, converts this to a block family type.
  * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
  */
-predicate knownOpenSSLConstantToBlockModeFamilyType(
-  KnownOpenSSLBlockModeAlgorithmConstant e, Crypto::TBlockCipherModeOfOperationType type
+predicate knownOpenSslConstantToBlockModeFamilyType(
+  KnownOpenSslBlockModeAlgorithmExpr e, Crypto::TBlockCipherModeOfOperationType type
 ) {
   exists(string name |
-    name = e.getNormalizedName() and
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
       name.matches("CBC") and type instanceof Crypto::CBC
       or
@@ -39,34 +39,35 @@ predicate knownOpenSSLConstantToBlockModeFamilyType(
   )
 }
 
-class KnownOpenSSLBlockModeConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
-  Crypto::ModeOfOperationAlgorithmInstance instanceof KnownOpenSSLBlockModeAlgorithmConstant
+class KnownOpenSslBlockModeConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::ModeOfOperationAlgorithmInstance instanceof KnownOpenSslBlockModeAlgorithmExpr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
 
-  KnownOpenSSLBlockModeConstantAlgorithmInstance() {
+  KnownOpenSslBlockModeConstantAlgorithmInstance() {
     // Two possibilities:
     // 1) The source is a literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // Possibility 1:
-    this instanceof Literal and
+    this instanceof OpenSslAlgorithmLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
-      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
   }
 
   override Crypto::TBlockCipherModeOfOperationType getModeType() {
-    knownOpenSSLConstantToBlockModeFamilyType(this, result)
+    knownOpenSslConstantToBlockModeFamilyType(this, result)
     or
-    not knownOpenSSLConstantToBlockModeFamilyType(this, _) and result = Crypto::OtherMode()
+    not knownOpenSslConstantToBlockModeFamilyType(this, _) and result = Crypto::OtherMode()
   }
 
   // NOTE: I'm not going to attempt to parse out the mode specific part, so returning
@@ -77,5 +78,5 @@ class KnownOpenSSLBlockModeConstantAlgorithmInstance extends OpenSSLAlgorithmIns
     result = this.(Call).getTarget().getName()
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/CipherAlgorithmInstance.qll

@@ -10,14 +10,14 @@ private import AlgToAVCFlow
 private import BlockAlgorithmInstance
 
 /**
- * Given a `KnownOpenSSLCipherAlgorithmConstant`, converts this to a cipher family type.
+ * Given a `KnownOpenSslCipherAlgorithmExpr`, converts this to a cipher family type.
  * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
  */
-predicate knownOpenSSLConstantToCipherFamilyType(
-  KnownOpenSSLCipherAlgorithmConstant e, Crypto::KeyOpAlg::TAlgorithm type
+predicate knownOpenSslConstantToCipherFamilyType(
+  KnownOpenSslCipherAlgorithmExpr e, Crypto::KeyOpAlg::TAlgorithm type
 ) {
   exists(string name |
-    name = e.getNormalizedName() and
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
       name.matches("AES%") and type = KeyOpAlg::TSymmetricCipher(KeyOpAlg::AES())
       or
@@ -64,28 +64,29 @@ predicate knownOpenSSLConstantToCipherFamilyType(
   )
 }
 
-class KnownOpenSSLCipherConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
-  Crypto::KeyOperationAlgorithmInstance instanceof KnownOpenSSLCipherAlgorithmConstant
+class KnownOpenSslCipherConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::KeyOperationAlgorithmInstance instanceof KnownOpenSslCipherAlgorithmExpr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
 
-  KnownOpenSSLCipherConstantAlgorithmInstance() {
+  KnownOpenSslCipherConstantAlgorithmInstance() {
     // Two possibilities:
     // 1) The source is a literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // Possibility 1:
-    this instanceof Literal and
+    this instanceof OpenSslAlgorithmLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
-      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
   }
 
   override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() {
@@ -109,17 +110,17 @@ class KnownOpenSSLCipherConstantAlgorithmInstance extends OpenSSLAlgorithmInstan
   }
 
   override int getKeySizeFixed() {
-    this.(KnownOpenSSLCipherAlgorithmConstant).getExplicitKeySize() = result
+    this.(KnownOpenSslCipherAlgorithmExpr).getExplicitKeySize() = result
   }
 
   override Crypto::KeyOpAlg::Algorithm getAlgorithmType() {
-    knownOpenSSLConstantToCipherFamilyType(this, result)
+    knownOpenSslConstantToCipherFamilyType(this, result)
     or
-    not knownOpenSSLConstantToCipherFamilyType(this, _) and
+    not knownOpenSslConstantToCipherFamilyType(this, _) and
     result = Crypto::KeyOpAlg::TUnknownKeyOperationAlgorithmType()
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
   override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
     // TODO: trace to any key size initializer, symmetric and asymmetric

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/EllipticCurveAlgorithmInstance.qll

@@ -6,31 +6,32 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
 private import AlgToAVCFlow
 
-class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
-  Crypto::EllipticCurveInstance instanceof KnownOpenSSLEllipticCurveAlgorithmConstant
+class KnownOpenSslEllipticCurveConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::EllipticCurveInstance instanceof KnownOpenSslEllipticCurveAlgorithmExpr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
 
-  KnownOpenSSLEllipticCurveConstantAlgorithmInstance() {
+  KnownOpenSslEllipticCurveConstantAlgorithmInstance() {
     // Two possibilities:
     // 1) The source is a literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // Possibility 1:
-    this instanceof Literal and
+    this instanceof OpenSslAlgorithmLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
       sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
   override string getRawEllipticCurveName() {
     result = this.(Literal).getValue().toString()
@@ -43,11 +44,11 @@ class KnownOpenSSLEllipticCurveConstantAlgorithmInstance extends OpenSSLAlgorith
   }
 
   override string getParsedEllipticCurveName() {
-    result = this.(KnownOpenSSLEllipticCurveAlgorithmConstant).getNormalizedName()
+    result = this.(KnownOpenSslAlgorithmExpr).getNormalizedName()
   }
 
   override int getKeySize() {
-    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSSLEllipticCurveAlgorithmConstant)
+    Crypto::ellipticCurveNameToKeySizeAndFamilyMapping(this.(KnownOpenSslAlgorithmExpr)
           .getNormalizedName(), result, _)
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/HashAlgorithmInstance.qll

@@ -5,11 +5,11 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
 private import AlgToAVCFlow
 
-predicate knownOpenSSLConstantToHashFamilyType(
-  KnownOpenSSLHashAlgorithmConstant e, Crypto::THashType type
+predicate knownOpenSslConstantToHashFamilyType(
+  KnownOpenSslHashAlgorithmExpr e, Crypto::THashType type
 ) {
   exists(string name |
-    name = e.getNormalizedName() and
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
       name.matches("BLAKE2B") and type instanceof Crypto::BLAKE2B
       or
@@ -29,7 +29,7 @@ predicate knownOpenSSLConstantToHashFamilyType(
       or
       name.matches(["SHA", "SHA1"]) and type instanceof Crypto::SHA1
       or
-      name.matches("SHA+%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
+      name.matches("SHA_%") and not name.matches(["SHA1", "SHA3-"]) and type instanceof Crypto::SHA2
       or
       name.matches("SHA3-%") and type instanceof Crypto::SHA3
       or
@@ -44,36 +44,37 @@ predicate knownOpenSSLConstantToHashFamilyType(
   )
 }
 
-class KnownOpenSSLHashConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
-  Crypto::HashAlgorithmInstance instanceof KnownOpenSSLHashAlgorithmConstant
+class KnownOpenSslHashConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::HashAlgorithmInstance instanceof KnownOpenSslHashAlgorithmExpr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
 
-  KnownOpenSSLHashConstantAlgorithmInstance() {
+  KnownOpenSslHashConstantAlgorithmInstance() {
     // Two possibilities:
     // 1) The source is a literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // Possibility 1:
-    this instanceof Literal and
+    this instanceof OpenSslAlgorithmLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
-      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
   override Crypto::THashType getHashFamily() {
-    knownOpenSSLConstantToHashFamilyType(this, result)
+    knownOpenSslConstantToHashFamilyType(this, result)
     or
-    not knownOpenSSLConstantToHashFamilyType(this, _) and result = Crypto::OtherHashType()
+    not knownOpenSslConstantToHashFamilyType(this, _) and result = Crypto::OtherHashType()
   }
 
   override string getRawHashAlgorithmName() {
@@ -83,6 +84,6 @@ class KnownOpenSSLHashConstantAlgorithmInstance extends OpenSSLAlgorithmInstance
   }
 
   override int getFixedDigestLength() {
-    this.(KnownOpenSSLHashAlgorithmConstant).getExplicitDigestLength() = result
+    this.(KnownOpenSslHashAlgorithmExpr).getExplicitDigestLength() = result
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KeyAgreementAlgorithmInstance.qll

@@ -5,11 +5,11 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
 private import AlgToAVCFlow
 
-predicate knownOpenSSLConstantToKeyAgreementFamilyType(
-  KnownOpenSSLKeyAgreementAlgorithmConstant e, Crypto::TKeyAgreementType type
+predicate knownOpenSslConstantToKeyAgreementFamilyType(
+  KnownOpenSslKeyAgreementAlgorithmExpr e, Crypto::TKeyAgreementType type
 ) {
   exists(string name |
-    name = e.getNormalizedName() and
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
       name = "ECDH" and type = Crypto::ECDH()
       or
@@ -22,36 +22,37 @@ predicate knownOpenSSLConstantToKeyAgreementFamilyType(
   )
 }
 
-class KnownOpenSSLHashConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
-  Crypto::KeyAgreementAlgorithmInstance instanceof KnownOpenSSLKeyAgreementAlgorithmConstant
+class KnownOpenSslKeyAgreementConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::KeyAgreementAlgorithmInstance instanceof KnownOpenSslKeyAgreementAlgorithmExpr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
 
-  KnownOpenSSLHashConstantAlgorithmInstance() {
+  KnownOpenSslKeyAgreementConstantAlgorithmInstance() {
     // Two possibilities:
     // 1) The source is a literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // Possibility 1:
-    this instanceof Literal and
+    this instanceof OpenSslAlgorithmLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
       sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and getterCall = this
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
   override Crypto::TKeyAgreementType getKeyAgreementType() {
-    knownOpenSSLConstantToKeyAgreementFamilyType(this, result)
+    knownOpenSslConstantToKeyAgreementFamilyType(this, result)
     or
-    not knownOpenSSLConstantToKeyAgreementFamilyType(this, _) and
+    not knownOpenSslConstantToKeyAgreementFamilyType(this, _) and
     result = Crypto::OtherKeyAgreementType()
   }
 

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/KnownAlgorithmConstants.qll

@@ -1,79 +1,44 @@
 import cpp
 import experimental.quantum.OpenSSL.GenericSourceCandidateLiteral
 
-predicate resolveAlgorithmFromExpr(Expr e, string normalizedName, string algType) {
-  resolveAlgorithmFromCall(e, normalizedName, algType)
-  or
-  resolveAlgorithmFromLiteral(e, normalizedName, algType)
-}
-
-class KnownOpenSSLAlgorithmConstant extends Expr {
-  KnownOpenSSLAlgorithmConstant() { resolveAlgorithmFromExpr(this, _, _) }
-
-  string getNormalizedName() { resolveAlgorithmFromExpr(this, result, _) }
-
-  string getAlgType() { resolveAlgorithmFromExpr(this, _, result) }
-}
-
-class KnownOpenSSLCipherAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  string algType;
-
-  KnownOpenSSLCipherAlgorithmConstant() {
-    resolveAlgorithmFromExpr(this, _, algType) and
-    algType.matches("%ENCRYPTION")
-  }
-
-  int getExplicitKeySize() {
-    exists(string name |
-      name = this.getNormalizedName() and
-      resolveAlgorithmFromExpr(this, name, algType) and
-      result = name.regexpCapture(".*-(\\d*)", 1).toInt()
-    )
-  }
-}
-
-class KnownOpenSSLPaddingAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLPaddingAlgorithmConstant() {
-    exists(string algType |
-      resolveAlgorithmFromExpr(this, _, algType) and
-      algType.matches("%PADDING")
-    )
-  }
-}
-
-class KnownOpenSSLBlockModeAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLBlockModeAlgorithmConstant() { resolveAlgorithmFromExpr(this, _, "BLOCK_MODE") }
-}
-
-class KnownOpenSSLHashAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLHashAlgorithmConstant() { resolveAlgorithmFromExpr(this, _, "HASH") }
-
-  int getExplicitDigestLength() {
-    exists(string name |
-      name = this.getNormalizedName() and
-      resolveAlgorithmFromExpr(this, name, "HASH") and
-      result = name.regexpCapture(".*-(\\d*)$", 1).toInt()
-    )
-  }
-}
-
-class KnownOpenSSLEllipticCurveAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLEllipticCurveAlgorithmConstant() {
-    resolveAlgorithmFromExpr(this, _, "ELLIPTIC_CURVE")
-  }
-}
-
-class KnownOpenSSLSignatureAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLSignatureAlgorithmConstant() { resolveAlgorithmFromExpr(this, _, "SIGNATURE") }
-}
-
-class KnownOpenSSLKeyAgreementAlgorithmConstant extends KnownOpenSSLAlgorithmConstant {
-  KnownOpenSSLKeyAgreementAlgorithmConstant() { resolveAlgorithmFromExpr(this, _, "KEY_AGREEMENT") }
+predicate resolveAlgorithmFromExpr(
+  KnownOpenSslAlgorithmExpr e, string normalizedName, string algType
+) {
+  normalizedName = e.getNormalizedName() and
+  algType = e.getAlgType()
 }
 
 /**
- * Resolves a call to a 'direct algorithm getter', e.g., EVP_MD5()
- * This approach to fetching algorithms was used in OpenSSL 1.0.2.
+ * An expression that resolves to a known OpenSsl algorithm constant.
+ * This can be a literal, a call to a known OpenSsl algorithm constant getter,
+ * or a call to an operation that directly operates on a known algorithm.
+ */
+abstract class KnownOpenSslAlgorithmExpr extends Expr {
+  abstract string getNormalizedName();
+
+  abstract string getAlgType();
+}
+
+class OpenSslAlgorithmLiteral extends KnownOpenSslAlgorithmExpr instanceof Literal {
+  string normalizedName;
+  string algType;
+
+  OpenSslAlgorithmLiteral() { resolveAlgorithmFromLiteral(this, normalizedName, algType) }
+
+  override string getNormalizedName() { result = normalizedName }
+
+  override string getAlgType() { result = algType }
+}
+
+/**
+ * A call to either an OpenSsl algorithm constant 'getter', e.g., EVP_MD5()
+ * or call to an operation that directly operates on a known algorithm, e.g., AES_encrypt
+ */
+abstract class OpenSslAlgorithmCall extends KnownOpenSslAlgorithmExpr instanceof Call { }
+
+/**
+ * A call to a 'direct algorithm getter', e.g., EVP_MD5()
+ * This approach to fetching algorithms was used in OpenSsl 1.0.2.
  * The strategy for resolving these calls is to parse the target name
  * and resolve the name as though it were a known literal.
  * There are a few exceptions where the name doesn't directly match the
@@ -81,15 +46,134 @@ class KnownOpenSSLKeyAgreementAlgorithmConstant extends KnownOpenSSLAlgorithmCon
  * set of aliases. E.g., EVP_dss() and EVP_dss1() needed such mappings
  *   alias = "dss" and target = "dsa"
  *   or
- *  alias = "dss1" and target = "dsaWithSHA1"
+ *   alias = "dss1" and target = "dsaWithSHA1"
  */
-predicate resolveAlgorithmFromCall(Call c, string normalized, string algType) {
-  exists(string name, string parsedTargetName |
-    parsedTargetName =
-      c.getTarget().getName().replaceAll("EVP_", "").toLowerCase().replaceAll("_", "-") and
-    name = resolveAlgorithmAlias(parsedTargetName) and
-    knownOpenSSLAlgorithmLiteral(name, _, normalized, algType)
-  )
+class OpenSslDirectAlgorithmFetchCall extends OpenSslAlgorithmCall {
+  string normalizedName;
+  string algType;
+
+  OpenSslDirectAlgorithmFetchCall() {
+    //ASSUMPTION: these cases will have operands for the call
+    not exists(this.(Call).getAnArgument()) and
+    exists(string name, string parsedTargetName |
+      parsedTargetName =
+        this.(Call).getTarget().getName().replaceAll("EVP_", "").toLowerCase().replaceAll("_", "-") and
+      name = resolveAlgorithmAlias(parsedTargetName) and
+      knownOpenSslAlgorithmLiteral(name, _, normalizedName, algType)
+    )
+  }
+
+  override string getNormalizedName() { result = normalizedName }
+
+  override string getAlgType() { result = algType }
+}
+
+/**
+ * A call to an OpenSsl operation that directly operates on a known algorithm.
+ * An algorithm construct is not generated for these calls, rather, the operation
+ * is directly performed, and the algorithm is inferred by the operation itself.
+ */
+class OpenSslDirectAlgorithmOperationCall extends OpenSslAlgorithmCall {
+  string normalizedName;
+  string algType;
+
+  OpenSslDirectAlgorithmOperationCall() {
+    //TODO: this set will have to be exhaustive, and for each operation
+    //further modeling will be necessary for each case to map the APIs operands
+    //ASSUMPTION: these cases must have operands for the call
+    exists(this.(Call).getAnArgument()) and
+    //TODO: Each case would be enumerated here. Will likely need an exhaustive mapping much like
+    // for known constants.
+    knownOpenSslAlgorithmOperationCall(this, normalizedName, algType)
+  }
+
+  override string getNormalizedName() { result = normalizedName }
+
+  override string getAlgType() { result = algType }
+}
+
+class KnownOpenSslCipherAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  string algType;
+
+  KnownOpenSslCipherAlgorithmExpr() {
+    algType = this.(KnownOpenSslAlgorithmExpr).getAlgType() and
+    algType.matches("%ENCRYPTION")
+  }
+
+  int getExplicitKeySize() {
+    exists(string name |
+      name = this.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
+      resolveAlgorithmFromExpr(this, name, algType) and
+      result = name.regexpCapture(".*-(\\d*)", 1).toInt()
+    )
+  }
+}
+
+class KnownOpenSslPaddingAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslPaddingAlgorithmExpr() {
+    exists(string algType |
+      resolveAlgorithmFromExpr(this, _, algType) and
+      algType.matches("%PADDING")
+    )
+  }
+}
+
+class KnownOpenSslBlockModeAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslBlockModeAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "BLOCK_MODE") }
+}
+
+class KnownOpenSslHashAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslHashAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "HASH") }
+
+  int getExplicitDigestLength() {
+    exists(string name |
+      name = this.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
+      resolveAlgorithmFromExpr(this, name, "HASH") and
+      result = name.regexpCapture(".*-(\\d*)$", 1).toInt()
+    )
+  }
+}
+
+class KnownOpenSslMacAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslMacAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "MAC") }
+}
+
+class KnownOpenSslHMacAlgorithmExpr extends Expr instanceof KnownOpenSslMacAlgorithmExpr {
+  KnownOpenSslHMacAlgorithmExpr() { resolveAlgorithmFromExpr(this, "HMAC", "MAC") }
+
+  /**
+   * Gets an explicit cipher algorithm for this MAC algorithm.
+   * This occurs when the MAC specifies the algorithm at the same time "HMAC-SHA-256"
+   */
+  KnownOpenSslHashAlgorithmExpr getExplicitHashAlgorithm() { result = this }
+}
+
+class KnownOpenSslCMacAlgorithmExpr extends Expr instanceof KnownOpenSslMacAlgorithmExpr {
+  KnownOpenSslCMacAlgorithmExpr() { resolveAlgorithmFromExpr(this, "CMAC", "MAC") }
+
+  /**
+   * Gets an explicit cipher algorithm for this MAC algorithm.
+   * This occurs when the MAC specifies the algorithm at the same time "HMAC-SHA-256"
+   */
+  KnownOpenSslCipherAlgorithmExpr getExplicitCipherAlgorithm() { result = this }
+}
+
+class KnownOpenSslEllipticCurveAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslEllipticCurveAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "ELLIPTIC_CURVE") }
+}
+
+class KnownOpenSslSignatureAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslSignatureAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "SIGNATURE") }
+}
+
+class KnownOpenSslKeyAgreementAlgorithmExpr extends Expr instanceof KnownOpenSslAlgorithmExpr {
+  KnownOpenSslKeyAgreementAlgorithmExpr() { resolveAlgorithmFromExpr(this, _, "KEY_AGREEMENT") }
+}
+
+predicate knownOpenSslAlgorithmOperationCall(Call c, string normalized, string algType) {
+  c.getTarget().getName() in ["EVP_RSA_gen", "RSA_generate_key_ex", "RSA_generate_key", "RSA_new"] and
+  normalized = "RSA" and
+  algType = "ASYMMETRIC_ENCRYPTION"
 }
 
 /**
@@ -98,13 +182,13 @@ predicate resolveAlgorithmFromCall(Call c, string normalized, string algType) {
  * If this predicate does not hold, then `e` can be interpreted as being of `UNKNOWN` type.
  */
 predicate resolveAlgorithmFromLiteral(
-  OpenSSLGenericSourceCandidateLiteral e, string normalized, string algType
+  OpenSslGenericSourceCandidateLiteral e, string normalized, string algType
 ) {
-  knownOpenSSLAlgorithmLiteral(_, e.getValue().toInt(), normalized, algType)
+  knownOpenSslAlgorithmLiteral(_, e.getValue().toInt(), normalized, algType)
   or
   exists(string name |
     name = resolveAlgorithmAlias(e.getValue()) and
-    knownOpenSSLAlgorithmLiteral(name, _, normalized, algType)
+    knownOpenSslAlgorithmLiteral(name, _, normalized, algType)
   )
 }
 
@@ -115,7 +199,7 @@ string resolveAlgorithmAlias(string name) {
     result = getAlgorithmAlias(lower)
     or
     // or the name is itself a known algorithm
-    knownOpenSSLAlgorithmLiteral(lower, _, _, _) and result = lower
+    knownOpenSslAlgorithmLiteral(lower, _, _, _) and result = lower
   )
 }
 
@@ -138,9 +222,9 @@ predicate customAliases(string target, string alias) {
 }
 
 /**
- * A hard-coded mapping of known algorithm aliases in OpenSSL.
+ * A hard-coded mapping of known algorithm aliases in OpenSsl.
  * This was derived by applying the same kind of logic foun din `customAliases` to the
- * OpenSSL code base directly.
+ * OpenSsl code base directly.
  *
  * The `target` and `alias` are converted to lowercase to be of a standard form.
  */
@@ -247,7 +331,7 @@ predicate defaultAliases(string target, string alias) {
  * `normalized` is the normalized name of the algorithm (e.g., "AES128" for "aes-128-cbc")
  * `algType` is the type of algorithm (e.g., "SYMMETRIC_ENCRYPTION")
  */
-predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized, string algType) {
+predicate knownOpenSslAlgorithmLiteral(string name, int nid, string normalized, string algType) {
   name = "dhKeyAgreement" and nid = 28 and normalized = "DH" and algType = "KEY_AGREEMENT"
   or
   name = "x9.42 dh" and nid = 29 and normalized = "DH" and algType = "KEY_AGREEMENT"
@@ -886,6 +970,8 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "id-alg-dh-sig-hmac-sha1" and nid = 325 and normalized = "DH" and algType = "KEY_AGREEMENT"
   or
+  name = "id-alg-dh-sig-hmac-sha1" and nid = 325 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-128-ofb" and nid = 420 and normalized = "AES-128" and algType = "SYMMETRIC_ENCRYPTION"
   or
   name = "aes-128-ofb" and nid = 420 and normalized = "OFB" and algType = "BLOCK_MODE"
@@ -1064,8 +1150,12 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "hmac-md5" and nid = 780 and normalized = "MD5" and algType = "HASH"
   or
+  name = "hmac-md5" and nid = 780 and normalized = "HMAC" and algType = "HASH"
+  or
   name = "hmac-sha1" and nid = 781 and normalized = "SHA1" and algType = "HASH"
   or
+  name = "hmac-sha1" and nid = 781 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "md_gost94" and nid = 809 and normalized = "GOST94" and algType = "HASH"
   or
   name = "gost94" and nid = 812 and normalized = "GOST94" and algType = "HASH"
@@ -1140,10 +1230,14 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "rc4-hmac-md5" and nid = 915 and normalized = "MD5" and algType = "HASH"
   or
+  name = "rc4-hmac-md5" and nid = 915 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "rc4-hmac-md5" and nid = 915 and normalized = "RC4" and algType = "SYMMETRIC_ENCRYPTION"
   or
   name = "aes-128-cbc-hmac-sha1" and nid = 916 and normalized = "SHA1" and algType = "HASH"
   or
+  name = "aes-128-cbc-hmac-sha1" and nid = 916 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-128-cbc-hmac-sha1" and
   nid = 916 and
   normalized = "AES-128" and
@@ -1153,6 +1247,8 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "aes-192-cbc-hmac-sha1" and nid = 917 and normalized = "SHA1" and algType = "HASH"
   or
+  name = "aes-192-cbc-hmac-sha1" and nid = 917 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-192-cbc-hmac-sha1" and
   nid = 917 and
   normalized = "AES-192" and
@@ -1167,6 +1263,8 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "aes-256-cbc-hmac-sha1" and nid = 918 and normalized = "CBC" and algType = "BLOCK_MODE"
   or
+  name = "aes-256-cbc-hmac-sha1" and nid = 918 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-128-cbc-hmac-sha256" and nid = 948 and normalized = "SHA-256" and algType = "HASH"
   or
   name = "aes-128-cbc-hmac-sha256" and
@@ -1178,6 +1276,8 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "aes-192-cbc-hmac-sha256" and nid = 949 and normalized = "SHA-256" and algType = "HASH"
   or
+  name = "aes-192-cbc-hmac-sha256" and nid = 949 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-192-cbc-hmac-sha256" and
   nid = 949 and
   normalized = "AES-192" and
@@ -1187,6 +1287,8 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "aes-256-cbc-hmac-sha256" and nid = 950 and normalized = "SHA-256" and algType = "HASH"
   or
+  name = "aes-256-cbc-hmac-sha256" and nid = 950 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "aes-256-cbc-hmac-sha256" and
   nid = 950 and
   normalized = "AES-256" and
@@ -1226,6 +1328,11 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   normalized = "CAMELLIA-128" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  name = "camellia-128-cmac" and
+  nid = 964 and
+  normalized = "CMAC" and
+  algType = "MAC"
+  or
   name = "camellia-192-gcm" and
   nid = 965 and
   normalized = "CAMELLIA-192" and
@@ -1278,6 +1385,11 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   normalized = "CAMELLIA-256" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  name = "camellia-256-cmac" and
+  nid = 972 and
+  normalized = "CMAC" and
+  algType = "MAC"
+  or
   name = "id-scrypt" and nid = 973 and normalized = "SCRYPT" and algType = "KEY_DERIVATION"
   or
   name = "gost89-cnt-12" and
@@ -1291,11 +1403,13 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "md_gost12_512" and nid = 983 and normalized = "GOST" and algType = "HASH"
   or
+  // TODO: re-evaluate: this is a signing algorithm using hashing and curves
   name = "id-tc26-signwithdigest-gost3410-2012-256" and
   nid = 985 and
   normalized = "GOST34102012" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  // TODO: re-evaluate: this is a signing algorithm using hashing and curves
   name = "id-tc26-signwithdigest-gost3410-2012-512" and
   nid = 986 and
   normalized = "GOST34102012" and
@@ -1304,22 +1418,42 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   name = "id-tc26-hmac-gost-3411-2012-256" and
   nid = 988 and
   normalized = "GOST34112012" and
-  algType = "SYMMETRIC_ENCRYPTION"
+  algType = "HASH"
+  or
+  name = "id-tc26-hmac-gost-3411-2012-256" and
+  nid = 988 and
+  normalized = "HMAC" and
+  algType = "MAC"
   or
   name = "id-tc26-hmac-gost-3411-2012-512" and
   nid = 989 and
   normalized = "GOST34112012" and
-  algType = "SYMMETRIC_ENCRYPTION"
+  algType = "HASH"
+  or
+  name = "id-tc26-hmac-gost-3411-2012-512" and
+  nid = 989 and
+  normalized = "HMAC" and
+  algType = "MAC"
   or
   name = "id-tc26-agreement-gost-3410-2012-256" and
   nid = 992 and
   normalized = "GOST34102012" and
-  algType = "SYMMETRIC_ENCRYPTION"
+  algType = "ELLIPTIC_CURVE"
+  or
+  name = "id-tc26-agreement-gost-3410-2012-256" and
+  nid = 992 and
+  normalized = "GOST34102012" and
+  algType = "KEY_AGREEMENT"
   or
   name = "id-tc26-agreement-gost-3410-2012-512" and
   nid = 993 and
   normalized = "GOST34102012" and
-  algType = "SYMMETRIC_ENCRYPTION"
+  algType = "ELLIPTIC_CURVE"
+  or
+  name = "id-tc26-agreement-gost-3410-2012-512" and
+  nid = 993 and
+  normalized = "GOST34102012" and
+  algType = "KEY_AGREEMENT"
   or
   name = "id-tc26-gost-3410-2012-512-constants" and
   nid = 996 and
@@ -1407,12 +1541,20 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "hmac-sha3-224" and nid = 1102 and normalized = "SHA3-224" and algType = "HASH"
   or
+  name = "hmac-sha3-224" and nid = 1102 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmac-sha3-256" and nid = 1103 and normalized = "SHA3-256" and algType = "HASH"
   or
+  name = "hmac-sha3-256" and nid = 1103 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmac-sha3-384" and nid = 1104 and normalized = "SHA3-384" and algType = "HASH"
   or
+  name = "hmac-sha3-384" and nid = 1104 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmac-sha3-512" and nid = 1105 and normalized = "SHA3-512" and algType = "HASH"
   or
+  name = "hmac-sha3-512" and nid = 1105 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-dsa-with-sha384" and nid = 1106 and normalized = "DSA" and algType = "SIGNATURE"
   or
   name = "id-dsa-with-sha384" and nid = 1106 and normalized = "SHA-384" and algType = "HASH"
@@ -2180,34 +2322,67 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   normalized = "GOST" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  name = "hmac gost 34.11-2012 256 bit" and
+  nid = 988 and
+  normalized = "HMAC" and
+  algType = "MAC"
+  or
   name = "hmac gost 34.11-2012 512 bit" and
   nid = 989 and
   normalized = "GOST" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  name = "hmac gost 34.11-2012 512 bit" and
+  nid = 989 and
+  normalized = "HMAC" and
+  algType = "MAC"
+  or
   name = "hmac gost 34.11-94" and
   nid = 810 and
   normalized = "GOST" and
   algType = "SYMMETRIC_ENCRYPTION"
   or
+  name = "hmac gost 34.11-94" and
+  nid = 810 and
+  normalized = "HMAC" and
+  algType = "MAC"
+  or
   name = "hmacwithmd5" and nid = 797 and normalized = "MD5" and algType = "HASH"
   or
+  name = "hmacwithmd5" and nid = 797 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha1" and nid = 163 and normalized = "SHA1" and algType = "HASH"
   or
+  name = "hmacwithsha1" and nid = 163 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha224" and nid = 798 and normalized = "SHA-224" and algType = "HASH"
   or
+  name = "hmacwithsha224" and nid = 798 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha256" and nid = 799 and normalized = "SHA-256" and algType = "HASH"
   or
+  name = "hmacwithsha256" and nid = 799 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha384" and nid = 800 and normalized = "SHA-384" and algType = "HASH"
   or
+  name = "hmacwithsha384" and nid = 800 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha512" and nid = 801 and normalized = "SHA-512" and algType = "HASH"
   or
+  name = "hmacwithsha512" and nid = 801 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha512-224" and nid = 1193 and normalized = "SHA-512-224" and algType = "HASH"
   or
+  name = "hmacwithsha512-224" and nid = 1193 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsha512-256" and nid = 1194 and normalized = "SHA-512-256" and algType = "HASH"
   or
+  name = "hmacwithsha512-256" and nid = 1194 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "hmacwithsm3" and nid = 1281 and normalized = "SM3" and algType = "HASH"
   or
+  name = "hmacwithsm3" and nid = 1281 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-aes128-ccm" and
   nid = 896 and
   normalized = "AES-128" and
@@ -2457,12 +2632,20 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   or
   name = "id-hmacwithsha3-224" and nid = 1102 and normalized = "SHA3-224" and algType = "HASH"
   or
+  name = "id-hmacwithsha3-224" and nid = 1102 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-hmacwithsha3-256" and nid = 1103 and normalized = "SHA3-256" and algType = "HASH"
   or
+  name = "id-hmacwithsha3-256" and nid = 1103 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-hmacwithsha3-384" and nid = 1104 and normalized = "SHA3-384" and algType = "HASH"
   or
+  name = "id-hmacwithsha3-384" and nid = 1104 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-hmacwithsha3-512" and nid = 1105 and normalized = "SHA3-512" and algType = "HASH"
   or
+  name = "id-hmacwithsha3-512" and nid = 1105 and normalized = "HMAC" and algType = "MAC"
+  or
   name = "id-regctrl" and nid = 313 and normalized = "CTR" and algType = "BLOCK_MODE"
   or
   name = "id-smime-alg-3deswrap" and
@@ -2818,93 +3001,93 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   name = "ripemd160withrsa" and
   nid = 119 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "ripemd160withrsa" and nid = 119 and normalized = "RIPEMD160" and algType = "HASH"
   or
-  name = "rsa-md2" and nid = 7 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-md2" and nid = 7 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-md2" and nid = 7 and normalized = "MD2" and algType = "HASH"
   or
-  name = "rsa-md4" and nid = 396 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-md4" and nid = 396 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-md4" and nid = 396 and normalized = "MD4" and algType = "HASH"
   or
-  name = "rsa-md5" and nid = 8 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-md5" and nid = 8 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-md5" and nid = 8 and normalized = "MD5" and algType = "HASH"
   or
-  name = "rsa-mdc2" and nid = 96 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-mdc2" and nid = 96 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-mdc2" and nid = 96 and normalized = "MDC2" and algType = "HASH"
   or
-  name = "rsa-np-md5" and nid = 104 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-np-md5" and nid = 104 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-np-md5" and nid = 104 and normalized = "MD5" and algType = "HASH"
   or
-  name = "rsa-ripemd160" and nid = 119 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-ripemd160" and nid = 119 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-ripemd160" and nid = 119 and normalized = "RIPEMD160" and algType = "HASH"
   or
-  name = "rsa-sha" and nid = 42 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha" and nid = 42 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha" and nid = 42 and normalized = "SHA" and algType = "HASH"
   or
-  name = "rsa-sha1" and nid = 65 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha1" and nid = 65 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha1" and nid = 65 and normalized = "SHA1" and algType = "HASH"
   or
-  name = "rsa-sha1-2" and nid = 115 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha1-2" and nid = 115 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha1-2" and nid = 115 and normalized = "SHA1" and algType = "HASH"
   or
-  name = "rsa-sha224" and nid = 671 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha224" and nid = 671 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha224" and nid = 671 and normalized = "SHA-224" and algType = "HASH"
   or
-  name = "rsa-sha256" and nid = 668 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha256" and nid = 668 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha256" and nid = 668 and normalized = "SHA-256" and algType = "HASH"
   or
-  name = "rsa-sha3-224" and nid = 1116 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha3-224" and nid = 1116 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha3-224" and nid = 1116 and normalized = "SHA3-224" and algType = "HASH"
   or
-  name = "rsa-sha3-256" and nid = 1117 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha3-256" and nid = 1117 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha3-256" and nid = 1117 and normalized = "SHA3-256" and algType = "HASH"
   or
-  name = "rsa-sha3-384" and nid = 1118 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha3-384" and nid = 1118 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha3-384" and nid = 1118 and normalized = "SHA3-384" and algType = "HASH"
   or
-  name = "rsa-sha3-512" and nid = 1119 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha3-512" and nid = 1119 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha3-512" and nid = 1119 and normalized = "SHA3-512" and algType = "HASH"
   or
-  name = "rsa-sha384" and nid = 669 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha384" and nid = 669 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha384" and nid = 669 and normalized = "SHA-384" and algType = "HASH"
   or
-  name = "rsa-sha512" and nid = 670 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sha512" and nid = 670 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sha512" and nid = 670 and normalized = "SHA-512" and algType = "HASH"
   or
   name = "rsa-sha512/224" and
   nid = 1145 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "rsa-sha512/224" and nid = 1145 and normalized = "SHA-512-224" and algType = "HASH"
   or
   name = "rsa-sha512/256" and
   nid = 1146 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "rsa-sha512/256" and nid = 1146 and normalized = "SHA-512-256" and algType = "HASH"
   or
-  name = "rsa-sm3" and nid = 1144 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsa-sm3" and nid = 1144 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsa-sm3" and nid = 1144 and normalized = "SM3" and algType = "HASH"
   or
@@ -2928,52 +3111,52 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   normalized = "OAEP" and
   algType = "ASYMMETRIC_PADDING"
   or
-  name = "rsasignature" and nid = 377 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsasignature" and nid = 377 and normalized = "RSA" and algType = "SIGNATURE"
   or
-  name = "rsassa-pss" and nid = 912 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsassa-pss" and nid = 912 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "rsassa-pss" and nid = 912 and normalized = "PSS" and algType = "ASYMMETRIC_PADDING"
   or
-  name = "rsassapss" and nid = 912 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "rsassapss" and nid = 912 and normalized = "RSA" and algType = "SIGNATURE"
   or
-  name = "rsassapss" and nid = 912 and normalized = "PSS" and algType = "ASYMMETRIC_PADDING"
+  name = "rsassapss" and nid = 912 and normalized = "PSS" and algType = "SIGNATURE"
   or
-  name = "sha1withrsa" and nid = 115 and normalized = "RSA" and algType = "ASYMMETRIC_ENCRYPTION"
+  name = "sha1withrsa" and nid = 115 and normalized = "RSA" and algType = "SIGNATURE"
   or
   name = "sha1withrsa" and nid = 115 and normalized = "SHA1" and algType = "HASH"
   or
   name = "sha1withrsaencryption" and
   nid = 65 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha1withrsaencryption" and nid = 65 and normalized = "SHA1" and algType = "HASH"
   or
   name = "sha224withrsaencryption" and
   nid = 671 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha224withrsaencryption" and nid = 671 and normalized = "SHA-224" and algType = "HASH"
   or
   name = "sha256withrsaencryption" and
   nid = 668 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha256withrsaencryption" and nid = 668 and normalized = "SHA-256" and algType = "HASH"
   or
   name = "sha384withrsaencryption" and
   nid = 669 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha384withrsaencryption" and nid = 669 and normalized = "SHA-384" and algType = "HASH"
   or
   name = "sha512-224withrsaencryption" and
   nid = 1145 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha512-224withrsaencryption" and
   nid = 1145 and
@@ -2983,7 +3166,7 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   name = "sha512-256withrsaencryption" and
   nid = 1146 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha512-256withrsaencryption" and
   nid = 1146 and
@@ -2993,14 +3176,14 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   name = "sha512withrsaencryption" and
   nid = 670 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sha512withrsaencryption" and nid = 670 and normalized = "SHA-512" and algType = "HASH"
   or
   name = "shawithrsaencryption" and
   nid = 42 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "shawithrsaencryption" and nid = 42 and normalized = "SHA" and algType = "HASH"
   or
@@ -3017,7 +3200,11 @@ predicate knownOpenSSLAlgorithmLiteral(string name, int nid, string normalized,
   name = "sm3withrsaencryption" and
   nid = 1144 and
   normalized = "RSA" and
-  algType = "ASYMMETRIC_ENCRYPTION"
+  algType = "SIGNATURE"
   or
   name = "sm3withrsaencryption" and nid = 1144 and normalized = "SM3" and algType = "HASH"
+  or
+  name = "hmac" and nid = 855 and normalized = "HMAC" and algType = "MAC"
+  or
+  name = "cmac" and nid = 894 and normalized = "CMAC" and algType = "MAC"
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/MACAlgorithmInstance.qll

@@ -0,0 +1,66 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import experimental.quantum.OpenSSL.Operations.OpenSSLOperations
+private import AlgToAVCFlow
+
+class KnownOpenSslMacConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::MACAlgorithmInstance instanceof KnownOpenSslMacAlgorithmExpr
+{
+  OpenSslAlgorithmValueConsumer getterCall;
+
+  KnownOpenSslMacConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof OpenSslAlgorithmLiteral and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a CipherGetterCall
+      sink = getterCall.getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
+  }
+
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
+
+  override string getRawMacAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override Crypto::TMACType getMacType() {
+    this instanceof KnownOpenSslHMacAlgorithmExpr and result instanceof Crypto::THMAC
+    or
+    this instanceof KnownOpenSslCMacAlgorithmExpr and result instanceof Crypto::TCMAC
+  }
+}
+
+class KnownOpenSslHMacConstantAlgorithmInstance extends Crypto::HMACAlgorithmInstance,
+  KnownOpenSslMacConstantAlgorithmInstance
+{
+  override Crypto::AlgorithmValueConsumer getHashAlgorithmValueConsumer() {
+    if exists(this.(KnownOpenSslHMacAlgorithmExpr).getExplicitHashAlgorithm())
+    then
+      // ASSUMPTION: if there is an explicit hash algorithm, it is already modeled
+      // and we can simply grab that model's AVC
+      exists(OpenSslAlgorithmInstance inst | inst.getAvc() = result and inst = this)
+    else
+      // ASSUMPTION: If no explicit algorithm is given, then it is assumed to be configured by
+      // a signature operation
+      exists(Crypto::SignatureOperationInstance s |
+        s.getHashAlgorithmValueConsumer() = result and
+        s.getAnAlgorithmValueConsumer() = this.getAvc()
+      )
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/OpenSSLAlgorithmInstanceBase.qll

@@ -1,6 +1,6 @@
 private import experimental.quantum.Language
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 
-abstract class OpenSSLAlgorithmInstance extends Crypto::AlgorithmInstance {
-  abstract OpenSSLAlgorithmValueConsumer getAVC();
+abstract class OpenSslAlgorithmInstance extends Crypto::AlgorithmInstance {
+  abstract OpenSslAlgorithmValueConsumer getAvc();
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/OpenSSLAlgorithmInstances.qll

@@ -4,3 +4,5 @@ import PaddingAlgorithmInstance
 import BlockAlgorithmInstance
 import HashAlgorithmInstance
 import EllipticCurveAlgorithmInstance
+import SignatureAlgorithmInstance
+import MACAlgorithmInstance

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/PaddingAlgorithmInstance.qll

@@ -17,21 +17,21 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
  *     # define RSA_PKCS1_WITH_TLS_PADDING 7
  *     # define RSA_PKCS1_NO_IMPLICIT_REJECT_PADDING 8
  */
-class OpenSSLPaddingLiteral extends Literal {
+class OpenSslPaddingLiteral extends Literal {
   // TODO: we can be more specific about where the literal is in a larger expression
   // to avoid literals that are clealy not representing an algorithm, e.g., array indices.
-  OpenSSLPaddingLiteral() { this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8] }
+  OpenSslPaddingLiteral() { this.getValue().toInt() in [0, 1, 3, 4, 5, 6, 7, 8] }
 }
 
 /**
- * Given a `KnownOpenSSLPaddingAlgorithmConstant`, converts this to a padding family type.
+ * Given a `KnownOpenSslPaddingAlgorithmExpr`, converts this to a padding family type.
  * Does not bind if there is no mapping (no mapping to 'unknown' or 'other').
  */
-predicate knownOpenSSLConstantToPaddingFamilyType(
-  KnownOpenSSLPaddingAlgorithmConstant e, Crypto::TPaddingType type
+predicate knownOpenSslConstantToPaddingFamilyType(
+  KnownOpenSslPaddingAlgorithmExpr e, Crypto::TPaddingType type
 ) {
   exists(string name |
-    name = e.getNormalizedName() and
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
     (
       name.matches("OAEP") and type = Crypto::OAEP()
       or
@@ -44,44 +44,44 @@ predicate knownOpenSSLConstantToPaddingFamilyType(
   )
 }
 
-//abstract class OpenSSLPaddingAlgorithmInstance extends OpenSSLAlgorithmInstance, Crypto::PaddingAlgorithmInstance{}
+//abstract class OpenSslPaddingAlgorithmInstance extends OpenSslAlgorithmInstance, Crypto::PaddingAlgorithmInstance{}
 // TODO: need to alter this to include known padding constants which don't have the
 // same mechanics as those with known nids
-class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInstance,
+class KnownOpenSslPaddingConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
   Crypto::PaddingAlgorithmInstance instanceof Expr
 {
-  OpenSSLAlgorithmValueConsumer getterCall;
+  OpenSslAlgorithmValueConsumer getterCall;
   boolean isPaddingSpecificConsumer;
 
-  KnownOpenSSLPaddingConstantAlgorithmInstance() {
+  KnownOpenSslPaddingConstantAlgorithmInstance() {
     // three possibilities:
     // 1) The source is a 'typical' literal and flows to a getter, then we know we have an instance
-    // 2) The source is a KnownOpenSSLAlgorithm is call, and we know we have an instance immediately from that
+    // 2) The source is a KnownOpenSslAlgorithm is call, and we know we have an instance immediately from that
     // 3) the source is a padding-specific literal flowing to a padding-specific consumer
     // Possibility 1:
-    this instanceof Literal and
-    this instanceof KnownOpenSSLPaddingAlgorithmConstant and
+    this instanceof OpenSslAlgorithmLiteral and
+    this instanceof KnownOpenSslPaddingAlgorithmExpr and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
-      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a getter
-      KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink) and
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink) and
       isPaddingSpecificConsumer = false
     )
     or
     // Possibility 2:
-    this instanceof DirectAlgorithmValueConsumer and
+    this instanceof OpenSslAlgorithmCall and
     getterCall = this and
-    this instanceof KnownOpenSSLPaddingAlgorithmConstant and
+    this instanceof KnownOpenSslPaddingAlgorithmExpr and
     isPaddingSpecificConsumer = false
     or
     // Possibility 3: padding-specific literal
-    this instanceof OpenSSLPaddingLiteral and
+    this instanceof OpenSslPaddingLiteral and
     exists(DataFlow::Node src, DataFlow::Node sink |
       // Sink is an argument to a CipherGetterCall
-      sink = getterCall.(OpenSSLAlgorithmValueConsumer).getInputNode() and
+      sink = getterCall.getInputNode() and
       // Source is `this`
       src.asExpr() = this and
       // This traces to a padding-specific consumer
@@ -96,7 +96,7 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
     result = this.(Call).getTarget().getName()
   }
 
-  override OpenSSLAlgorithmValueConsumer getAVC() { result = getterCall }
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
 
   Crypto::TPaddingType getKnownPaddingType() {
     this.(Literal).getValue().toInt() in [1, 7, 8] and result = Crypto::PKCS1_v1_5()
@@ -119,7 +119,7 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
     )
     or
     isPaddingSpecificConsumer = false and
-    knownOpenSSLConstantToPaddingFamilyType(this, result)
+    knownOpenSslConstantToPaddingFamilyType(this, result)
   }
 }
 
@@ -127,7 +127,7 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
 // // not the same as 'typical' constants found in the set of known algorithm constants
 // // they do not have an NID
 // // TODO: what about setting the padding directly?
-// class KnownRSAPaddingConstant extends OpenSSLPaddingAlgorithmInstance, Crypto::PaddingAlgorithmInstance instanceof Literal
+// class KnownRSAPaddingConstant extends OpenSslPaddingAlgorithmInstance, Crypto::PaddingAlgorithmInstance instanceof Literal
 // {
 //   KnownRSAPaddingConstant() {
 //     // from rsa.h in openssl:
@@ -162,7 +162,7 @@ class KnownOpenSSLPaddingConstantAlgorithmInstance extends OpenSSLAlgorithmInsta
 //   }
 // }
 class OAEPPaddingAlgorithmInstance extends Crypto::OAEPPaddingAlgorithmInstance,
-  KnownOpenSSLPaddingConstantAlgorithmInstance
+  KnownOpenSslPaddingConstantAlgorithmInstance
 {
   OAEPPaddingAlgorithmInstance() {
     this.(Crypto::PaddingAlgorithmInstance).getPaddingType() = Crypto::OAEP()

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/SignatureAlgorithmInstance.qll

@@ -0,0 +1,102 @@
+import cpp
+private import experimental.quantum.Language
+private import KnownAlgorithmConstants
+private import Crypto::KeyOpAlg as KeyOpAlg
+private import OpenSSLAlgorithmInstanceBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.DirectAlgorithmValueConsumer
+private import AlgToAVCFlow
+
+/**
+ * Gets the signature algorithm type based on the normalized algorithm name.
+ */
+private predicate knownOpenSslConstantToSignatureFamilyType(
+  KnownOpenSslSignatureAlgorithmExpr e, Crypto::KeyOpAlg::TAlgorithm type
+) {
+  exists(string name |
+    name = e.(KnownOpenSslAlgorithmExpr).getNormalizedName() and
+    (
+      name.matches("RSA%") and type = KeyOpAlg::TAsymmetricCipher(KeyOpAlg::RSA())
+      or
+      name.matches("DSA%") and type = KeyOpAlg::TSignature(KeyOpAlg::DSA())
+      or
+      name.matches("ECDSA%") and type = KeyOpAlg::TSignature(KeyOpAlg::ECDSA())
+      or
+      name.matches("ED25519%") and type = KeyOpAlg::TSignature(KeyOpAlg::EDDSA())
+      or
+      name.matches("ED448%") and type = KeyOpAlg::TSignature(KeyOpAlg::EDDSA())
+    )
+  )
+}
+
+/**
+ * A signature algorithm instance derived from an OpenSsl constant.
+ */
+class KnownOpenSslSignatureConstantAlgorithmInstance extends OpenSslAlgorithmInstance,
+  Crypto::KeyOperationAlgorithmInstance instanceof KnownOpenSslSignatureAlgorithmExpr
+{
+  OpenSslAlgorithmValueConsumer getterCall;
+
+  KnownOpenSslSignatureConstantAlgorithmInstance() {
+    // Two possibilities:
+    // 1) The source is a literal and flows to a getter, then we know we have an instance
+    // 2) The source is a KnownOpenSslAlgorithm call, and we know we have an instance immediately from that
+    // Possibility 1:
+    this instanceof OpenSslAlgorithmLiteral and
+    exists(DataFlow::Node src, DataFlow::Node sink |
+      // Sink is an argument to a signature getter call
+      sink = getterCall.getInputNode() and
+      // Source is `this`
+      src.asExpr() = this and
+      // This traces to a getter
+      KnownOpenSslAlgorithmToAlgorithmValueConsumerFlow::flow(src, sink)
+    )
+    or
+    // Possibility 2:
+    this instanceof OpenSslAlgorithmCall and
+    getterCall = this
+  }
+
+  override Crypto::ModeOfOperationAlgorithmInstance getModeOfOperationAlgorithm() { none() }
+
+  override Crypto::PaddingAlgorithmInstance getPaddingAlgorithm() { none() }
+
+  override string getRawAlgorithmName() {
+    result = this.(Literal).getValue().toString()
+    or
+    result = this.(Call).getTarget().getName()
+  }
+
+  override int getKeySizeFixed() {
+    // TODO: use ellipticCurveNameToKeySizeAndFamilyMapping or KnownOpenSslEllipticCurveConstantAlgorithmInstance
+    // TODO: maybe add getExplicitKeySize to KnownOpenSslSignatureAlgorithmExpr and use it here
+    none()
+  }
+
+  override KeyOpAlg::Algorithm getAlgorithmType() {
+    knownOpenSslConstantToSignatureFamilyType(this, result)
+    or
+    not knownOpenSslConstantToSignatureFamilyType(this, _) and
+    result = KeyOpAlg::TSignature(KeyOpAlg::OtherSignatureAlgorithmType())
+  }
+
+  override OpenSslAlgorithmValueConsumer getAvc() { result = getterCall }
+
+  override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
+    // TODO: trace to any key size initializer
+    // probably PKeyAlgorithmValueConsumer and SignatureAlgorithmValueConsumer
+    none()
+  }
+
+  /**
+   * No mode for signatures.
+   */
+  override predicate shouldHaveModeOfOperation() { none() }
+
+  /**
+   * Padding only for RSA.
+   */
+  override predicate shouldHavePaddingScheme() {
+    this.getAlgorithmType() instanceof KeyOpAlg::TAsymmetricCipher
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/CipherAlgorithmValueConsumer.qll

@@ -4,14 +4,14 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
 private import OpenSSLAlgorithmValueConsumerBase
 
-abstract class CipherAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class CipherAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
 // https://www.openssl.org/docs/manmaster/man3/EVP_CIPHER_fetch.html
-class EVPCipherAlgorithmValueConsumer extends CipherAlgorithmValueConsumer {
+class EvpCipherAlgorithmValueConsumer extends CipherAlgorithmValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPCipherAlgorithmValueConsumer() {
+  EvpCipherAlgorithmValueConsumer() {
     resultNode.asExpr() = this and
     (
       this.(Call).getTarget().getName() in [
@@ -30,8 +30,8 @@ class EVPCipherAlgorithmValueConsumer extends CipherAlgorithmValueConsumer {
 
   // override DataFlow::Node getInputNode() { result = valueArgNode }
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
-    //TODO: As a potential alternative, for OpenSSL only, add a generic source node for literals and only create flow (flowsTo) to
-    // OpenSSL AVCs... the unknown literal sources would have to be any literals not in the known set.
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
+    //TODO: As a potential alternative, for OpenSsl only, add a generic source node for literals and only create flow (flowsTo) to
+    // OpenSsl AVCs... the unknown literal sources would have to be any literals not in the known set.
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/DirectAlgorithmValueConsumer.qll

@@ -7,26 +7,27 @@ private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgor
  * Cases like EVP_MD5(),
  * there is no input, rather it directly gets an algorithm
  * and returns it.
+ * Also includes operations directly using an algorithm
+ * like AES_encrypt().
  */
-class DirectAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer {
-  DataFlow::Node resultNode;
-  Expr resultExpr;
-
-  DirectAlgorithmValueConsumer() {
-    this instanceof KnownOpenSSLAlgorithmConstant and
-    this instanceof Call and
-    resultExpr = this and
-    resultNode.asExpr() = resultExpr
-  }
-
+class DirectAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer instanceof OpenSslAlgorithmCall
+{
   /**
    * These cases take in no explicit value (the value is implicit)
    */
   override Crypto::ConsumerInputDataFlowNode getInputNode() { none() }
 
-  override DataFlow::Node getResultNode() { result = resultNode }
+  /**
+   * Gets the DataFlow node represeting the output algorithm entity
+   * created as a result of this call.
+   */
+  override DataFlow::Node getResultNode() {
+    this instanceof OpenSslDirectAlgorithmFetchCall and
+    result.asExpr() = this
+    // NOTE: if instanceof OpenSslDirectAlgorithmOperationCall then there is no algorithm generated
+    // the algorithm is directly used
+  }
 
-  //   override DataFlow::Node getOutputNode() { result = resultNode }
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
     // Note: algorithm source definitions enforces that
     // this class will be a known algorithm source

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/EllipticCurveAlgorithmValueConsumer.qll

@@ -4,14 +4,14 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
 
-abstract class EllipticCurveValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class EllipticCurveValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
 //https://docs.openssl.org/3.0/man3/EC_KEY_new/#name
-class EVPEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer {
+class EvpEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPEllipticCurveAlgorithmConsumer() {
+  EvpEllipticCurveAlgorithmConsumer() {
     resultNode.asExpr() = this.(Call) and // in all cases the result is the return
     (
       this.(Call).getTarget().getName() in ["EVP_EC_gen", "EC_KEY_new_by_curve_name"] and
@@ -25,7 +25,7 @@ class EVPEllipticCurveAlgorithmConsumer extends EllipticCurveValueConsumer {
   }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 
   override DataFlow::Node getResultNode() { result = resultNode }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/HashAlgorithmValueConsumer.qll

@@ -4,20 +4,20 @@ private import semmle.code.cpp.dataflow.new.DataFlow
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
 
-abstract class HashAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class HashAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
 /**
  * EVP_Q_Digest directly consumes algorithm constant values
  */
-class EVP_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
-  EVP_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
+class Evp_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
+  Evp_Q_Digest_Algorithm_Consumer() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
 
   override Crypto::ConsumerInputDataFlowNode getInputNode() {
     result.asExpr() = this.(Call).getArgument(1)
   }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 
   override DataFlow::Node getResultNode() {
@@ -27,15 +27,43 @@ class EVP_Q_Digest_Algorithm_Consumer extends HashAlgorithmValueConsumer {
   }
 }
 
+/**
+ * An instance from https://docs.openssl.org/3.0/man3/EVP_PKEY_CTX_ctrl/
+ * where the digest is directly consumed by name.
+ * In these cases, the operation is not yet performed, but there is
+ * these functions are treated as 'initializers' and track the algorithm through
+ * `EvpInitializer` mechanics, i.e., the resultNode is considered 'none'
+ */
+class EvpPkeySetCtxALgorithmConsumer extends HashAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+
+  EvpPkeySetCtxALgorithmConsumer() {
+    this.(Call).getTarget().getName() in [
+        "EVP_PKEY_CTX_set_rsa_mgf1_md_name", "EVP_PKEY_CTX_set_rsa_oaep_md_name",
+        "EVP_PKEY_CTX_set_dsa_paramgen_md_props"
+      ] and
+    valueArgNode.asExpr() = this.(Call).getArgument(1)
+  }
+
+  override DataFlow::Node getResultNode() { none() }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
+  }
+}
+
 /**
  * The EVP digest algorithm getters
  * https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
+ * https://docs.openssl.org/3.0/man3/EVP_DigestSignInit/#name
  */
-class EVPDigestAlgorithmValueConsumer extends HashAlgorithmValueConsumer {
+class EvpDigestAlgorithmValueConsumer extends HashAlgorithmValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPDigestAlgorithmValueConsumer() {
+  EvpDigestAlgorithmValueConsumer() {
     resultNode.asExpr() = this and
     (
       this.(Call).getTarget().getName() in [
@@ -45,6 +73,9 @@ class EVPDigestAlgorithmValueConsumer extends HashAlgorithmValueConsumer {
       or
       this.(Call).getTarget().getName() = "EVP_MD_fetch" and
       valueArgNode.asExpr() = this.(Call).getArgument(1)
+      or
+      this.(Call).getTarget().getName() = "EVP_DigestSignInit_ex" and
+      valueArgNode.asExpr() = this.(Call).getArgument(2)
     )
   }
 
@@ -53,6 +84,6 @@ class EVPDigestAlgorithmValueConsumer extends HashAlgorithmValueConsumer {
   override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/KEMAlgorithmValueConsumer.qll

@@ -4,13 +4,13 @@ private import semmle.code.cpp.dataflow.new.DataFlow
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
 
-abstract class KEMAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class KemAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
-class EVPKEMAlgorithmValueConsumer extends KEMAlgorithmValueConsumer {
+class EvpKemAlgorithmValueConsumer extends KemAlgorithmValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPKEMAlgorithmValueConsumer() {
+  EvpKemAlgorithmValueConsumer() {
     resultNode.asExpr() = this and
     (
       this.(Call).getTarget().getName() = "EVP_KEM_fetch" and
@@ -23,6 +23,6 @@ class EVPKEMAlgorithmValueConsumer extends KEMAlgorithmValueConsumer {
   override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/KeyExchangeAlgorithmValueConsumer.qll

@@ -4,13 +4,13 @@ private import semmle.code.cpp.dataflow.new.DataFlow
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
 
-abstract class KeyExchangeAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class KeyExchangeAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
-class EVPKeyExchangeAlgorithmValueConsumer extends KeyExchangeAlgorithmValueConsumer {
+class EvpKeyExchangeAlgorithmValueConsumer extends KeyExchangeAlgorithmValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPKeyExchangeAlgorithmValueConsumer() {
+  EvpKeyExchangeAlgorithmValueConsumer() {
     resultNode.asExpr() = this and
     (
       this.(Call).getTarget().getName() = "EVP_KEYEXCH_fetch" and
@@ -23,6 +23,6 @@ class EVPKeyExchangeAlgorithmValueConsumer extends KeyExchangeAlgorithmValueCons
   override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/OpenSSLAlgorithmValueConsumerBase.qll

@@ -1,6 +1,6 @@
 private import experimental.quantum.Language
 
-abstract class OpenSSLAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer instanceof Call {
+abstract class OpenSslAlgorithmValueConsumer extends Crypto::AlgorithmValueConsumer instanceof Call {
   /**
    * Returns the node representing the resulting algorithm
    */

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/OpenSSLAlgorithmValueConsumers.qll

@@ -5,3 +5,4 @@ import PaddingAlgorithmValueConsumer
 import HashAlgorithmValueConsumer
 import EllipticCurveAlgorithmValueConsumer
 import PKeyAlgorithmValueConsumer
+import SignatureAlgorithmValueConsumer

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PKeyAlgorithmValueConsumer.qll

@@ -4,13 +4,13 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumerBase
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstances
 
-abstract class PKeyValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class PKeyValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
-class EVPPKeyAlgorithmConsumer extends PKeyValueConsumer {
+class EvpPKeyAlgorithmConsumer extends PKeyValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVPPKeyAlgorithmConsumer() {
+  EvpPKeyAlgorithmConsumer() {
     resultNode.asExpr() = this.(Call) and // in all cases the result is the return
     (
       // NOTE: some of these consumers are themselves key gen operations,
@@ -23,7 +23,8 @@ class EVPPKeyAlgorithmConsumer extends PKeyValueConsumer {
       or
       this.(Call).getTarget().getName() in [
           "EVP_PKEY_CTX_new_from_name", "EVP_PKEY_new_raw_private_key_ex",
-          "EVP_PKEY_new_raw_public_key_ex", "EVP_PKEY_CTX_ctrl", "EVP_PKEY_CTX_set_group_name"
+          "EVP_PKEY_new_raw_public_key_ex", "EVP_PKEY_CTX_ctrl", "EVP_PKEY_CTX_ctrl_uint64",
+          "EVP_PKEY_CTX_ctrl_str", "EVP_PKEY_CTX_set_group_name"
         ] and
       valueArgNode.asExpr() = this.(Call).getArgument(1)
       or
@@ -46,7 +47,7 @@ class EVPPKeyAlgorithmConsumer extends PKeyValueConsumer {
   }
 
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
   }
 
   override DataFlow::Node getResultNode() { result = resultNode }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/PaddingAlgorithmValueConsumer.qll

@@ -4,16 +4,16 @@ private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmCon
 private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
 private import OpenSSLAlgorithmValueConsumerBase
 
-abstract class PaddingAlgorithmValueConsumer extends OpenSSLAlgorithmValueConsumer { }
+abstract class PaddingAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
 
 // https://docs.openssl.org/master/man7/EVP_ASYM_CIPHER-RSA/#rsa-asymmetric-cipher-parameters
 // TODO: need to handle setting padding through EVP_PKEY_CTX_set_params, where modes like "OSSL_PKEY_RSA_PAD_MODE_OAEP"
 // are set.
-class EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer extends PaddingAlgorithmValueConsumer {
+class Evp_PKey_Ctx_set_rsa_padding_AlgorithmValueConsumer extends PaddingAlgorithmValueConsumer {
   DataFlow::Node valueArgNode;
   DataFlow::Node resultNode;
 
-  EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer() {
+  Evp_PKey_Ctx_set_rsa_padding_AlgorithmValueConsumer() {
     resultNode.asExpr() = this and
     this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_rsa_padding" and
     valueArgNode.asExpr() = this.(Call).getArgument(1)
@@ -25,8 +25,8 @@ class EVP_PKEY_CTX_set_rsa_padding_AlgorithmValueConsumer extends PaddingAlgorit
 
   // override DataFlow::Node getInputNode() { result = valueArgNode }
   override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
-    exists(OpenSSLAlgorithmInstance i | i.getAVC() = this and result = i)
-    //TODO: As a potential alternative, for OpenSSL only, add a generic source node for literals and only create flow (flowsTo) to
-    // OpenSSL AVCs... the unknown literal sources would have to be any literals not in the known set.
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
+    //TODO: As a potential alternative, for OpenSsl only, add a generic source node for literals and only create flow (flowsTo) to
+    // OpenSsl AVCs... the unknown literal sources would have to be any literals not in the known set.
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmValueConsumers/SignatureAlgorithmValueConsumer.qll

@@ -0,0 +1,32 @@
+import cpp
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
+private import experimental.quantum.OpenSSL.AlgorithmInstances.OpenSSLAlgorithmInstanceBase
+private import OpenSSLAlgorithmValueConsumerBase
+private import experimental.quantum.OpenSSL.LibraryDetector
+
+abstract class SignatureAlgorithmValueConsumer extends OpenSslAlgorithmValueConsumer { }
+
+class EvpSignatureAlgorithmValueConsumer extends SignatureAlgorithmValueConsumer {
+  DataFlow::Node valueArgNode;
+  DataFlow::Node resultNode;
+
+  EvpSignatureAlgorithmValueConsumer() {
+    resultNode.asExpr() = this and
+    (
+      // EVP_SIGNATURE
+      this.(Call).getTarget().getName() = "EVP_SIGNATURE_fetch" and
+      valueArgNode.asExpr() = this.(Call).getArgument(1)
+      // EVP_PKEY_get1_DSA, EVP_PKEY_get1_RSA
+      // DSA_SIG_new, DSA_SIG_get0, RSA_sign ?
+    )
+  }
+
+  override DataFlow::Node getResultNode() { result = resultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getInputNode() { result = valueArgNode }
+
+  override Crypto::AlgorithmInstance getAKnownAlgorithmSource() {
+    exists(OpenSslAlgorithmInstance i | i.getAvc() = this and result = i)
+  }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/AvcFlow.qll

@@ -0,0 +1,19 @@
+import semmle.code.cpp.dataflow.new.DataFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+
+/**
+ * Flows from algorithm values to operations, specific to OpenSsl
+ */
+module AvcToCallArgConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    exists(OpenSslAlgorithmValueConsumer c | c.getResultNode() = source)
+  }
+
+  /**
+   * Trace to any call accepting the algorithm.
+   * NOTE: users must restrict this set to the operations they are interested in.
+   */
+  predicate isSink(DataFlow::Node sink) { exists(Call c | c.getAnArgument() = sink.asExpr()) }
+}
+
+module AvcToCallArgFlow = DataFlow::Global<AvcToCallArgConfig>;

cpp/ql/lib/experimental/quantum/OpenSSL/CtxFlow.qll

@@ -28,7 +28,7 @@ import semmle.code.cpp.dataflow.new.DataFlow
  * - EVP_MD_CTX
  * - EVP_PKEY_CTX
  */
-private class CtxType extends Type {
+class CtxType extends Type {
   CtxType() {
     // It is possible for users to use the underlying type of the CTX variables
     // these have a name matching 'evp_%ctx_%st
@@ -47,7 +47,7 @@ private class CtxType extends Type {
 /**
  * A pointer to a CtxType
  */
-private class CtxPointerExpr extends Expr {
+class CtxPointerExpr extends Expr {
   CtxPointerExpr() {
     this.getType() instanceof CtxType and
     this.getType() instanceof PointerType
@@ -57,12 +57,19 @@ private class CtxPointerExpr extends Expr {
 /**
  * A call argument of type CtxPointerExpr.
  */
-private class CtxPointerArgument extends CtxPointerExpr {
+class CtxPointerArgument extends CtxPointerExpr {
   CtxPointerArgument() { exists(Call c | c.getAnArgument() = this) }
 
   Call getCall() { result.getAnArgument() = this }
 }
 
+/**
+ * A call returning a CtxPointerExpr.
+ */
+private class CtxPointerReturn extends CtxPointerExpr instanceof Call {
+  Call getCall() { result = this }
+}
+
 /**
  * A call whose target contains 'free' or 'reset' and has an argument of type
  * CtxPointerArgument.
@@ -74,66 +81,141 @@ private class CtxClearCall extends Call {
   }
 }
 
+abstract private class CtxPassThroughCall extends Call {
+  abstract DataFlow::Node getNode1();
+
+  abstract DataFlow::Node getNode2();
+}
+
 /**
  * A call whose target contains 'copy' and has an argument of type
  * CtxPointerArgument.
  */
-private class CtxCopyOutArgCall extends Call {
+private class CtxCopyOutArgCall extends CtxPassThroughCall {
+  DataFlow::Node n1;
+  DataFlow::Node n2;
+
   CtxCopyOutArgCall() {
     this.getTarget().getName().toLowerCase().matches("%copy%") and
-    this.getAnArgument() instanceof CtxPointerArgument
+    n1.asExpr() = this.getAnArgument() and
+    n1.getType() instanceof CtxType and
+    n2.asDefiningArgument() = this.getAnArgument() and
+    n2.getType() instanceof CtxType and
+    n1.asDefiningArgument() != n2.asExpr()
   }
+
+  override DataFlow::Node getNode1() { result = n1 }
+
+  override DataFlow::Node getNode2() { result = n2 }
 }
 
 /**
  * A call whose target contains 'dup' and has an argument of type
  * CtxPointerArgument.
  */
-private class CtxCopyReturnCall extends Call, CtxPointerExpr {
+private class CtxCopyReturnCall extends CtxPassThroughCall, CtxPointerExpr {
+  DataFlow::Node n1;
+
   CtxCopyReturnCall() {
     this.getTarget().getName().toLowerCase().matches("%dup%") and
-    this.getAnArgument() instanceof CtxPointerArgument
+    n1.asExpr() = this.getAnArgument() and
+    n1.getType() instanceof CtxType
+  }
+
+  override DataFlow::Node getNode1() { result = n1 }
+
+  override DataFlow::Node getNode2() { result.asExpr() = this }
+}
+
+/**
+ * A call to `EVP_PKEY_paramgen` acts as a kind of pass through.
+ * It's output pkey is eventually used in a new operation generating
+ * a fresh context pointer (e.g., `EVP_PKEY_CTX_new`).
+ * It is easier to model this as a pass through
+ * than to model the flow from the paramgen to the new key generation.
+ */
+private class CtxParamGenCall extends CtxPassThroughCall {
+  DataFlow::Node n1;
+  DataFlow::Node n2;
+
+  CtxParamGenCall() {
+    this.getTarget().getName() = "EVP_PKEY_paramgen" and
+    n1.asExpr() = this.getArgument(0) and
+    (
+      n2.asExpr() = this.getArgument(1)
+      or
+      n2.asDefiningArgument() = this.getArgument(1)
+    )
+  }
+
+  override DataFlow::Node getNode1() { result = n1 }
+
+  override DataFlow::Node getNode2() { result = n2 }
+}
+
+/**
+ * If the current node gets is an argument to a function
+ * that returns a pointer type, immediately flow through.
+ * NOTE: this passthrough is required if we allow
+ * intermediate steps to go into variables that are not a CTX type.
+ * See for example `CtxParamGenCall`.
+ */
+private class CallArgToCtxRet extends CtxPassThroughCall, CtxPointerExpr {
+  DataFlow::Node n1;
+  DataFlow::Node n2;
+
+  CallArgToCtxRet() {
+    this.getAnArgument() = n1.asExpr() and
+    n2.asExpr() = this
+  }
+
+  override DataFlow::Node getNode1() { result = n1 }
+
+  override DataFlow::Node getNode2() { result = n2 }
+}
+
+/**
+ * A source Ctx of interest is any argument or return of type CtxPointerExpr.
+ */
+class CtxPointerSource extends CtxPointerExpr {
+  CtxPointerSource() {
+    this instanceof CtxPointerReturn or
+    this instanceof CtxPointerArgument
+  }
+
+  DataFlow::Node asNode() {
+    result.asExpr() = this
+    or
+    result.asDefiningArgument() = this
   }
 }
 
 /**
- * Flow from any CtxPointerArgument to any other CtxPointerArgument
+ * Flow from any CtxPointerSource to other CtxPointerSource.
  */
-module OpenSSLCtxArgumentFlowConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof CtxPointerArgument }
+module OpenSslCtxSourceToSourceFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { exists(CtxPointerSource s | s.asNode() = source) }
 
-  predicate isSink(DataFlow::Node sink) { sink.asExpr() instanceof CtxPointerArgument }
+  predicate isSink(DataFlow::Node sink) { exists(CtxPointerSource s | s.asNode() = sink) }
 
   predicate isBarrier(DataFlow::Node node) {
     exists(CtxClearCall c | c.getAnArgument() = node.asExpr())
   }
 
   predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) {
-    exists(CtxCopyOutArgCall c |
-      c.getAnArgument() = node1.asExpr() and
-      c.getAnArgument() = node2.asExpr() and
-      node1.asExpr() != node2.asExpr() and
-      node2.asExpr().getType() instanceof CtxType
-    )
-    or
-    exists(CtxCopyReturnCall c |
-      c.getAnArgument() = node1.asExpr() and
-      c = node2.asExpr() and
-      node1.asExpr() != node2.asExpr() and
-      node2.asExpr().getType() instanceof CtxType
-    )
+    exists(CtxPassThroughCall c | c.getNode1() = node1 and c.getNode2() = node2)
   }
 }
 
-module OpenSSLCtxArgumentFlow = DataFlow::Global<OpenSSLCtxArgumentFlowConfig>;
+module OpenSslCtxSourceToArgumentFlow = DataFlow::Global<OpenSslCtxSourceToSourceFlowConfig>;
 
 /**
  * Holds if there is a context flow from the source to the sink.
  */
-predicate ctxArgFlowsToCtxArg(CtxPointerArgument source, CtxPointerArgument sink) {
+predicate ctxSrcToSrcFlow(CtxPointerSource source, CtxPointerSource sink) {
   exists(DataFlow::Node a, DataFlow::Node b |
-    OpenSSLCtxArgumentFlow::flow(a, b) and
-    a.asExpr() = source and
-    b.asExpr() = sink
+    OpenSslCtxSourceToArgumentFlow::flow(a, b) and
+    a = source.asNode() and
+    b = sink.asNode()
   )
 }

cpp/ql/lib/experimental/quantum/OpenSSL/GenericSourceCandidateLiteral.qll

@@ -14,9 +14,9 @@ private class IntLiteral extends Literal {
 /**
  * Holds if a StringLiteral could conceivably be used in some way for cryptography.
  * Note: this predicate should only consider restrictions with respect to strings only.
- * General restrictions are in the OpenSSLGenericSourceCandidateLiteral class.
+ * General restrictions are in the OpenSslGenericSourceCandidateLiteral class.
  */
-private predicate isOpenSSLStringLiteralGenericSourceCandidate(StringLiteral s) {
+private predicate isOpenSslStringLiteralGenericSourceCandidate(StringLiteral s) {
   // 'EC' is a constant that may be used where typical algorithms are specified,
   // but EC specifically means set up a default curve container, that will later be
   //specified explicitly (or if not a default) curve is used.
@@ -49,9 +49,9 @@ private predicate isOpenSSLStringLiteralGenericSourceCandidate(StringLiteral s)
 /**
  * Holds if a StringLiteral could conceivably be used in some way for cryptography.
  * Note: this predicate should only consider restrictions with respect to integers only.
- * General restrictions are in the OpenSSLGenericSourceCandidateLiteral class.
+ * General restrictions are in the OpenSslGenericSourceCandidateLiteral class.
  */
-private predicate isOpenSSLIntLiteralGenericSourceCandidate(IntLiteral l) {
+private predicate isOpenSslIntLiteralGenericSourceCandidate(IntLiteral l) {
   // Ignore integer values of 0, commonly referring to NULL only (no known algorithm 0)
   l.getValue().toInt() != 0 and
   // ASSUMPTION, no negative numbers are allowed
@@ -102,11 +102,11 @@ private predicate isOpenSSLIntLiteralGenericSourceCandidate(IntLiteral l) {
  * "AES" may be a legitimate algorithm literal, but the literal will not be used for an operation directly
  * since it is in a equality comparison, hence this case would also be filtered.
  */
-class OpenSSLGenericSourceCandidateLiteral extends Literal {
-  OpenSSLGenericSourceCandidateLiteral() {
+class OpenSslGenericSourceCandidateLiteral extends Literal {
+  OpenSslGenericSourceCandidateLiteral() {
     (
-      isOpenSSLIntLiteralGenericSourceCandidate(this) or
-      isOpenSSLStringLiteralGenericSourceCandidate(this)
+      isOpenSslIntLiteralGenericSourceCandidate(this) or
+      isOpenSslStringLiteralGenericSourceCandidate(this)
     ) and
     // ********* General filters beyond what is filtered for strings and ints *********
     // An algorithm literal in a switch case will not be directly applied to an operation.

cpp/ql/lib/experimental/quantum/OpenSSL/KeyFlow.qll

@@ -0,0 +1,27 @@
+import semmle.code.cpp.dataflow.new.DataFlow
+private import Operations.OpenSSLOperations
+private import experimental.quantum.Language
+
+/**
+ * Flow from key creation to key used in a call
+ */
+module OpenSslKeyFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    // NOTE/ASSUMPTION: it is assumed the operation is also an OpenSslOperation.
+    // All operations modeled for openssl should be modeled as OpenSslOperation.
+    exists(Crypto::KeyCreationOperationInstance keygen | keygen.getOutputKeyArtifact() = source)
+  }
+
+  predicate isSink(DataFlow::Node sink) { exists(Call call | call.getAnArgument() = sink.asExpr()) }
+  //TODO: consideration for additional flow steps? Can a key be copied for example?
+}
+
+module OpenSslKeyFlow = TaintTracking::Global<OpenSslKeyFlowConfig>;
+
+Crypto::KeyCreationOperationInstance getSourceKeyCreationInstanceFromArg(Expr arg) {
+  exists(DataFlow::Node src, DataFlow::Node sink |
+    OpenSslKeyFlow::flow(src, sink) and
+    result.getOutputKeyArtifact() = src and
+    sink.asExpr() = arg
+  )
+}

cpp/ql/lib/experimental/quantum/OpenSSL/LibraryDetector.qll

@@ -1,7 +1,7 @@
 import cpp
 
-predicate isPossibleOpenSSLFunction(Function f) {
-  isPossibleOpenSSLLocation(f.getADeclarationLocation())
+predicate isPossibleOpenSslFunction(Function f) {
+  isPossibleOpenSslLocation(f.getADeclarationLocation())
 }
 
-predicate isPossibleOpenSSLLocation(Location l) { l.toString().toLowerCase().matches("%openssl%") }
+predicate isPossibleOpenSslLocation(Location l) { l.toString().toLowerCase().matches("%openssl%") }

cpp/ql/lib/experimental/quantum/OpenSSL/OpenSSL.qll

@@ -1,4 +1,4 @@
-module OpenSSLModel {
+module OpenSslModel {
   import AlgorithmInstances.OpenSSLAlgorithmInstances
   import AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
   import Operations.OpenSSLOperations

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/ECKeyGenOperation.qll

@@ -1,10 +1,9 @@
 private import experimental.quantum.Language
-private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
 private import OpenSSLOperationBase
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
 private import semmle.code.cpp.dataflow.new.DataFlow
 
-class ECKeyGenOperation extends OpenSSLOperation, Crypto::KeyGenerationOperationInstance {
+class ECKeyGenOperation extends OpenSslOperation, Crypto::KeyGenerationOperationInstance {
   ECKeyGenOperation() { this.(Call).getTarget().getName() = "EC_KEY_generate_key" }
 
   override Expr getAlgorithmArg() { result = this.(Call).getArgument(0) }

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherInitializer.qll

@@ -1,117 +0,0 @@
-/**
- * see: https://docs.openssl.org/master/man3/EVP_EncryptInit/
- * Models cipher initialization for EVP cipher operations.
- */
-
-private import experimental.quantum.Language
-private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
-private import OpenSSLOperationBase
-
-module EncValToInitEncArgConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source.asExpr().getValue().toInt() in [0, 1] }
-
-  predicate isSink(DataFlow::Node sink) {
-    exists(EVP_Cipher_Initializer initCall | sink.asExpr() = initCall.getOperationSubtypeArg())
-  }
-}
-
-module EncValToInitEncArgFlow = DataFlow::Global<EncValToInitEncArgConfig>;
-
-int getEncConfigValue(Expr e) {
-  exists(EVP_Cipher_Initializer initCall | e = initCall.getOperationSubtypeArg()) and
-  exists(DataFlow::Node a, DataFlow::Node b |
-    EncValToInitEncArgFlow::flow(a, b) and b.asExpr() = e and result = a.asExpr().getValue().toInt()
-  )
-}
-
-bindingset[i]
-Crypto::KeyOperationSubtype intToCipherOperationSubtype(int i) {
-  if i = 0
-  then result instanceof Crypto::TEncryptMode
-  else
-    if i = 1
-    then result instanceof Crypto::TDecryptMode
-    else result instanceof Crypto::TUnknownKeyOperationMode
-}
-
-// TODO: need to add key consumer
-abstract class EVP_Cipher_Initializer extends EVPInitialize {
-  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
-
-  abstract Expr getOperationSubtypeArg();
-
-  override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
-    if this.(Call).getTarget().getName().toLowerCase().matches("%encrypt%")
-    then result instanceof Crypto::TEncryptMode
-    else
-      if this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%")
-      then result instanceof Crypto::TDecryptMode
-      else
-        if exists(getEncConfigValue(this.getOperationSubtypeArg()))
-        then result = intToCipherOperationSubtype(getEncConfigValue(this.getOperationSubtypeArg()))
-        else result instanceof Crypto::TUnknownKeyOperationMode
-  }
-}
-
-abstract class EVP_EX_Initializer extends EVP_Cipher_Initializer {
-  override Expr getKeyArg() { result = this.(Call).getArgument(3) }
-
-  override Expr getIVArg() { result = this.(Call).getArgument(4) }
-}
-
-abstract class EVP_EX2_Initializer extends EVP_Cipher_Initializer {
-  override Expr getKeyArg() { result = this.(Call).getArgument(2) }
-
-  override Expr getIVArg() { result = this.(Call).getArgument(3) }
-}
-
-class EVP_Cipher_EX_Init_Call extends EVP_EX_Initializer {
-  EVP_Cipher_EX_Init_Call() {
-    this.(Call).getTarget().getName() in [
-        "EVP_EncryptInit_ex", "EVP_DecryptInit_ex", "EVP_CipherInit_ex"
-      ]
-  }
-
-  override Expr getOperationSubtypeArg() {
-    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
-    result = this.(Call).getArgument(5)
-  }
-}
-
-class EVP_Cipher_EX2_or_Simple_Init_Call extends EVP_EX2_Initializer {
-  EVP_Cipher_EX2_or_Simple_Init_Call() {
-    this.(Call).getTarget().getName() in [
-        "EVP_EncryptInit_ex2", "EVP_DecryptInit_ex2", "EVP_CipherInit_ex2", "EVP_EncryptInit",
-        "EVP_DecryptInit", "EVP_CipherInit"
-      ]
-  }
-
-  override Expr getOperationSubtypeArg() {
-    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
-    result = this.(Call).getArgument(4)
-  }
-}
-
-class EVP_CipherInit_SKEY_Call extends EVP_EX2_Initializer {
-  EVP_CipherInit_SKEY_Call() { this.(Call).getTarget().getName() in ["EVP_CipherInit_SKEY"] }
-
-  override Expr getOperationSubtypeArg() { result = this.(Call).getArgument(5) }
-}
-
-class EVPCipherInitializerAlgorithmArgument extends Expr {
-  EVPCipherInitializerAlgorithmArgument() {
-    exists(EVP_Cipher_Initializer initCall | this = initCall.getAlgorithmArg())
-  }
-}
-
-class EVPCipherInitializerKeyArgument extends Expr {
-  EVPCipherInitializerKeyArgument() {
-    exists(EVP_Cipher_Initializer initCall | this = initCall.getKeyArg())
-  }
-}
-
-class EVPCipherInitializerIVArgument extends Expr {
-  EVPCipherInitializerIVArgument() {
-    exists(EVP_Cipher_Initializer initCall | this = initCall.getIVArg())
-  }
-}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPCipherOperation.qll

@@ -1,16 +1,90 @@
 private import experimental.quantum.Language
-private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
-private import EVPCipherInitializer
+private import experimental.quantum.OpenSSL.CtxFlow
 private import OpenSSLOperationBase
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
 
-class EVP_Cipher_Update_Call extends EVPUpdate {
-  EVP_Cipher_Update_Call() {
+// TODO: need to add key consumer
+abstract class Evp_Cipher_Initializer extends EvpKeyOperationSubtypeInitializer,
+  EvpPrimaryAlgorithmInitializer, EvpKeyInitializer, EvpIVInitializer
+{
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+}
+
+abstract class Evp_EX_Initializer extends Evp_Cipher_Initializer {
+  override Expr getKeyArg() {
+    // Null key indicates the key is not actually set
+    // This pattern can occur during a multi-step initialization
+    // TODO/Note: not flowing 0 to the sink, assuming a direct use of NULL for now
+    result = this.(Call).getArgument(3) and
+    (exists(result.getValue()) implies result.getValue().toInt() != 0)
+  }
+
+  override Expr getIVArg() {
+    // Null IV indicates the IV is not actually set
+    // This occurs given that setting the IV sometimes requires first setting the IV size.
+    // TODO/Note: not flowing 0 to the sink, assuming a direct use of NULL for now
+    result = this.(Call).getArgument(4) and
+    (exists(result.getValue()) implies result.getValue().toInt() != 0)
+  }
+}
+
+abstract class Evp_EX2_Initializer extends Evp_Cipher_Initializer {
+  override Expr getKeyArg() { result = this.(Call).getArgument(2) }
+
+  override Expr getIVArg() { result = this.(Call).getArgument(3) }
+}
+
+class EvpCipherEXInitCall extends Evp_EX_Initializer {
+  EvpCipherEXInitCall() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptInit_ex", "EVP_DecryptInit_ex", "EVP_CipherInit_ex"
+      ]
+  }
+
+  override Expr getKeyOperationSubtypeArg() {
+    // NOTE: for EncryptInit and DecryptInit there is no subtype arg
+    // the subtype is determined automatically by the initializer based on the operation name
+    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
+    result = this.(Call).getArgument(5)
+  }
+}
+
+//   if this.(Call).getTarget().getName().toLowerCase().matches("%encrypt%")
+//   then result instanceof Crypto::TEncryptMode
+//   else
+//     if this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%")
+//     then result instanceof Crypto::TDecryptMode
+class Evp_Cipher_EX2_or_Simple_Init_Call extends Evp_EX2_Initializer {
+  Evp_Cipher_EX2_or_Simple_Init_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_EncryptInit_ex2", "EVP_DecryptInit_ex2", "EVP_CipherInit_ex2", "EVP_EncryptInit",
+        "EVP_DecryptInit", "EVP_CipherInit"
+      ]
+  }
+
+  override Expr getKeyOperationSubtypeArg() {
+    this.(Call).getTarget().getName().toLowerCase().matches("%cipherinit%") and
+    result = this.(Call).getArgument(4)
+  }
+}
+
+class Evp_CipherInit_SKey_Call extends Evp_EX2_Initializer {
+  Evp_CipherInit_SKey_Call() { this.(Call).getTarget().getName() = "EVP_CipherInit_SKEY" }
+
+  override Expr getKeyOperationSubtypeArg() { result = this.(Call).getArgument(5) }
+}
+
+class Evp_Cipher_Update_Call extends EvpUpdate {
+  Evp_Cipher_Update_Call() {
     this.(Call).getTarget().getName() in [
         "EVP_EncryptUpdate", "EVP_DecryptUpdate", "EVP_CipherUpdate"
       ]
   }
 
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
   override Expr getInputArg() { result = this.(Call).getArgument(3) }
 
   override Expr getOutputArg() { result = this.(Call).getArgument(1) }
@@ -20,7 +94,7 @@ class EVP_Cipher_Update_Call extends EVPUpdate {
  * see: https://docs.openssl.org/master/man3/EVP_EncryptInit/#synopsis
  * Base configuration for all EVP cipher operations.
  */
-abstract class EVP_Cipher_Operation extends EVPOperation, Crypto::KeyOperationInstance {
+abstract class Evp_Cipher_Operation extends EvpOperation, Crypto::KeyOperationInstance {
   override Expr getOutputArg() { result = this.(Call).getArgument(1) }
 
   override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
@@ -30,36 +104,42 @@ abstract class EVP_Cipher_Operation extends EVPOperation, Crypto::KeyOperationIn
     result instanceof Crypto::TDecryptMode and
     this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%")
     or
-    result = this.getInitCall().getKeyOperationSubtype() and
+    result = this.getInitCall().(EvpKeyOperationSubtypeInitializer).getKeyOperationSubtype() and
     this.(Call).getTarget().getName().toLowerCase().matches("%cipher%")
   }
 
   override Crypto::ConsumerInputDataFlowNode getNonceConsumer() {
-    this.getInitCall().getIVArg() = result.asExpr()
+    this.getInitCall().(EvpIVInitializer).getIVArg() = result.asExpr()
   }
 
   override Crypto::ConsumerInputDataFlowNode getKeyConsumer() {
-    this.getInitCall().getKeyArg() = result.asExpr()
+    this.getInitCall().(EvpKeyInitializer).getKeyArg() = result.asExpr()
     // todo: or track to the EVP_PKEY_CTX_new
   }
 
   override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
-    result = EVPOperation.super.getOutputArtifact()
+    result = EvpOperation.super.getOutputArtifact()
   }
 
   override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
-    result = EVPOperation.super.getInputConsumer()
+    result = EvpOperation.super.getInputConsumer()
   }
 }
 
-class EVP_Cipher_Call extends EVPOperation, EVP_Cipher_Operation {
-  EVP_Cipher_Call() { this.(Call).getTarget().getName() = "EVP_Cipher" }
+class Evp_Cipher_Call extends EvpOperation, Evp_Cipher_Operation {
+  Evp_Cipher_Call() { this.(Call).getTarget().getName() = "EVP_Cipher" }
 
   override Expr getInputArg() { result = this.(Call).getArgument(2) }
+
+  override Expr getAlgorithmArg() {
+    result = this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg()
+  }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
 }
 
-class EVP_Cipher_Final_Call extends EVPFinal, EVP_Cipher_Operation {
-  EVP_Cipher_Final_Call() {
+class Evp_Cipher_Final_Call extends EvpFinal, Evp_Cipher_Operation {
+  Evp_Cipher_Final_Call() {
     this.(Call).getTarget().getName() in [
         "EVP_EncryptFinal_ex", "EVP_DecryptFinal_ex", "EVP_CipherFinal_ex", "EVP_EncryptFinal",
         "EVP_DecryptFinal", "EVP_CipherFinal"
@@ -70,8 +150,32 @@ class EVP_Cipher_Final_Call extends EVPFinal, EVP_Cipher_Operation {
    * Output is both from update calls and from the final call.
    */
   override Expr getOutputArg() {
-    result = EVPFinal.super.getOutputArg()
+    result = EvpFinal.super.getOutputArg()
     or
-    result = EVP_Cipher_Operation.super.getOutputArg()
+    result = Evp_Cipher_Operation.super.getOutputArg()
+  }
+
+  override Expr getAlgorithmArg() {
+    result = this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg()
+  }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+/**
+ * https://docs.openssl.org/3.2/man3/EVP_PKEY_decrypt/
+ * https://docs.openssl.org/3.2/man3/EVP_PKEY_encrypt
+ */
+class Evp_PKey_Cipher_Operation extends Evp_Cipher_Operation {
+  Evp_PKey_Cipher_Operation() {
+    this.(Call).getTarget().getName() in ["EVP_PKEY_encrypt", "EVP_PKEY_decrypt"]
+  }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(3) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
+  override Expr getAlgorithmArg() {
+    result = this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg()
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPHashInitializer.qll

@@ -1,14 +0,0 @@
-import cpp
-private import OpenSSLOperationBase
-
-abstract class EVP_Hash_Initializer extends EVPInitialize { }
-
-class EVP_DigestInit_Variant_Calls extends EVP_Hash_Initializer {
-  EVP_DigestInit_Variant_Calls() {
-    this.(Call).getTarget().getName() in [
-        "EVP_DigestInit", "EVP_DigestInit_ex", "EVP_DigestInit_ex2"
-      ]
-  }
-
-  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
-}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPHashOperation.qll

@@ -3,24 +3,37 @@
  */
 
 private import experimental.quantum.Language
-private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import experimental.quantum.OpenSSL.CtxFlow
 private import OpenSSLOperationBase
-private import EVPHashInitializer
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
 
-class EVP_Digest_Update_Call extends EVPUpdate {
-  EVP_Digest_Update_Call() { this.(Call).getTarget().getName() = "EVP_DigestUpdate" }
-
-  override Expr getInputArg() { result = this.(Call).getArgument(1) }
-}
-
-//https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
-class EVP_Q_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance {
-  EVP_Q_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
+class Evp_DigestInit_Variant_Calls extends EvpPrimaryAlgorithmInitializer {
+  Evp_DigestInit_Variant_Calls() {
+    this.(Call).getTarget().getName() in [
+        "EVP_DigestInit", "EVP_DigestInit_ex", "EVP_DigestInit_ex2"
+      ]
+  }
 
   override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
 
-  override EVP_Hash_Initializer getInitCall() {
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class Evp_Digest_Update_Call extends EvpUpdate {
+  Evp_Digest_Update_Call() { this.(Call).getTarget().getName() = "EVP_DigestUpdate" }
+
+  override Expr getInputArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+//https://docs.openssl.org/3.0/man3/EVP_DigestInit/#synopsis
+class Evp_Q_Digest_Operation extends EvpOperation, Crypto::HashOperationInstance {
+  Evp_Q_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Q_digest" }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+
+  override EvpInitializer getInitCall() {
     // This variant of digest does not use an init
     // and even if it were used, the init would be ignored/undefined
     none()
@@ -31,23 +44,25 @@ class EVP_Q_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance
   override Expr getOutputArg() { result = this.(Call).getArgument(5) }
 
   override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
-    result = EVPOperation.super.getOutputArtifact()
+    result = EvpOperation.super.getOutputArtifact()
   }
 
   override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
-    result = EVPOperation.super.getInputConsumer()
+    result = EvpOperation.super.getInputConsumer()
   }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
 }
 
-class EVP_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance {
-  EVP_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Digest" }
+class Evp_Digest_Operation extends EvpOperation, Crypto::HashOperationInstance {
+  Evp_Digest_Operation() { this.(Call).getTarget().getName() = "EVP_Digest" }
 
   // There is no context argument for this function
-  override Expr getContextArg() { none() }
+  override CtxPointerSource getContext() { none() }
 
   override Expr getAlgorithmArg() { result = this.(Call).getArgument(4) }
 
-  override EVP_Hash_Initializer getInitCall() {
+  override EvpPrimaryAlgorithmInitializer getInitCall() {
     // This variant of digest does not use an init
     // and even if it were used, the init would be ignored/undefined
     none()
@@ -58,28 +73,34 @@ class EVP_Digest_Operation extends EVPOperation, Crypto::HashOperationInstance {
   override Expr getOutputArg() { result = this.(Call).getArgument(2) }
 
   override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
-    result = EVPOperation.super.getOutputArtifact()
+    result = EvpOperation.super.getOutputArtifact()
   }
 
   override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
-    result = EVPOperation.super.getInputConsumer()
+    result = EvpOperation.super.getInputConsumer()
   }
 }
 
-class EVP_Digest_Final_Call extends EVPFinal, Crypto::HashOperationInstance {
-  EVP_Digest_Final_Call() {
+class Evp_Digest_Final_Call extends EvpFinal, Crypto::HashOperationInstance {
+  Evp_Digest_Final_Call() {
     this.(Call).getTarget().getName() in [
         "EVP_DigestFinal", "EVP_DigestFinal_ex", "EVP_DigestFinalXOF"
       ]
   }
 
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
   override Expr getOutputArg() { result = this.(Call).getArgument(1) }
 
   override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
-    result = EVPFinal.super.getOutputArtifact()
+    result = EvpFinal.super.getOutputArtifact()
   }
 
   override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
-    result = EVPFinal.super.getInputConsumer()
+    result = EvpFinal.super.getInputConsumer()
+  }
+
+  override Expr getAlgorithmArg() {
+    result = this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg()
   }
 }

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPKeyGenOperation.qll

@@ -0,0 +1,96 @@
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.CtxFlow
+private import OpenSSLOperationBase
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+
+class EvpKeyGenInitialize extends EvpPrimaryAlgorithmInitializer {
+  EvpKeyGenInitialize() {
+    this.(Call).getTarget().getName() in [
+        "EVP_PKEY_keygen_init",
+        "EVP_PKEY_paramgen_init"
+      ]
+  }
+
+  /**
+   * Gets the algorithm argument.
+   * In this case the algorithm is encoded through the context argument.
+   * The context may be directly created from an algorithm consumer,
+   * or from a new operation off of a prior key. Either way,
+   * we will treat this argument as the algorithm argument.
+   */
+  override Expr getAlgorithmArg() { result = this.getContext() }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpKeyGenOperation extends EvpOperation, Crypto::KeyGenerationOperationInstance {
+  DataFlow::Node keyResultNode;
+
+  EvpKeyGenOperation() {
+    this.(Call).getTarget().getName() in ["EVP_RSA_gen", "EVP_PKEY_Q_keygen"] and
+    keyResultNode.asExpr() = this
+    or
+    this.(Call).getTarget().getName() in ["EVP_PKEY_generate", "EVP_PKEY_keygen"] and
+    keyResultNode.asDefiningArgument() = this.(Call).getArgument(1)
+  }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
+  override Expr getAlgorithmArg() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_Q_keygen" and
+    result = this.(Call).getArgument(0)
+    or
+    result = this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg()
+  }
+
+  override Crypto::KeyArtifactType getOutputKeyType() { result = Crypto::TAsymmetricKeyType() }
+
+  override Expr getInputArg() { none() }
+
+  override Expr getOutputArg() { result = keyResultNode.asExpr() }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputKeyArtifact() { result = keyResultNode }
+
+  override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_Q_keygen" and
+    result = DataFlow::exprNode(this.(Call).getArgument(3)) and
+    // Arg 3 (0 based) is only a key size if the 'type' parameter is RSA, however,
+    // as a crude approximation, assume that if the type of the argument is not a derived type
+    // the argument must specify a key size (this is to avoid tracing if "rsa" is in the type parameter)
+    not this.(Call).getArgument(3).getType().getUnderlyingType() instanceof DerivedType
+    or
+    this.(Call).getTarget().getName() = "EVP_RSA_gen" and
+    result = DataFlow::exprNode(this.(Call).getArgument(0))
+    or
+    result = DataFlow::exprNode(this.getInitCall().(EvpKeySizeInitializer).getKeySizeArg())
+  }
+}
+
+/**
+ * A call to `EVP_PKEY_new_mac_key` that creatse a new generic MAC key.
+ * Signature: EVP_PKEY *EVP_PKEY_new_mac_key(int type, ENGINE *e, const unsigned char *key, int keylen);
+ */
+class EvpNewMacKey extends EvpOperation, Crypto::KeyGenerationOperationInstance {
+  DataFlow::Node keyResultNode;
+
+  EvpNewMacKey() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_new_mac_key" and keyResultNode.asExpr() = this
+  }
+
+  override CtxPointerSource getContext() { none() }
+
+  override Crypto::KeyArtifactType getOutputKeyType() { result = Crypto::TSymmetricKeyType() }
+
+  override Expr getOutputArg() { result = keyResultNode.asExpr() }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputKeyArtifact() { result = keyResultNode }
+
+  override Expr getInputArg() { none() }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(0) }
+
+  override Crypto::ConsumerInputDataFlowNode getKeySizeConsumer() {
+    result = DataFlow::exprNode(this.(Call).getArgument(3))
+  }
+}
+/// TODO: https://docs.openssl.org/3.0/man3/EVP_PKEY_new/#synopsis

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPPKeyCtxInitializer.qll

@@ -0,0 +1,119 @@
+/**
+ * Initializers for EVP PKey
+ * including:
+ *  https://docs.openssl.org/3.0/man3/EVP_PKEY_CTX_ctrl/
+ *  https://docs.openssl.org/3.0/man3/EVP_EncryptInit/#synopsis
+ */
+
+import cpp
+private import experimental.quantum.OpenSSL.CtxFlow
+private import OpenSSLOperations
+
+/**
+ * A call to `EVP_PKEY_CTX_new` or `EVP_PKEY_CTX_new_from_pkey`.
+ * These calls initialize the context from a prior key.
+ * The key may be generated previously, or merely had it's
+ * parameters set (e.g., `EVP_PKEY_paramgen`).
+ * NOTE: for the case of `EVP_PKEY_paramgen`, these calls
+ * are encoded as context passthroughs, and any operation
+ * will get all associated initializers for the paramgen
+ * at the final keygen operation automatically.
+ */
+class EvpNewKeyCtx extends EvpKeyInitializer {
+  Expr keyArg;
+
+  EvpNewKeyCtx() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new" and
+    keyArg = this.(Call).getArgument(0)
+    or
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_new_from_pkey" and
+    keyArg = this.(Call).getArgument(1)
+  }
+
+  /**
+   * Context is returned
+   */
+  override CtxPointerSource getContext() { result = this }
+
+  override Expr getKeyArg() { result = keyArg }
+}
+
+/**
+ * A call to "EVP_PKEY_CTX_set_ec_paramgen_curve_nid".
+ * Note that this is a primary algorithm as the pattenr is to specify an "EC" context,
+ * then set the specific curve later. Although the curve is set later, it is the primary
+ * algorithm intended for an operation.
+ */
+class EvpCtxSetPrimaryAlgorithmInitializer extends EvpPrimaryAlgorithmInitializer {
+  EvpCtxSetPrimaryAlgorithmInitializer() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_ec_paramgen_curve_nid"
+  }
+
+  override Expr getAlgorithmArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpCtxSetHashAlgorithmInitializer extends EvpHashAlgorithmInitializer {
+  EvpCtxSetHashAlgorithmInitializer() {
+    this.(Call).getTarget().getName() in [
+        "EVP_PKEY_CTX_set_signature_md", "EVP_PKEY_CTX_set_rsa_mgf1_md_name",
+        "EVP_PKEY_CTX_set_rsa_mgf1_md", "EVP_PKEY_CTX_set_rsa_oaep_md_name",
+        "EVP_PKEY_CTX_set_rsa_oaep_md", "EVP_PKEY_CTX_set_dsa_paramgen_md",
+        "EVP_PKEY_CTX_set_dh_kdf_md", "EVP_PKEY_CTX_set_ecdh_kdf_md"
+      ]
+  }
+
+  override Expr getHashAlgorithmArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpCtxSetKeySizeInitializer extends EvpKeySizeInitializer {
+  Expr arg;
+
+  EvpCtxSetKeySizeInitializer() {
+    this.(Call).getTarget().getName() in [
+        "EVP_PKEY_CTX_set_rsa_keygen_bits", "EVP_PKEY_CTX_set_dsa_paramgen_bits",
+        "EVP_CIPHER_CTX_set_key_length"
+      ] and
+    arg = this.(Call).getArgument(1)
+    or
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_mac_key" and
+    arg = this.(Call).getArgument(2)
+  }
+
+  override Expr getKeySizeArg() { result = arg }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpCtxSetKeyInitializer extends EvpKeyInitializer {
+  EvpCtxSetKeyInitializer() { this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_mac_key" }
+
+  override Expr getKeyArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpCtxSetPaddingInitializer extends EvpPaddingInitializer {
+  EvpCtxSetPaddingInitializer() {
+    this.(Call).getTarget().getName() in [
+        "EVP_PKEY_CTX_set_rsa_padding", "EVP_CIPHER_CTX_set_padding"
+      ]
+  }
+
+  override Expr getPaddingArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpCtxSetSaltLengthInitializer extends EvpSaltLengthInitializer {
+  EvpCtxSetSaltLengthInitializer() {
+    this.(Call).getTarget().getName() = "EVP_PKEY_CTX_set_rsa_pss_saltlen"
+  }
+
+  override Expr getSaltLengthArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/EVPSignatureOperation.qll

@@ -0,0 +1,200 @@
+/**
+ * Provides classes for modeling OpenSSL's EVP signature operations
+ */
+
+private import experimental.quantum.Language
+private import experimental.quantum.OpenSSL.AvcFlow
+private import experimental.quantum.OpenSSL.CtxFlow
+private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+private import experimental.quantum.OpenSSL.Operations.OpenSSLOperations
+
+// TODO: verification functions
+class EvpSignatureDigestInitializer extends EvpHashAlgorithmInitializer {
+  Expr arg;
+
+  EvpSignatureDigestInitializer() {
+    this.(Call).getTarget().getName() in ["EVP_DigestSignInit_ex", "EVP_DigestSignInit"] and
+    arg = this.(Call).getArgument(2)
+    or
+    this.(Call).getTarget().getName() in ["EVP_SignInit", "EVP_SignInit_ex"] and
+    arg = this.(Call).getArgument(1)
+  }
+
+  override Expr getHashAlgorithmArg() { result = arg }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpSignatureKeyInitializer extends EvpKeyInitializer {
+  Expr arg;
+
+  EvpSignatureKeyInitializer() {
+    this.(Call).getTarget().getName() = "EVP_DigestSignInit_ex" and
+    arg = this.(Call).getArgument(5)
+    or
+    this.(Call).getTarget().getName() = "EVP_DigestSignInit" and
+    arg = this.(Call).getArgument(4)
+  }
+
+  override Expr getKeyArg() { result = arg }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class EvpSignaturePrimaryAlgorithmInitializer extends EvpPrimaryAlgorithmInitializer {
+  Expr arg;
+
+  EvpSignaturePrimaryAlgorithmInitializer() {
+    // signature algorithm
+    this.(Call).getTarget().getName() in ["EVP_PKEY_sign_init_ex2", "EVP_PKEY_sign_message_init"] and
+    arg = this.(Call).getArgument(1)
+    or
+    // configuration through the context argument
+    this.(Call).getTarget().getName() in ["EVP_PKEY_sign_init", "EVP_PKEY_sign_init_ex"] and
+    arg = this.getContext()
+  }
+
+  override Expr getAlgorithmArg() { result = arg }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+class Evp_Signature_Update_Call extends EvpUpdate {
+  Evp_Signature_Update_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_DigestSignUpdate", "EVP_SignUpdate", "EVP_PKEY_sign_message_update"
+      ]
+  }
+
+  /**
+   * Input is the message to sign.
+   */
+  override Expr getInputArg() { result = this.(Call).getArgument(1) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+}
+
+/**
+ * We model output explicit output arguments as predicate to use it in constructors.
+ * The predicate must cover all EVP_Signature_Operation subclasses.
+ */
+pragma[inline]
+private Expr signatureOperationOutputArg(Call call) {
+  if call.getTarget().getName() = "EVP_SignFinal_ex"
+  then result = call.getArgument(2)
+  else result = call.getArgument(1)
+}
+
+/**
+ * The base configuration for all EVP signature operations.
+ */
+abstract class EvpSignatureOperation extends EvpOperation, Crypto::SignatureOperationInstance {
+  EvpSignatureOperation() {
+    this.(Call).getTarget().getName().matches("EVP_%") and
+    // NULL output argument means the call is to get the size of the signature and such call is not an operation
+    (
+      not exists(signatureOperationOutputArg(this).getValue())
+      or
+      signatureOperationOutputArg(this).getValue() != "0"
+    )
+  }
+
+  Expr getHashAlgorithmArg() {
+    this.getInitCall().(EvpHashAlgorithmInitializer).getHashAlgorithmArg() = result
+  }
+
+  override Expr getAlgorithmArg() {
+    this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg() = result
+  }
+
+  override Crypto::AlgorithmValueConsumer getHashAlgorithmValueConsumer() {
+    AvcToCallArgFlow::flow(result.(OpenSslAlgorithmValueConsumer).getResultNode(),
+      DataFlow::exprNode(this.getHashAlgorithmArg()))
+  }
+
+  /**
+   * Signing, verification or unknown.
+   */
+  override Crypto::KeyOperationSubtype getKeyOperationSubtype() {
+    // TODO: if this KeyOperationSubtype does not match initialization call's KeyOperationSubtype then we found a bug
+    if this.(Call).getTarget().getName().toLowerCase().matches("%sign%")
+    then result instanceof Crypto::TSignMode
+    else
+      if this.(Call).getTarget().getName().toLowerCase().matches("%verify%")
+      then result instanceof Crypto::TVerifyMode
+      else result instanceof Crypto::TUnknownKeyOperationMode
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getNonceConsumer() {
+    // TODO: some signing operations may have explicit nonce generators
+    none()
+  }
+
+  /**
+   * Keys provided in the initialization call or in a context are found by this method.
+   * Keys in explicit arguments are found by overridden methods in extending classes.
+   */
+  override Crypto::ConsumerInputDataFlowNode getKeyConsumer() {
+    result = DataFlow::exprNode(this.getInitCall().(EvpKeyInitializer).getKeyArg())
+  }
+
+  override Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
+    result = EvpOperation.super.getOutputArtifact()
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getInputConsumer() {
+    result = EvpOperation.super.getInputConsumer()
+  }
+
+  /**
+   * TODO: only signing operations for now, change when verificaiton is added
+   */
+  override Crypto::ConsumerInputDataFlowNode getSignatureConsumer() { none() }
+}
+
+class Evp_Signature_Call extends EvpSignatureOperation {
+  Evp_Signature_Call() { this.(Call).getTarget().getName() in ["EVP_DigestSign", "EVP_PKEY_sign"] }
+
+  /**
+   * Output is the signature.
+   */
+  override Expr getOutputArg() { result = signatureOperationOutputArg(this) }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
+  /**
+   * Input is the message to sign.
+   */
+  override Expr getInputArg() { result = this.(Call).getArgument(3) }
+}
+
+class Evp_Signature_Final_Call extends EvpFinal, EvpSignatureOperation {
+  Evp_Signature_Final_Call() {
+    this.(Call).getTarget().getName() in [
+        "EVP_DigestSignFinal",
+        "EVP_SignFinal_ex",
+        "EVP_SignFinal",
+        "EVP_PKEY_sign_message_final"
+      ]
+  }
+
+  override CtxPointerSource getContext() { result = this.(Call).getArgument(0) }
+
+  override Expr getAlgorithmArg() {
+    this.getInitCall().(EvpPrimaryAlgorithmInitializer).getAlgorithmArg() = result
+  }
+
+  override Crypto::ConsumerInputDataFlowNode getKeyConsumer() {
+    // key provided as an argument
+    this.(Call).getTarget().getName() in ["EVP_SignFinal", "EVP_SignFinal_ex"] and
+    result = DataFlow::exprNode(this.(Call).getArgument(3))
+    or
+    // or find key in the initialization call
+    result = EvpSignatureOperation.super.getKeyConsumer()
+  }
+
+  /**
+   * Output is the signature.
+   */
+  override Expr getOutputArg() { result = signatureOperationOutputArg(this) }
+}

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperationBase.qll

@@ -1,14 +1,51 @@
 private import experimental.quantum.Language
-private import experimental.quantum.OpenSSL.CtxFlow as CTXFlow
+private import experimental.quantum.OpenSSL.AvcFlow
+private import experimental.quantum.OpenSSL.CtxFlow
+private import experimental.quantum.OpenSSL.KeyFlow
 private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
+// Importing these intializers here to ensure the are part of any model that is
+// using OpenSslOperationBase. This further ensures that initializers are tied to opeartions
+// even if only importing the operation by itself.
+import EVPPKeyCtxInitializer
+
+module EncValToInitEncArgConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { source.asExpr().getValue().toInt() in [0, 1] }
+
+  predicate isSink(DataFlow::Node sink) {
+    exists(EvpKeyOperationSubtypeInitializer initCall |
+      sink.asExpr() = initCall.getKeyOperationSubtypeArg()
+    )
+  }
+}
+
+module EncValToInitEncArgFlow = DataFlow::Global<EncValToInitEncArgConfig>;
+
+private predicate argToAvc(Expr arg, Crypto::AlgorithmValueConsumer avc) {
+  // NOTE: because we trace through keys to their sources we must consider that the arg is an avc
+  // Consider this example:
+  //      EVP_PKEY *pkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, key, key_len);
+  // The key may trace into a signing operation. Tracing through the key we will get the arg taking `EVP_PKEY_HMAC`
+  // as the algorithm value consumer (the input node of the AVC). The output node of this AVC
+  // is the call return of `EVP_PKEY_new_mac_key`. If we trace from the AVC result to
+  // the input argument this will not be possible (from the return to the call argument is a backwards flow).
+  // Therefore, we must consider the input node of the AVC as the argument.
+  // This should only occur due to tracing through keys to find configuration data.
+  avc.getInputNode().asExpr() = arg
+  or
+  AvcToCallArgFlow::flow(avc.(OpenSslAlgorithmValueConsumer).getResultNode(),
+    DataFlow::exprNode(arg))
+}
 
 /**
- * A class for all OpenSSL operations.
+ * A class for all OpenSsl operations.
  */
-abstract class OpenSSLOperation extends Crypto::OperationInstance instanceof Call {
+abstract class OpenSslOperation extends Crypto::OperationInstance instanceof Call {
   /**
-   * Expression that specifies the algorithm for the operation.
-   * Will be an argument of the operation in the simplest case.
+   * Gets the argument that specifies the algorithm for the operation.
+   * This argument might not be immediately present at the specified operation.
+   * For example, it might be set in an initialization call.
+   * Modelers of the operation are resonsible for linking the operation to any
+   * initialization calls, and providing that argument as a returned value here.
    */
   abstract Expr getAlgorithmArg();
 
@@ -16,54 +53,191 @@ abstract class OpenSSLOperation extends Crypto::OperationInstance instanceof Cal
    * Algorithm is specified in initialization call or is implicitly established by the key.
    */
   override Crypto::AlgorithmValueConsumer getAnAlgorithmValueConsumer() {
-    AlgGetterToAlgConsumerFlow::flow(result.(OpenSSLAlgorithmValueConsumer).getResultNode(),
-      DataFlow::exprNode(this.getAlgorithmArg()))
+    argToAvc(this.getAlgorithmArg(), result)
   }
 }
 
 /**
- * A Call to initialization functions from the EVP API.
+ * A Call to an initialization function for an operation.
  * These are not operations in the sense of Crypto::OperationInstance,
  * but they are used to initialize the context for the operation.
+ * There may be multiple initialization calls for the same operation.
+ * Intended for use with EvPOperation.
  */
-abstract class EVPInitialize extends Call {
+abstract class EvpInitializer extends Call {
   /**
-   * Gets the context argument that ties together initialization, updates and/or final calls.
+   * Gets the context argument or return that ties together initialization, updates and/or final calls.
+   * The context is the context coming into the initializer and is the output as well.
+   * This is assumed to be the same argument.
    */
-  Expr getContextArg() { result = this.(Call).getArgument(0) }
-
-  /**
-   * Gets the type of key operation, none if not applicable.
-   */
-  Crypto::KeyOperationSubtype getKeyOperationSubtype() { none() }
-
-  /**
-   * Explicitly specified algorithm or none if implicit (e.g., established by the key).
-   * None if not applicable.
-   */
-  Expr getAlgorithmArg() { none() }
-
-  /**
-   * Gets the key for the operation, none if not applicable.
-   */
-  Expr getKeyArg() { none() }
-
-  /**
-   * Gets the IV/nonce, none if not applicable.
-   */
-  Expr getIVArg() { none() }
+  abstract CtxPointerSource getContext();
 }
 
 /**
- * A Call to update functions from the EVP API.
- * These are not operations in the sense of Crypto::OperationInstance,
- * but they are used to update the context for the operation.
+ * A call to initialize a key size.
  */
-abstract class EVPUpdate extends Call {
+abstract class EvpKeySizeInitializer extends EvpInitializer {
+  abstract Expr getKeySizeArg();
+}
+
+/**
+ * A call to initialize a key operation subtype.
+ */
+abstract class EvpKeyOperationSubtypeInitializer extends EvpInitializer {
+  abstract Expr getKeyOperationSubtypeArg();
+
+  private Crypto::KeyOperationSubtype intToCipherOperationSubtype(int i) {
+    i = 0 and
+    result instanceof Crypto::TEncryptMode
+    or
+    i = 1 and result instanceof Crypto::TDecryptMode
+  }
+
+  Crypto::KeyOperationSubtype getKeyOperationSubtype() {
+    exists(DataFlow::Node a, DataFlow::Node b |
+      EncValToInitEncArgFlow::flow(a, b) and
+      b.asExpr() = this.getKeyOperationSubtypeArg() and
+      result = this.intToCipherOperationSubtype(a.asExpr().getValue().toInt())
+    )
+    or
+    // Infer the subtype from the initialization call, and ignore the argument
+    this.(Call).getTarget().getName().toLowerCase().matches("%encrypt%") and
+    result instanceof Crypto::TEncryptMode
+    or
+    this.(Call).getTarget().getName().toLowerCase().matches("%decrypt%") and
+    result instanceof Crypto::TDecryptMode
+  }
+}
+
+/**
+ * An primary algorithm initializer initializes the primary algorithm for a given operation.
+ * For example, for a signing operation, the algorithm initializer may initialize algorithms
+ * like RSA. Other algorithsm may be initialized on an operation, as part of a larger
+ * operation/protocol. For example, hashing operations on signing operations; however,
+ * these are not the primary algorithm. Any other algorithms initialized on an operation
+ * require a specialized initializer, such as EvpHashAlgorithmInitializer.
+ */
+abstract class EvpPrimaryAlgorithmInitializer extends EvpInitializer {
+  abstract Expr getAlgorithmArg();
+
+  Crypto::AlgorithmValueConsumer getAlgorithmValueConsumer() {
+    argToAvc(this.getAlgorithmArg(), result)
+  }
+}
+
+/**
+ * A call to initialize a key.
+ */
+abstract class EvpKeyInitializer extends EvpInitializer {
+  abstract Expr getKeyArg();
+}
+
+/**
+ * A key initializer may initialize the algorithm and the key size through
+ * the key. Extend any instance of key initializer provide initialization
+ * of the algorithm and key size from the key.
+ */
+class EvpInitializerThroughKey extends EvpPrimaryAlgorithmInitializer, EvpKeySizeInitializer,
+  EvpKeyInitializer
+{
+  Expr arg;
+  CtxPointerSource context;
+
+  EvpInitializerThroughKey() {
+    exists(EvpKeyInitializer keyInit |
+      arg = keyInit.getKeyArg() and this = keyInit and context = keyInit.getContext()
+    )
+  }
+
+  override CtxPointerSource getContext() { result = context }
+
+  override Expr getAlgorithmArg() {
+    result =
+      getSourceKeyCreationInstanceFromArg(this.getKeyArg()).(OpenSslOperation).getAlgorithmArg()
+  }
+
+  override Expr getKeySizeArg() {
+    result = getSourceKeyCreationInstanceFromArg(this.getKeyArg()).getKeySizeConsumer().asExpr()
+  }
+
+  override Expr getKeyArg() { result = arg }
+}
+
+/**
+ * A default initializer for any key operation that accepts a key as input.
+ * A key initializer allows for a mechanic to go backwards to the key creation operation
+ * and find the algorithm and key size.
+ * If a user were to stipualte a key consumer for an operation but fail to indicate it as an
+ * initializer, automatic tracing to the creation operation would not occur.
+ * USERS SHOULD NOT NEED TO USE OR EXTEND THIS CLASS DIRECTLY.
+ *
+ * TODO: re-evaluate this approach
+ */
+class DefaultKeyInitializer extends EvpKeyInitializer instanceof Crypto::KeyOperationInstance {
+  Expr arg;
+
+  DefaultKeyInitializer() {
+    exists(Call c |
+      c.getAChild*() = arg and
+      arg = this.(Crypto::KeyOperationInstance).getKeyConsumer().asExpr() and
+      c = this
+    )
+  }
+
+  override Expr getKeyArg() { result = arg }
+
+  override CtxPointerSource getContext() { result = this.(EvpOperation).getContext() }
+}
+
+abstract class EvpIVInitializer extends EvpInitializer {
+  abstract Expr getIVArg();
+}
+
+/**
+ * A call to initialize padding.
+ */
+abstract class EvpPaddingInitializer extends EvpInitializer {
+  /**
+   * Gets the padding mode argument.
+   *  e.g., `EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING)` argument 1 (0-based)
+   */
+  abstract Expr getPaddingArg();
+}
+
+/**
+ * A call to initialize a salt length.
+ */
+abstract class EvpSaltLengthInitializer extends EvpInitializer {
+  /**
+   * Gets the salt length argument.
+   * e.g., `EVP_PKEY_CTX_set_scrypt_salt_len(ctx, 16)` argument 1 (0-based)
+   */
+  abstract Expr getSaltLengthArg();
+}
+
+/**
+ * A call to initialize a hash algorithm.
+ */
+abstract class EvpHashAlgorithmInitializer extends EvpInitializer {
+  abstract Expr getHashAlgorithmArg();
+
+  Crypto::AlgorithmValueConsumer getHashAlgorithmValueConsumer() {
+    argToAvc(this.getHashAlgorithmArg(), result)
+  }
+}
+
+/**
+ * A Call to an "update" function.
+ * These are not operations in the sense of Crypto::OperationInstance,
+ * but produce intermediate results for the operation that are later finalized
+ * (see EvpFinal).
+ * Intended for use with EvPOperation.
+ */
+abstract class EvpUpdate extends Call {
   /**
    * Gets the context argument that ties together initialization, updates and/or final calls.
    */
-  Expr getContextArg() { result = this.(Call).getArgument(0) }
+  abstract CtxPointerSource getContext();
 
   /**
    * Update calls always have some input data like plaintext or message digest.
@@ -76,31 +250,16 @@ abstract class EVPUpdate extends Call {
   Expr getOutputArg() { none() }
 }
 
-/**
- * Flows from algorithm values to operations, specific to OpenSSL
- */
-private module AlgGetterToAlgConsumerConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    exists(OpenSSLAlgorithmValueConsumer c | c.getResultNode() = source)
-  }
-
-  predicate isSink(DataFlow::Node sink) {
-    exists(EVPOperation c | c.getAlgorithmArg() = sink.asExpr())
-  }
-}
-
-private module AlgGetterToAlgConsumerFlow = DataFlow::Global<AlgGetterToAlgConsumerConfig>;
-
 /**
  * The base class for all operations of the EVP API.
  * This captures one-shot APIs (with and without an initilizer call) and final calls.
- * Provides some default methods for Crypto::KeyOperationInstance class
+ * Provides some default methods for Crypto::KeyOperationInstance class.
  */
-abstract class EVPOperation extends OpenSSLOperation {
+abstract class EvpOperation extends OpenSslOperation {
   /**
    * Gets the context argument that ties together initialization, updates and/or final calls.
    */
-  Expr getContextArg() { result = this.(Call).getArgument(0) }
+  abstract CtxPointerSource getContext();
 
   /**
    * Some input data like plaintext or message digest.
@@ -113,17 +272,10 @@ abstract class EVPOperation extends OpenSSLOperation {
    */
   abstract Expr getOutputArg();
 
-  /**
-   * Overwrite with an explicitly specified algorithm or leave base implementation to find it in the initialization call.
-   */
-  override Expr getAlgorithmArg() { result = this.getInitCall().getAlgorithmArg() }
-
   /**
    * Finds the initialization call, may be none.
    */
-  EVPInitialize getInitCall() {
-    CTXFlow::ctxArgFlowsToCtxArg(result.getContextArg(), this.getContextArg())
-  }
+  EvpInitializer getInitCall() { ctxSrcToSrcFlow(result.getContext(), this.getContext()) }
 
   Crypto::ArtifactOutputDataFlowNode getOutputArtifact() {
     result = DataFlow::exprNode(this.getOutputArg())
@@ -138,15 +290,17 @@ abstract class EVPOperation extends OpenSSLOperation {
 }
 
 /**
- * The final calls of the EVP API.
+ * An EVP final call,
+ * which is typicall used in an update/final pattern.
+ * Final operations are typically identified by "final" in the name,
+ * e.g., "EVP_DigestFinal", "EVP_EncryptFinal", etc.
+ * however, this is not a strict rule.
  */
-abstract class EVPFinal extends EVPOperation {
+abstract class EvpFinal extends EvpOperation {
   /**
    * All update calls that were executed before this final call.
    */
-  EVPUpdate getUpdateCalls() {
-    CTXFlow::ctxArgFlowsToCtxArg(result.getContextArg(), this.getContextArg())
-  }
+  EvpUpdate getUpdateCalls() { ctxSrcToSrcFlow(result.getContext(), this.getContext()) }
 
   /**
    * Gets the input data provided to all update calls.

cpp/ql/lib/experimental/quantum/OpenSSL/Operations/OpenSSLOperations.qll

@@ -2,3 +2,5 @@ import OpenSSLOperationBase
 import EVPCipherOperation
 import EVPHashOperation
 import ECKeyGenOperation
+import EVPSignatureOperation
+import EVPKeyGenOperation

cpp/ql/lib/experimental/quantum/OpenSSL/Random.qll

@@ -3,11 +3,10 @@ private import experimental.quantum.Language
 private import LibraryDetector
 private import semmle.code.cpp.dataflow.new.DataFlow
 
-class OpenSSLRandomNumberGeneratorInstance extends Crypto::RandomNumberGenerationInstance instanceof Call
+class OpenSslRandomNumberGeneratorInstance extends Crypto::RandomNumberGenerationInstance instanceof Call
 {
-  OpenSSLRandomNumberGeneratorInstance() {
-    this.(Call).getTarget().getName() in ["RAND_bytes", "RAND_pseudo_bytes"] and
-    isPossibleOpenSSLFunction(this.(Call).getTarget())
+  OpenSslRandomNumberGeneratorInstance() {
+    this.(Call).getTarget().getName() in ["RAND_bytes", "RAND_pseudo_bytes"]
   }
 
   override Crypto::DataFlowNode getOutputNode() {

cpp/ql/lib/experimental/semmle/code/cpp/security/PrivateCleartextWrite.qll

@@ -42,6 +42,8 @@ module PrivateCleartextWrite {
     predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
 
     predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
   }
 
   module WriteFlow = TaintTracking::Global<WriteConfig>;

cpp/ql/lib/ext/generated/brotli/brotli.model.yml

@@ -0,0 +1,480 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "", True, "AttachPreparedDictionary", "(CompoundDictionary *,const PreparedDictionary *)", "", "Argument[1]", "Argument[*0].Field[**chunk_source]", "taint", "dfc-generated"]
+      - ["", "", True, "AttachPreparedDictionary", "(CompoundDictionary *,const PreparedDictionary *)", "", "Argument[1]", "Argument[*0].Field[*chunk_source]", "taint", "dfc-generated"]
+      - ["", "", True, "AttachPreparedDictionary", "(CompoundDictionary *,const PreparedDictionary *)", "", "Argument[1]", "Argument[*0].Field[*chunks]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*0].Field[*total_count_]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[*4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[*4]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[*6]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[0]", "Argument[*0].Field[*index_left_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[0]", "Argument[*0].Field[*index_right_or_value_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[1]", "Argument[*0].Field[*total_count_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildAndStoreHuffmanTreeFast", "(HuffmanTree *,const uint32_t *,const size_t,const size_t,uint8_t *,uint16_t *,size_t *,uint8_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildCodeLengthsHuffmanTable", "(HuffmanCode *,const uint8_t *const,uint16_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*10]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*2].Field[**types]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*2].Field[*types]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*3].Field[**types]", "Argument[*12]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*3].Field[*types]", "Argument[*12]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*4].Field[**types]", "Argument[*13]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*4].Field[*types]", "Argument[*13]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*5]", "Argument[*11].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[*5]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[10]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[11]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[12]", "Argument[*12]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[13]", "Argument[*13]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[5]", "Argument[*11].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[5]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[6]", "Argument[*11].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[6]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[7]", "Argument[*11].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[7]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[8]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHistogramsWithContext", "(const Command *,const size_t,const BlockSplit *,const BlockSplit *,const BlockSplit *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,const ContextType *,HistogramLiteral *,HistogramCommand *,HistogramDistance *)", "", "Argument[9]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHuffmanTable", "(HuffmanCode *,int,const uint16_t *const,uint16_t *)", "", "Argument[*2]", "Argument[*0].Field[*value]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHuffmanTable", "(HuffmanCode *,int,const uint16_t *const,uint16_t *)", "", "Argument[0]", "Argument[*0].Field[*value]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHuffmanTable", "(HuffmanCode *,int,const uint16_t *const,uint16_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHuffmanTable", "(HuffmanCode *,int,const uint16_t *const,uint16_t *)", "", "Argument[2]", "Argument[*0].Field[*value]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildHuffmanTable", "(HuffmanCode *,int,const uint16_t *const,uint16_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[*1]", "Argument[*10].Field[**literal_histograms].Field[*bit_cost_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[*1]", "Argument[*10].Field[**literal_histograms].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[*1]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[1]", "Argument[*10].Field[**literal_histograms].Field[*bit_cost_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[1]", "Argument[*10].Field[**literal_histograms].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[1]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[2]", "Argument[*10].Field[**literal_histograms].Field[*bit_cost_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[2]", "Argument[*10].Field[**literal_histograms].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[2]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[3]", "Argument[*10].Field[**literal_histograms].Field[*bit_cost_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[3]", "Argument[*10].Field[**literal_histograms].Field[*data_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[3]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[5]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[6]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[8]", "Argument[*10].Field[*command_split].Field[**lengths]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlock", "(MemoryManager *,const uint8_t *,const size_t,const size_t,BrotliEncoderParams *,uint8_t,uint8_t,Command *,size_t,ContextType,MetaBlockSplit *)", "", "Argument[9]", "Argument[*10].Field[**literal_histograms]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlockGreedy", "(MemoryManager *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,ContextLut,size_t,const uint32_t *,const Command *,size_t,MetaBlockSplit *)", "", "Argument[*8]", "Argument[*11].Field[**literal_context_map]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlockGreedy", "(MemoryManager *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,ContextLut,size_t,const uint32_t *,const Command *,size_t,MetaBlockSplit *)", "", "Argument[7]", "Argument[*11].Field[**literal_context_map]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlockGreedy", "(MemoryManager *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,ContextLut,size_t,const uint32_t *,const Command *,size_t,MetaBlockSplit *)", "", "Argument[7]", "Argument[*11].Field[*literal_histograms_size]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildMetaBlockGreedy", "(MemoryManager *,const uint8_t *,size_t,size_t,uint8_t,uint8_t,ContextLut,size_t,const uint32_t *,const Command *,size_t,MetaBlockSplit *)", "", "Argument[8]", "Argument[*11].Field[**literal_context_map]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildSimpleHuffmanTable", "(HuffmanCode *,int,uint16_t *,uint32_t)", "", "Argument[*2]", "Argument[*0].Field[*value]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliBuildSimpleHuffmanTable", "(HuffmanCode *,int,uint16_t *,uint32_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildSimpleHuffmanTable", "(HuffmanCode *,int,uint16_t *,uint32_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildSimpleHuffmanTable", "(HuffmanCode *,int,uint16_t *,uint32_t)", "", "Argument[2]", "Argument[*0].Field[*value]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliBuildSimpleHuffmanTable", "(HuffmanCode *,int,uint16_t *,uint32_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[*1]", "Argument[*4]", "value", "df-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsCommand", "(MemoryManager *,const HistogramCommand *,const size_t,size_t,HistogramCommand *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[*1]", "Argument[*4]", "value", "df-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsDistance", "(MemoryManager *,const HistogramDistance *,const size_t,size_t,HistogramDistance *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[*1]", "Argument[*4]", "value", "df-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[1]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliClusterHistogramsLiteral", "(MemoryManager *,const HistogramLiteral *,const size_t,size_t,HistogramLiteral *,size_t *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueCommand", "(const HistogramCommand *,HistogramCommand *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueDistance", "(const HistogramDistance *,HistogramDistance *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[*2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[2]", "Argument[*6].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompareAndPushToQueueLiteral", "(const HistogramLiteral *,HistogramLiteral *,const uint32_t *,uint32_t,uint32_t,size_t,HistogramPair *,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentFast", "(BrotliOnePassArena *,const uint8_t *,size_t,int,int *,size_t,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*7]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompressFragmentFast", "(BrotliOnePassArena *,const uint8_t *,size_t,int,int *,size_t,size_t *,uint8_t *)", "", "Argument[*6]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentFast", "(BrotliOnePassArena *,const uint8_t *,size_t,int,int *,size_t,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentFast", "(BrotliOnePassArena *,const uint8_t *,size_t,int,int *,size_t,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentFast", "(BrotliOnePassArena *,const uint8_t *,size_t,int,int *,size_t,size_t *,uint8_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*5]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*9]", "value", "df-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[*6]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[*8]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[8]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[8]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCompressFragmentTwoPass", "(BrotliTwoPassArena *,const uint8_t *,size_t,int,uint32_t *,uint8_t *,int *,size_t,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliConvertBitDepthsToSymbols", "(const uint8_t *,size_t,uint16_t *)", "", "Argument[*0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliConvertBitDepthsToSymbols", "(const uint8_t *,size_t,uint16_t *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[*7]", "Argument[*9].Field[*dist_extra_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[*7]", "Argument[*9].Field[*dist_prefix_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[0]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[0]", "Argument[*9].Field[*cmd_prefix_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[0]", "Argument[*9].Field[*copy_len_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[10]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[11]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[1]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[1]", "Argument[*9].Field[*cmd_prefix_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[1]", "Argument[*9].Field[*copy_len_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[7]", "Argument[*9].Field[*dist_extra_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[7]", "Argument[*9].Field[*dist_prefix_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[9]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateBackwardReferences", "(size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[9]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHqZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[10]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHqZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[11]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHqZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[12]", "Argument[*12]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHqZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[8]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHuffmanTree", "(const uint32_t *,const size_t,const int,HuffmanTree *,uint8_t *)", "", "Argument[*0]", "Argument[*3].Field[*total_count_]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHuffmanTree", "(const uint32_t *,const size_t,const int,HuffmanTree *,uint8_t *)", "", "Argument[0]", "Argument[*3].Field[*total_count_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHuffmanTree", "(const uint32_t *,const size_t,const int,HuffmanTree *,uint8_t *)", "", "Argument[1]", "Argument[*3].Field[*index_right_or_value_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHuffmanTree", "(const uint32_t *,const size_t,const int,HuffmanTree *,uint8_t *)", "", "Argument[1]", "Argument[*3].Field[*total_count_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateHuffmanTree", "(const uint32_t *,const size_t,const int,HuffmanTree *,uint8_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateManagedDictionary", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**2]", "ReturnValue[*].Field[*memory_manager_].Field[***opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateManagedDictionary", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[*memory_manager_].Field[**opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateManagedDictionary", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[0]", "ReturnValue[*].Field[*memory_manager_].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateManagedDictionary", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[*memory_manager_].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateManagedDictionary", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[*memory_manager_].Field[*opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliCreateZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[10]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[11]", "Argument[*11]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[12]", "Argument[*12]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[1]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliCreateZopfliBackwardReferences", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,Hasher *,int *,size_t *,Command *,size_t *,size_t *)", "", "Argument[8]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderAttachDictionary", "(BrotliDecoderState *,BrotliDecoderStateInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[*3]", "Argument[*0].Field[**dictionary].Field[**prefix]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderAttachDictionary", "(BrotliDecoderState *,BrotliDecoderStateInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[2]", "Argument[*0].Field[**dictionary].Field[*prefix_size]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderAttachDictionary", "(BrotliDecoderState *,BrotliDecoderStateInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[3]", "Argument[*0].Field[**dictionary].Field[*prefix]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**2]", "ReturnValue[*].Field[***memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**2]", "ReturnValue[*].Field[**dictionary].Field[***memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[**dictionary].Field[**memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[**memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[0]", "ReturnValue[*].Field[**dictionary].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[0]", "ReturnValue[*].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[**dictionary].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[**dictionary].Field[*memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[*memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompress", "(size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[*1]", "Argument[*0].Field[*used_input]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[*2]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[*4]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[1]", "Argument[*0].Field[*used_input]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[4]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderDecompressStream", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderGetErrorCode", "(const BrotliDecoderState *,const BrotliDecoderStateInternal *)", "", "Argument[*0].Field[*error_code]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderHuffmanTreeGroupInit", "(BrotliDecoderStateInternal *,HuffmanTreeGroup *,uint64_t,uint64_t,uint64_t)", "", "Argument[2]", "Argument[*1].Field[*alphabet_size_max]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderHuffmanTreeGroupInit", "(BrotliDecoderStateInternal *,HuffmanTreeGroup *,uint64_t,uint64_t,uint64_t)", "", "Argument[3]", "Argument[*1].Field[*alphabet_size_limit]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderHuffmanTreeGroupInit", "(BrotliDecoderStateInternal *,HuffmanTreeGroup *,uint64_t,uint64_t,uint64_t)", "", "Argument[4]", "Argument[*1].Field[**codes]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderHuffmanTreeGroupInit", "(BrotliDecoderStateInternal *,HuffmanTreeGroup *,uint64_t,uint64_t,uint64_t)", "", "Argument[4]", "Argument[*1].Field[*codes]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderHuffmanTreeGroupInit", "(BrotliDecoderStateInternal *,HuffmanTreeGroup *,uint64_t,uint64_t,uint64_t)", "", "Argument[4]", "Argument[*1].Field[*num_htrees]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderSetMetadataCallbacks", "(BrotliDecoderState *,BrotliDecoderStateInternal *,brotli_decoder_metadata_start_func,brotli_decoder_metadata_chunk_func,void *)", "", "Argument[**3]", "Argument[*0].Field[***metadata_callback_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderSetMetadataCallbacks", "(BrotliDecoderState *,BrotliDecoderStateInternal *,brotli_decoder_metadata_start_func,brotli_decoder_metadata_chunk_func,void *)", "", "Argument[*3]", "Argument[*0].Field[**metadata_callback_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderSetMetadataCallbacks", "(BrotliDecoderState *,BrotliDecoderStateInternal *,brotli_decoder_metadata_start_func,brotli_decoder_metadata_chunk_func,void *)", "", "Argument[1]", "Argument[*0].Field[*metadata_start_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderSetMetadataCallbacks", "(BrotliDecoderState *,BrotliDecoderStateInternal *,brotli_decoder_metadata_start_func,brotli_decoder_metadata_chunk_func,void *)", "", "Argument[2]", "Argument[*0].Field[*metadata_chunk_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderSetMetadataCallbacks", "(BrotliDecoderState *,BrotliDecoderStateInternal *,brotli_decoder_metadata_start_func,brotli_decoder_metadata_chunk_func,void *)", "", "Argument[3]", "Argument[*0].Field[*metadata_callback_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**3]", "Argument[*0].Field[***memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**3]", "Argument[*0].Field[**dictionary].Field[***memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*3]", "Argument[*0].Field[**dictionary].Field[**memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*3]", "Argument[*0].Field[**memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "Argument[*0].Field[**dictionary].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "Argument[*0].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "Argument[*0].Field[**dictionary].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "Argument[*0].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[3]", "Argument[*0].Field[**dictionary].Field[*memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderStateInit", "(BrotliDecoderStateInternal *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[3]", "Argument[*0].Field[*memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[*1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliDecoderTakeOutput", "(BrotliDecoderState *,BrotliDecoderStateInternal *,size_t *)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderAttachPreparedDictionary", "(BrotliEncoderState *,BrotliEncoderStateInternal *,const BrotliEncoderPreparedDictionary *)", "", "Argument[*1].Field[**dictionary]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderAttachPreparedDictionary", "(BrotliEncoderState *,BrotliEncoderStateInternal *,const BrotliEncoderPreparedDictionary *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*4]", "Argument[*6]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*5]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[*5]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[3]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[3]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[3]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[4]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[5]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[5]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompress", "(int,int,BrotliEncoderMode,size_t,const uint8_t[],size_t *,uint8_t[])", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompressStream", "(BrotliEncoderState *,BrotliEncoderStateInternal *,BrotliEncoderOperation,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[**3]", "Argument[**5]", "value", "df-generated"]
+      - ["", "", True, "BrotliEncoderCompressStream", "(BrotliEncoderState *,BrotliEncoderStateInternal *,BrotliEncoderOperation,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[**5]", "Argument[*0].Field[**next_out_]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCompressStream", "(BrotliEncoderState *,BrotliEncoderStateInternal *,BrotliEncoderOperation,size_t *,const uint8_t **,size_t *,uint8_t **,size_t *)", "", "Argument[**5]", "Argument[*0].Field[*last_bytes_]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**2]", "ReturnValue[*].Field[*memory_manager_].Field[***opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[*memory_manager_].Field[**opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[0]", "ReturnValue[*].Field[*memory_manager_].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[*memory_manager_].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[*memory_manager_].Field[*opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderEstimatePeakMemoryUsage", "(int,int,size_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderEstimatePeakMemoryUsage", "(int,int,size_t)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderGetPreparedDictionarySize", "(const BrotliEncoderPreparedDictionary *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderGetPreparedDictionarySize", "(const BrotliEncoderPreparedDictionary *)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderMaxCompressedSize", "(size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**6]", "ReturnValue[*].Field[*memory_manager_].Field[***opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[**dictionary].Field[*num_items]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*6]", "ReturnValue[*].Field[*memory_manager_].Field[**opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[**dictionary].Field[*source_size]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[**dictionary].Field[*num_items]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[4]", "ReturnValue[*].Field[*memory_manager_].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[5]", "ReturnValue[*].Field[*memory_manager_].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderPrepareDictionary", "(BrotliSharedDictionaryType,size_t,const uint8_t[],int,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[6]", "ReturnValue[*].Field[*memory_manager_].Field[*opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliEncoderSetParameter", "(BrotliEncoderState *,BrotliEncoderStateInternal *,BrotliEncoderParameter,uint32_t)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEncoderTakeOutput", "(BrotliEncoderState *,BrotliEncoderStateInternal *,size_t *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[*3]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[*3]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[*4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[0]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[0]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[1]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[2]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[3]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[3]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliEstimateBitCostsForLiterals", "(size_t,size_t,size_t,const uint8_t *,size_t *,float *)", "", "Argument[4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliFindAllStaticDictionaryMatches", "(const BrotliEncoderDictionary *,const uint8_t *,size_t,size_t,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliFindAllStaticDictionaryMatches", "(const BrotliEncoderDictionary *,const uint8_t *,size_t,size_t,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceCommand", "(const HistogramCommand *,const HistogramCommand *,HistogramCommand *)", "", "Argument[*0]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceCommand", "(const HistogramCommand *,const HistogramCommand *,HistogramCommand *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceCommand", "(const HistogramCommand *,const HistogramCommand *,HistogramCommand *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceDistance", "(const HistogramDistance *,const HistogramDistance *,HistogramDistance *)", "", "Argument[*0]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceDistance", "(const HistogramDistance *,const HistogramDistance *,HistogramDistance *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceDistance", "(const HistogramDistance *,const HistogramDistance *,HistogramDistance *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceLiteral", "(const HistogramLiteral *,const HistogramLiteral *,HistogramLiteral *)", "", "Argument[*0]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceLiteral", "(const HistogramLiteral *,const HistogramLiteral *,HistogramLiteral *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramBitCostDistanceLiteral", "(const HistogramLiteral *,const HistogramLiteral *,HistogramLiteral *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*4]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineCommand", "(HistogramCommand *,HistogramCommand *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[6]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*4]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineDistance", "(HistogramDistance *,HistogramDistance *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[6]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[*4]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[2]", "Argument[*5].Field[*cost_diff]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramCombineLiteral", "(HistogramLiteral *,HistogramLiteral *,uint32_t *,uint32_t *,uint32_t *,HistogramPair *,size_t,size_t,size_t,size_t)", "", "Argument[6]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexCommand", "(MemoryManager *,HistogramCommand *,uint32_t *,size_t)", "", "Argument[*2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexCommand", "(MemoryManager *,HistogramCommand *,uint32_t *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexCommand", "(MemoryManager *,HistogramCommand *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexCommand", "(MemoryManager *,HistogramCommand *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexDistance", "(MemoryManager *,HistogramDistance *,uint32_t *,size_t)", "", "Argument[*2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexDistance", "(MemoryManager *,HistogramDistance *,uint32_t *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexDistance", "(MemoryManager *,HistogramDistance *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexDistance", "(MemoryManager *,HistogramDistance *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexLiteral", "(MemoryManager *,HistogramLiteral *,uint32_t *,size_t)", "", "Argument[*2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexLiteral", "(MemoryManager *,HistogramLiteral *,uint32_t *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexLiteral", "(MemoryManager *,HistogramLiteral *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramReindexLiteral", "(MemoryManager *,HistogramLiteral *,uint32_t *,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[*0]", "Argument[*5]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[*2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[*2]", "Argument[*6]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[0]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapCommand", "(const HistogramCommand *,size_t,const uint32_t *,size_t,HistogramCommand *,HistogramCommand *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[*0]", "Argument[*5]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[*2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[*2]", "Argument[*6]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[0]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapDistance", "(const HistogramDistance *,size_t,const uint32_t *,size_t,HistogramDistance *,HistogramDistance *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[*0]", "Argument[*5]", "value", "df-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[*2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[*2]", "Argument[*6]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[*6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[0]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[6]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliHistogramRemapLiteral", "(const HistogramLiteral *,size_t,const uint32_t *,size_t,HistogramLiteral *,HistogramLiteral *,uint32_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliInitDistanceParams", "(BrotliDistanceParams *,uint32_t,uint32_t,int)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliInitDistanceParams", "(BrotliDistanceParams *,uint32_t,uint32_t,int)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "BrotliInitMemoryManager", "(MemoryManager *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**3]", "Argument[*0].Field[***opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliInitMemoryManager", "(MemoryManager *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*3]", "Argument[*0].Field[**opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliInitMemoryManager", "(MemoryManager *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "Argument[*0].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliInitMemoryManager", "(MemoryManager *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "Argument[*0].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliInitMemoryManager", "(MemoryManager *,brotli_alloc_func,brotli_free_func,void *)", "", "Argument[3]", "Argument[*0].Field[*opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliInitSharedEncoderDictionary", "(SharedEncoderDictionary *)", "", "Argument[*0].Field[*contextual].Field[*instance_]", "Argument[*0].Field[*contextual].Field[**dict]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliOptimizeHuffmanCountsForRle", "(size_t,uint32_t *,uint8_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostCommand", "(const HistogramCommand *)", "", "Argument[*0].Field[*data_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostCommand", "(const HistogramCommand *)", "", "Argument[*0].Field[*total_count_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostDistance", "(const HistogramDistance *)", "", "Argument[*0].Field[*data_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostDistance", "(const HistogramDistance *)", "", "Argument[*0].Field[*total_count_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostLiteral", "(const HistogramLiteral *)", "", "Argument[*0].Field[*data_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliPopulationCostLiteral", "(const HistogramLiteral *)", "", "Argument[*0].Field[*total_count_]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSafeReadBits32Slow", "(BrotliBitReader *const,uint64_t,uint64_t *)", "", "Argument[1]", "Argument[*0].Field[*bit_pos_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSafeReadBits32Slow", "(BrotliBitReader *const,uint64_t,uint64_t *)", "", "Argument[1]", "Argument[*0].Field[*val_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSafeReadBits32Slow", "(BrotliBitReader *const,uint64_t,uint64_t *)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryAttach", "(BrotliSharedDictionaryInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[*3]", "Argument[*0].Field[**prefix]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryAttach", "(BrotliSharedDictionaryInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[2]", "Argument[*0].Field[*prefix_size]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryAttach", "(BrotliSharedDictionaryInternal *,BrotliSharedDictionaryType,size_t,const uint8_t[])", "", "Argument[3]", "Argument[*0].Field[*prefix]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[**2]", "ReturnValue[*].Field[***memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[*2]", "ReturnValue[*].Field[**memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[0]", "ReturnValue[*].Field[*alloc_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[1]", "ReturnValue[*].Field[*free_func]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSharedDictionaryCreateInstance", "(brotli_alloc_func,brotli_free_func,void *)", "", "Argument[2]", "ReturnValue[*].Field[*memory_manager_opaque]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliSplitBlock", "(MemoryManager *,const Command *,const size_t,const uint8_t *,const size_t,const size_t,const BrotliEncoderParams *,BlockSplit *,BlockSplit *,BlockSplit *)", "", "Argument[*1].Field[*insert_len_]", "Argument[*7].Field[**lengths]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSplitBlock", "(MemoryManager *,const Command *,const size_t,const uint8_t *,const size_t,const size_t,const BrotliEncoderParams *,BlockSplit *,BlockSplit *,BlockSplit *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliSplitBlock", "(MemoryManager *,const Command *,const size_t,const uint8_t *,const size_t,const size_t,const BrotliEncoderParams *,BlockSplit *,BlockSplit *,BlockSplit *)", "", "Argument[2]", "Argument[*8].Field[**lengths]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[*0]", "Argument[*2].Field[*total_count_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[*0]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[*3]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[0]", "Argument[*2].Field[*total_count_]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[0]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[3]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreHuffmanTree", "(const uint8_t *,size_t,HuffmanTree *,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[*13]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[13]", "Argument[*13]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[13]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[14]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[1]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[2]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[3]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[5]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[6]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[7]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlock", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,uint8_t,uint8_t,int,const BrotliEncoderParams *,ContextType,const Command *,size_t,const MetaBlockSplit *,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*14]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[*9]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[10]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[1]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[2]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[3]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[5]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockFast", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[*1]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[*9]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[10]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[1]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[2]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[3]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[4]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[5]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*10]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreMetaBlockTrivial", "(MemoryManager *,const uint8_t *,size_t,size_t,size_t,int,const BrotliEncoderParams *,const Command *,size_t,size_t *,uint8_t *)", "", "Argument[9]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[*1]", "Argument[*6]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[*5]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[1]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[2]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[2]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[3]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[3]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[4]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[4]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[5]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliStoreUncompressedMetaBlock", "(int,const uint8_t *__restrict__,size_t,size_t,size_t,size_t *__restrict__,uint8_t *__restrict__)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliTransformDictionaryWord", "(uint8_t *,const uint8_t *,int,const BrotliTransforms *,int)", "", "Argument[*1]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliTransformDictionaryWord", "(uint8_t *,const uint8_t *,int,const BrotliTransforms *,int)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliTransformDictionaryWord", "(uint8_t *,const uint8_t *,int,const BrotliTransforms *,int)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliTransformDictionaryWord", "(uint8_t *,const uint8_t *,int,const BrotliTransforms *,int)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliTransformDictionaryWord", "(uint8_t *,const uint8_t *,int,const BrotliTransforms *,int)", "", "Argument[4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[*0]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[*2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[*2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[0]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[2]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliWriteHuffmanTree", "(const uint8_t *,size_t,size_t *,uint8_t *,uint8_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliComputeShortestPath", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,const int *,Hasher *,ZopfliNode *)", "", "Argument[1]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliComputeShortestPath", "(MemoryManager *,size_t,size_t,const uint8_t *,size_t,ContextLut,const BrotliEncoderParams *,const int *,Hasher *,ZopfliNode *)", "", "Argument[9]", "Argument[*9]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliCreateCommands", "(const size_t,const size_t,const ZopfliNode *,int *,size_t *,const BrotliEncoderParams *,Command *,size_t *)", "", "Argument[0]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliCreateCommands", "(const size_t,const size_t,const ZopfliNode *,int *,size_t *,const BrotliEncoderParams *,Command *,size_t *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliCreateCommands", "(const size_t,const size_t,const ZopfliNode *,int *,size_t *,const BrotliEncoderParams *,Command *,size_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliCreateCommands", "(const size_t,const size_t,const ZopfliNode *,int *,size_t *,const BrotliEncoderParams *,Command *,size_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "BrotliZopfliCreateCommands", "(const size_t,const size_t,const ZopfliNode *,int *,size_t *,const BrotliEncoderParams *,Command *,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "CreatePreparedDictionary", "(MemoryManager *,const uint8_t *,size_t)", "", "Argument[*1]", "ReturnValue[*].Field[*num_items]", "taint", "dfc-generated"]
+      - ["", "", True, "CreatePreparedDictionary", "(MemoryManager *,const uint8_t *,size_t)", "", "Argument[1]", "ReturnValue[*].Field[*num_items]", "taint", "dfc-generated"]
+      - ["", "", True, "CreatePreparedDictionary", "(MemoryManager *,const uint8_t *,size_t)", "", "Argument[2]", "ReturnValue[*].Field[*source_size]", "value", "dfc-generated"]

cpp/ql/lib/ext/generated/curl/curl.model.yml

@@ -0,0 +1,959 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "", True, "Curl_GetFTPResponse", "(Curl_easy *,ssize_t *,int *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_GetFTPResponse", "(Curl_easy *,ssize_t *,int *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_HMAC_final", "(HMAC_context *,unsigned char *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_HMAC_init", "(const HMAC_params *,const unsigned char *,unsigned int)", "", "Argument[0]", "ReturnValue[*].Field[**hashctxt1].Field[*hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_HMAC_init", "(const HMAC_params *,const unsigned char *,unsigned int)", "", "Argument[0]", "ReturnValue[*].Field[**hashctxt2].Field[*hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_HMAC_init", "(const HMAC_params *,const unsigned char *,unsigned int)", "", "Argument[0]", "ReturnValue[*].Field[*hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_MD5_init", "(const MD5_params *)", "", "Argument[*0]", "ReturnValue[*].Field[**md5_hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_MD5_init", "(const MD5_params *)", "", "Argument[0]", "ReturnValue[*].Field[*md5_hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_add_custom_headers", "(Curl_easy *,bool,dynbuf *)", "", "Argument[*2].Field[*allc]", "Argument[*2].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_addrinfo_callback", "(Curl_easy *,int,Curl_addrinfo *)", "", "Argument[*2]", "Argument[2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_addrinfo_callback", "(Curl_easy *,int,Curl_addrinfo *)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_alpn_set_negotiated", "(Curl_cfilter *,Curl_easy *,ssl_connect_data *,const unsigned char *,size_t)", "", "Argument[*3]", "Argument[*2].Field[*negotiated].Field[**alpn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_alpn_set_negotiated", "(Curl_cfilter *,Curl_easy *,ssl_connect_data *,const unsigned char *,size_t)", "", "Argument[3]", "Argument[*2].Field[*negotiated].Field[**alpn]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_alpn_to_proto_buf", "(alpn_proto_buf *,const alpn_spec *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_alpn_to_proto_str", "(alpn_proto_buf *,const alpn_spec *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_altsvc_cleanup", "(altsvcinfo **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_altsvc_ctrl", "(altsvcinfo *,const long)", "", "Argument[1]", "Argument[*0].Field[*flags]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_altsvc_parse", "(Curl_easy *,altsvcinfo *,const char *,alpnid,const char *,unsigned short)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_attach_connection", "(Curl_easy *,connectdata *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_attach_connection", "(Curl_easy *,connectdata *)", "", "Argument[1]", "Argument[*0].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_external_message", "(const char *,bufref *)", "", "Argument[*0]", "Argument[*1].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_external_message", "(const char *,bufref *)", "", "Argument[0]", "Argument[*1].Field[*ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_login_message", "(const char *,bufref *)", "", "Argument[*0]", "Argument[*1].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_login_message", "(const char *,bufref *)", "", "Argument[0]", "Argument[*1].Field[*ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_ntlm_type3_message", "(Curl_easy *,const char *,const char *,ntlmdata *,bufref *)", "", "Argument[*1]", "Argument[*4].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_ntlm_type3_message", "(Curl_easy *,const char *,const char *,ntlmdata *,bufref *)", "", "Argument[1]", "Argument[*4].Field[**ptr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_ntlm_type3_message", "(Curl_easy *,const char *,const char *,ntlmdata *,bufref *)", "", "Argument[1]", "Argument[*4].Field[*len]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[*0]", "Argument[*3].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[*1]", "Argument[*3].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[*2]", "Argument[*3].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[0]", "Argument[*3].Field[**ptr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[1]", "Argument[*3].Field[**ptr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_create_plain_message", "(const char *,const char *,const char *,bufref *)", "", "Argument[2]", "Argument[*3].Field[**ptr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_decode_digest_http_message", "(const char *,digestdata *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_decode_ntlm_type2_message", "(Curl_easy *,const bufref *,ntlmdata *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_auth_digest_get_pair", "(const char *,char *,char *,const char **)", "", "Argument[*0]", "Argument[**3]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_digest_get_pair", "(const char *,char *,char *,const char **)", "", "Argument[*0]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_digest_get_pair", "(const char *,char *,char *,const char **)", "", "Argument[*0]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_auth_digest_get_pair", "(const char *,char *,char *,const char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_auth_digest_get_pair", "(const char *,char *,char *,const char **)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufcp_init", "(bufc_pool *,size_t,size_t)", "", "Argument[1]", "Argument[*0].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufcp_init", "(bufc_pool *,size_t,size_t)", "", "Argument[2]", "Argument[*0].Field[*spare_max]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_cread", "(bufq *,char *,size_t,size_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_cread", "(bufq *,char *,size_t,size_t *)", "", "Argument[2]", "Argument[*0].Field[**head].Field[*r_offset]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_cread", "(bufq *,char *,size_t,size_t *)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_cread", "(bufq *,char *,size_t,size_t *)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_cwrite", "(bufq *,const char *,size_t,size_t *)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_init2", "(bufq *,size_t,size_t,int)", "", "Argument[1]", "Argument[*0].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_init2", "(bufq *,size_t,size_t,int)", "", "Argument[2]", "Argument[*0].Field[*max_chunks]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_init2", "(bufq *,size_t,size_t,int)", "", "Argument[3]", "Argument[*0].Field[*opts]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_init", "(bufq *,size_t,size_t)", "", "Argument[1]", "Argument[*0].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_init", "(bufq *,size_t,size_t)", "", "Argument[2]", "Argument[*0].Field[*max_chunks]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_initp", "(bufq *,bufc_pool *,size_t,int)", "", "Argument[*1].Field[*chunk_size]", "Argument[*0].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_initp", "(bufq *,bufc_pool *,size_t,int)", "", "Argument[*1]", "Argument[*0].Field[**pool]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_initp", "(bufq *,bufc_pool *,size_t,int)", "", "Argument[1]", "Argument[*0].Field[*pool]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_initp", "(bufq *,bufc_pool *,size_t,int)", "", "Argument[2]", "Argument[*0].Field[*max_chunks]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_initp", "(bufq *,bufc_pool *,size_t,int)", "", "Argument[3]", "Argument[*0].Field[*opts]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_len", "(const bufq *)", "", "Argument[*0].Field[**head].Field[*r_offset]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_len", "(const bufq *)", "", "Argument[*0].Field[**head].Field[*w_offset]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_pass", "(bufq *,Curl_bufq_writer *,void *,CURLcode *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_peek", "(bufq *,const unsigned char **,size_t *)", "", "Argument[*0]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_bufq_peek", "(bufq *,const unsigned char **,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_bufq_peek", "(bufq *,const unsigned char **,size_t *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_bufq_peek_at", "(bufq *,size_t,const unsigned char **,size_t *)", "", "Argument[1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_peek_at", "(bufq *,size_t,const unsigned char **,size_t *)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_peek_at", "(bufq *,size_t,const unsigned char **,size_t *)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_read", "(bufq *,unsigned char *,size_t,CURLcode *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_read", "(bufq *,unsigned char *,size_t,CURLcode *)", "", "Argument[2]", "Argument[*0].Field[**head].Field[*r_offset]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_read", "(bufq *,unsigned char *,size_t,CURLcode *)", "", "Argument[2]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_read", "(bufq *,unsigned char *,size_t,CURLcode *)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_sipn", "(bufq *,size_t,Curl_bufq_reader *,void *,CURLcode *)", "", "Argument[3]", "Argument[*3].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_sipn", "(bufq *,size_t,Curl_bufq_reader *,void *,CURLcode *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_skip", "(bufq *,size_t)", "", "Argument[1]", "Argument[*0].Field[**head].Field[*r_offset]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_slurp", "(bufq *,Curl_bufq_reader *,void *,CURLcode *)", "", "Argument[2]", "Argument[*2].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_slurp", "(bufq *,Curl_bufq_reader *,void *,CURLcode *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_unwrite", "(bufq *,size_t)", "", "Argument[1]", "Argument[*0].Field[**tail].Field[*w_offset]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_write", "(bufq *,const unsigned char *,size_t,CURLcode *)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_write_pass", "(bufq *,const unsigned char *,size_t,Curl_bufq_writer *,void *,CURLcode *)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufq_write_pass", "(bufq *,const unsigned char *,size_t,Curl_bufq_writer *,void *,CURLcode *)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_len", "(const bufref *)", "", "Argument[*0].Field[*len]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_memdup", "(bufref *,const void *,size_t)", "", "Argument[*1]", "Argument[*0].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_memdup", "(bufref *,const void *,size_t)", "", "Argument[1]", "Argument[*0].Field[**ptr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_memdup", "(bufref *,const void *,size_t)", "", "Argument[2]", "Argument[*0].Field[*len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_ptr", "(const bufref *)", "", "Argument[*0].Field[**ptr]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_ptr", "(const bufref *)", "", "Argument[*0].Field[*ptr]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_set", "(bufref *,const void *,size_t,..(*)(..))", "", "Argument[*1]", "Argument[*0].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_set", "(bufref *,const void *,size_t,..(*)(..))", "", "Argument[1]", "Argument[*0].Field[*ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_set", "(bufref *,const void *,size_t,..(*)(..))", "", "Argument[2]", "Argument[*0].Field[*len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bufref_set", "(bufref *,const void *,size_t,..(*)(..))", "", "Argument[3]", "Argument[*0].Field[*dtor]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_bump_headersize", "(Curl_easy *,size_t,bool)", "", "Argument[1]", "Argument[*0].Field[*info].Field[*header_size]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bump_headersize", "(Curl_easy *,size_t,bool)", "", "Argument[1]", "Argument[*0].Field[*req].Field[*allheadercount]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_bump_headersize", "(Curl_easy *,size_t,bool)", "", "Argument[1]", "Argument[*0].Field[*req].Field[*headerbytecount]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cache_addr", "(Curl_easy *,Curl_addrinfo *,const char *,size_t,int,bool)", "", "Argument[*2]", "ReturnValue[*].Field[*hostname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cache_addr", "(Curl_easy *,Curl_addrinfo *,const char *,size_t,int,bool)", "", "Argument[2]", "ReturnValue[*].Field[*hostname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cache_addr", "(Curl_easy *,Curl_addrinfo *,const char *,size_t,int,bool)", "", "Argument[4]", "ReturnValue[*].Field[*hostport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_create", "(Curl_cfilter **,const Curl_cftype *,void *)", "", "Argument[**2]", "Argument[**0].Field[***ctx]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_create", "(Curl_cfilter **,const Curl_cftype *,void *)", "", "Argument[*1]", "Argument[**0].Field[**cft]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_create", "(Curl_cfilter **,const Curl_cftype *,void *)", "", "Argument[*2]", "Argument[**0].Field[**ctx]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_create", "(Curl_cfilter **,const Curl_cftype *,void *)", "", "Argument[1]", "Argument[**0].Field[*cft]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_create", "(Curl_cfilter **,const Curl_cftype *,void *)", "", "Argument[2]", "Argument[**0].Field[*ctx]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_https_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_https_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cf_https_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_socket_peek", "(Curl_cfilter *,Curl_easy *,curl_socket_t *,const Curl_sockaddr_ex **,ip_quadruple *)", "", "Argument[*0]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_cf_socket_peek", "(Curl_cfilter *,Curl_easy *,curl_socket_t *,const Curl_sockaddr_ex **,ip_quadruple *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_cf_socket_peek", "(Curl_cfilter *,Curl_easy *,curl_socket_t *,const Curl_sockaddr_ex **,ip_quadruple *)", "", "Argument[*0]", "Argument[*4]", "taint", "df-generated"]
+      - ["", "", True, "Curl_cf_tcp_create", "(Curl_cfilter **,Curl_easy *,connectdata *,const Curl_addrinfo *,int)", "", "Argument[4]", "Argument[**0].Field[**ctx].Field[*transport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_udp_create", "(Curl_cfilter **,Curl_easy *,connectdata *,const Curl_addrinfo *,int)", "", "Argument[4]", "Argument[**0].Field[**ctx].Field[*transport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cf_unix_create", "(Curl_cfilter **,Curl_easy *,connectdata *,const Curl_addrinfo *,int)", "", "Argument[4]", "Argument[**0].Field[**ctx].Field[*transport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_client_read", "(Curl_easy *,char *,size_t,size_t *,bool *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_client_read", "(Curl_easy *,char *,size_t,size_t *,bool *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_close", "(Curl_easy **)", "", "Argument[*0]", "Argument[**0]", "value", "df-generated"]
+      - ["", "", True, "Curl_close", "(Curl_easy **)", "", "Argument[0]", "Argument[**0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_close", "(Curl_easy **)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_conn_cf_add", "(Curl_easy *,connectdata *,int,Curl_cfilter *)", "", "Argument[*3]", "Argument[*1].Field[**cfilter]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_add", "(Curl_easy *,connectdata *,int,Curl_cfilter *)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_add", "(Curl_easy *,connectdata *,int,Curl_cfilter *)", "", "Argument[1]", "Argument[*3].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_add", "(Curl_easy *,connectdata *,int,Curl_cfilter *)", "", "Argument[3]", "Argument[*1].Field[*cfilter]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_adjust_pollset", "(Curl_cfilter *,Curl_easy *,easy_pollset *)", "", "Argument[*0].Field[**next].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_adjust_pollset", "(Curl_cfilter *,Curl_easy *,easy_pollset *)", "", "Argument[*0].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_cntrl", "(Curl_cfilter *,Curl_easy *,bool,int,int,void *)", "", "Argument[*0].Field[**next].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_cntrl", "(Curl_cfilter *,Curl_easy *,bool,int,int,void *)", "", "Argument[*0].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_discard_all", "(Curl_easy *,connectdata *,int)", "", "Argument[2]", "Argument[*1].Field[*cfilter]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_discard_chain", "(Curl_cfilter **,Curl_easy *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_insert_after", "(Curl_cfilter *,Curl_cfilter *)", "", "Argument[1]", "Argument[*0].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_is_ssl", "(Curl_cfilter *)", "", "Argument[*0].Field[**next].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_is_ssl", "(Curl_cfilter *)", "", "Argument[*0].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_poll", "(Curl_cfilter *,Curl_easy *,timediff_t)", "", "Argument[*0].Field[**next].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_cf_poll", "(Curl_cfilter *,Curl_easy *,timediff_t)", "", "Argument[*0].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_connect", "(Curl_easy *,int,bool,bool *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_get_host", "(Curl_easy *,int,const char **,const char **,int *)", "", "Argument[*0].Field[**conn].Field[*remote_port]", "Argument[*4]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_get_socket", "(Curl_easy *,int)", "", "Argument[*0].Field[**conn].Field[*sock]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_get_socket", "(Curl_easy *,int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_is_http2", "(const Curl_easy *,const connectdata *,int)", "", "Argument[*1].Field[**cfilter].Field[**next]", "Argument[*1].Field[**cfilter]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_is_ssl", "(connectdata *,int)", "", "Argument[*0].Field[**cfilter].Field[**next]", "Argument[*0].Field[**cfilter]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_seems_dead", "(connectdata *,Curl_easy *,curltime *)", "", "Argument[0]", "Argument[*1].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_seems_dead", "(connectdata *,Curl_easy *,curltime *)", "", "Argument[1]", "Argument[*1].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_seems_dead", "(connectdata *,Curl_easy *,curltime *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *,int)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_setup", "(Curl_easy *,connectdata *,int,const Curl_dns_entry *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_shutdown_timeleft", "(connectdata *,curltime *)", "", "Argument[*0].Field[*shutdown].Field[*timeout_ms]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_shutdown_timeleft", "(connectdata *,curltime *)", "", "Argument[*1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_shutdown_timeleft", "(connectdata *,curltime *)", "", "Argument[*1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_shutdown_timeleft", "(connectdata *,curltime *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[*3]", "Argument[*1].Field[*sock]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[2]", "Argument[*1].Field[*cfilter]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[3]", "Argument[*1].Field[*sock]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_tcp_listen_set", "(Curl_easy *,connectdata *,int,curl_socket_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_upkeep", "(Curl_easy *,connectdata *,curltime *)", "", "Argument[*2]", "Argument[*1].Field[*keepalive]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_upkeep", "(Curl_easy *,connectdata *,curltime *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_upkeep", "(Curl_easy *,connectdata *,curltime *)", "", "Argument[1]", "Argument[*0].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_conn_upkeep", "(Curl_easy *,connectdata *,curltime *)", "", "Argument[2]", "Argument[*1].Field[*keepalive]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_conn_upkeep", "(Curl_easy *,connectdata *,curltime *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_connect", "(Curl_easy *,bool *,bool *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_connect", "(Curl_easy *,bool *,bool *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_connect_only_attach", "(Curl_easy *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_connect_only_attach", "(Curl_easy *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_add", "(Curl_easy *,CookieInfo *,bool,bool,const char *,const char *,const char *,bool)", "", "Argument[*6]", "ReturnValue[*].Field[**path]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_add", "(Curl_easy *,CookieInfo *,bool,bool,const char *,const char *,const char *,bool)", "", "Argument[6]", "ReturnValue[*].Field[**path]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_getlist", "(Curl_easy *,CookieInfo *,const char *,const char *,bool,Curl_llist *)", "", "Argument[*2]", "Argument[*1].Field[*cookielist]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_getlist", "(Curl_easy *,CookieInfo *,const char *,const char *,bool,Curl_llist *)", "", "Argument[2]", "Argument[*1].Field[*cookielist]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_getlist", "(Curl_easy *,CookieInfo *,const char *,const char *,bool,Curl_llist *)", "", "Argument[5]", "Argument[*5].Field[**_head].Field[*_list]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_getlist", "(Curl_easy *,CookieInfo *,const char *,const char *,bool,Curl_llist *)", "", "Argument[5]", "Argument[*5].Field[**_tail].Field[*_list]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_init", "(Curl_easy *,const char *,CookieInfo *,bool)", "", "Argument[*2]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Curl_cookie_init", "(Curl_easy *,const char *,CookieInfo *,bool)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_init", "(Curl_easy *,const char *,CookieInfo *,bool)", "", "Argument[3]", "Argument[*2].Field[*newsession]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cookie_init", "(Curl_easy *,const char *,CookieInfo *,bool)", "", "Argument[3]", "ReturnValue[*].Field[*newsession]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_copy_header_value", "(const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_copy_header_value", "(const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_add_conn", "(Curl_easy *,connectdata *)", "", "Argument[1]", "Argument[*1].Field[*cpool_node].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_check_limits", "(Curl_easy *,connectdata *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_disconnect", "(Curl_easy *,connectdata *,bool)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_disconnect", "(Curl_easy *,connectdata *,bool)", "", "Argument[1]", "Argument[*0].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_disconnect", "(Curl_easy *,connectdata *,bool)", "", "Argument[1]", "Argument[*1].Field[*cpool_node].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_do_locked", "(Curl_easy *,connectdata *,Curl_cpool_conn_do_cb *,void *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_do_locked", "(Curl_easy *,connectdata *,Curl_cpool_conn_do_cb *,void *)", "", "Argument[1]", "Argument[*0].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_do_locked", "(Curl_easy *,connectdata *,Curl_cpool_conn_do_cb *,void *)", "", "Argument[1]", "Argument[*1].Field[*cpool_node].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[*2]", "Argument[*0].Field[**idata].Field[**multi]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[*2]", "Argument[*0].Field[**multi]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[*3]", "Argument[*0].Field[**share]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[1]", "Argument[*0].Field[*disconnect_cb]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[2]", "Argument[*0].Field[**idata].Field[*multi]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[2]", "Argument[*0].Field[*multi]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[3]", "Argument[*0].Field[*share]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_init", "(cpool *,Curl_cpool_disconnect_cb *,Curl_multi *,Curl_share *,size_t)", "", "Argument[4]", "Argument[*0].Field[*dest2bundle].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_prune_dead", "(Curl_easy *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_setfds", "(cpool *,fd_set *,fd_set *,int *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_upkeep", "(void *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cpool_upkeep", "(void *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_add", "(Curl_easy *,Curl_creader *)", "", "Argument[*0].Field[*req].Field[**reader_stack]", "Argument[*1].Field[**next]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_add", "(Curl_easy *,Curl_creader *)", "", "Argument[*0].Field[*req].Field[*reader_stack]", "Argument[*1].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_create", "(Curl_creader **,Curl_easy *,const Curl_crtype *,Curl_creader_phase)", "", "Argument[*2]", "Argument[**0].Field[**crt]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_create", "(Curl_creader **,Curl_easy *,const Curl_crtype *,Curl_creader_phase)", "", "Argument[2]", "Argument[**0].Field[*crt]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_create", "(Curl_creader **,Curl_easy *,const Curl_crtype *,Curl_creader_phase)", "", "Argument[3]", "Argument[**0].Field[*phase]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_get_by_type", "(Curl_easy *,const Curl_crtype *)", "", "Argument[*0].Field[*req].Field[**reader_stack]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_get_by_type", "(Curl_easy *,const Curl_crtype *)", "", "Argument[*0].Field[*req].Field[*reader_stack]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_set", "(Curl_easy *,Curl_creader *)", "", "Argument[1]", "Argument[*0].Field[*req].Field[*reader_stack]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_creader_set_rewind", "(Curl_easy *,bool)", "", "Argument[1]", "Argument[*0].Field[*req].Field[*rewind_read]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_creader_will_rewind", "(Curl_easy *)", "", "Argument[*0].Field[*req].Field[*rewind_read]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_add", "(Curl_easy *,Curl_cwriter *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_cwriter_create", "(Curl_cwriter **,Curl_easy *,const Curl_cwtype *,Curl_cwriter_phase)", "", "Argument[*2]", "Argument[**0].Field[**cwt]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_create", "(Curl_cwriter **,Curl_easy *,const Curl_cwtype *,Curl_cwriter_phase)", "", "Argument[2]", "Argument[**0].Field[*cwt]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_create", "(Curl_cwriter **,Curl_easy *,const Curl_cwtype *,Curl_cwriter_phase)", "", "Argument[3]", "Argument[**0].Field[*phase]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_get_by_name", "(Curl_easy *,const char *)", "", "Argument[*0].Field[*req].Field[**writer_stack]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_get_by_name", "(Curl_easy *,const char *)", "", "Argument[*0].Field[*req].Field[*writer_stack]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_get_by_type", "(Curl_easy *,const Curl_cwtype *)", "", "Argument[*0].Field[*req].Field[**writer_stack]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_cwriter_get_by_type", "(Curl_easy *,const Curl_cwtype *)", "", "Argument[*0].Field[*req].Field[*writer_stack]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_add", "(dynbuf *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_add", "(dynbuf *,const char *)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[*1]", "Argument[*0].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[2]", "Argument[*0].Field[*allc]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[2]", "Argument[*0].Field[*leng]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_free", "(dynbuf *)", "", "Argument[*0].Field[*allc]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_init", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*toobig]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_len", "(const dynbuf *)", "", "Argument[*0].Field[*leng]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_ptr", "(const dynbuf *)", "", "Argument[*0].Field[**bufr]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_ptr", "(const dynbuf *)", "", "Argument[*0].Field[*bufr]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_setlen", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_tail", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_tail", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dyn_uptr", "(const dynbuf *)", "", "Argument[*0].Field[**bufr]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_uptr", "(const dynbuf *)", "", "Argument[*0].Field[*bufr]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_vaddf", "(dynbuf *,const char *,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dyn_vprintf", "(dynbuf *,const char *,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_add", "(dynhds *,const char *,size_t,const char *,size_t)", "", "Argument[*1]", "Argument[*0].Field[***hds].Field[**value]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_add", "(dynhds *,const char *,size_t,const char *,size_t)", "", "Argument[1]", "Argument[*0].Field[***hds].Field[**value]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_add", "(dynhds *,const char *,size_t,const char *,size_t)", "", "Argument[4]", "Argument[*0].Field[***hds].Field[*valuelen]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_add", "(dynhds *,const char *,size_t,const char *,size_t)", "", "Argument[4]", "Argument[*0].Field[*strs_len]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_cadd", "(dynhds *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[***hds].Field[**value]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_cadd", "(dynhds *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[***hds].Field[**value]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_cget", "(dynhds *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_cget", "(dynhds *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_count", "(dynhds *)", "", "Argument[*0].Field[*hds_len]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_get", "(dynhds *,const char *,size_t)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_get", "(dynhds *,const char *,size_t)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_getn", "(dynhds *,size_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_h1_add_line", "(dynhds *,const char *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_h1_add_line", "(dynhds *,const char *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_h1_add_line", "(dynhds *,const char *,size_t)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_h1_cadd_line", "(dynhds *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_h1_cadd_line", "(dynhds *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_init", "(dynhds *,size_t,size_t)", "", "Argument[*0].Field[*hds_allc]", "Argument[*0].Field[*hds_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_init", "(dynhds *,size_t,size_t)", "", "Argument[*0].Field[*strs_len]", "Argument[*0].Field[*hds_allc]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_init", "(dynhds *,size_t,size_t)", "", "Argument[1]", "Argument[*0].Field[*max_entries]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_init", "(dynhds *,size_t,size_t)", "", "Argument[2]", "Argument[*0].Field[*max_strs_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_set_opts", "(dynhds *,int)", "", "Argument[1]", "Argument[*0].Field[*opts]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_dynhds_to_nva", "(dynhds *,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_dynhds_to_nva", "(dynhds *,size_t *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_eventfd", "(curl_socket_t[2],bool)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_fileinfo_cleanup", "(fileinfo *)", "", "Argument[*0].Field[*buf].Field[*allc]", "Argument[*0].Field[*buf].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_fopen", "(Curl_easy *,const char *,FILE **,char **)", "", "Argument[*1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_fopen", "(Curl_easy *,const char *,FILE **,char **)", "", "Argument[1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_fopen", "(Curl_easy *,const char *,FILE **,char **)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ftp_parselist", "(char *,size_t,size_t,void *)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ftp_parselist", "(char *,size_t,size_t,void *)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ftp_parselist_data_free", "(ftp_parselist_data **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ftp_parselist_geterror", "(ftp_parselist_data *)", "", "Argument[*0].Field[*error]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_get_line", "(dynbuf *,FILE *)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_pathname", "(const char **,char **,const char *)", "", "Argument[**0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_pathname", "(const char **,char **,const char *)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_pathname", "(const char **,char **,const char *)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_pathname", "(const char **,char **,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_scheme_handler", "(const char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_get_scheme_handler", "(const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_getdate_capped", "(const char *)", "", "Argument[*0]", "Argument[0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_getdate_capped", "(const char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_getdate_capped", "(const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_getformdata", "(CURL *,curl_mimepart *,curl_httppost *,curl_read_callback)", "", "Argument[1]", "Argument[*1].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_getformdata", "(CURL *,curl_mimepart *,curl_httppost *,curl_read_callback)", "", "Argument[1]", "Argument[*1].Field[**arg].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_getformdata", "(CURL *,curl_mimepart *,curl_httppost *,curl_read_callback)", "", "Argument[1]", "Argument[*1].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_getn_scheme_handler", "(const char *,size_t)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_getn_scheme_handler", "(const char *,size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_h1_req_parse_init", "(h1_req_parser *,size_t)", "", "Argument[1]", "Argument[*0].Field[*max_line_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_h1_req_parse_init", "(h1_req_parser *,size_t)", "", "Argument[1]", "Argument[*0].Field[*scratch].Field[*toobig]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_h1_req_parse_read", "(h1_req_parser *,const char *,size_t,const char *,int,CURLcode *)", "", "Argument[*3]", "Argument[*0].Field[**req].Field[**scheme]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_h1_req_parse_read", "(h1_req_parser *,const char *,size_t,const char *,int,CURLcode *)", "", "Argument[3]", "Argument[*0].Field[**req].Field[**scheme]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_h1_req_parse_read", "(h1_req_parser *,const char *,size_t,const char *,int,CURLcode *)", "", "Argument[5]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add2", "(Curl_hash *,void *,size_t,void *,Curl_hash_elem_dtor)", "", "Argument[**3]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add2", "(Curl_hash *,void *,size_t,void *,Curl_hash_elem_dtor)", "", "Argument[*1]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add2", "(Curl_hash *,void *,size_t,void *,Curl_hash_elem_dtor)", "", "Argument[*3]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add2", "(Curl_hash *,void *,size_t,void *,Curl_hash_elem_dtor)", "", "Argument[1]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add2", "(Curl_hash *,void *,size_t,void *,Curl_hash_elem_dtor)", "", "Argument[3]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add", "(Curl_hash *,void *,size_t,void *)", "", "Argument[**3]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add", "(Curl_hash *,void *,size_t,void *)", "", "Argument[*1]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add", "(Curl_hash *,void *,size_t,void *)", "", "Argument[*3]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add", "(Curl_hash *,void *,size_t,void *)", "", "Argument[1]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_add", "(Curl_hash *,void *,size_t,void *)", "", "Argument[3]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_clean_with_criterium", "(Curl_hash *,void *,..(*)(..))", "", "Argument[*1].Field[*now]", "Argument[*1].Field[*oldest]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_count", "(Curl_hash *)", "", "Argument[*0].Field[*size]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_init", "(Curl_hash *,size_t,hash_function,comp_function,Curl_hash_dtor)", "", "Argument[1]", "Argument[*0].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_init", "(Curl_hash *,size_t,hash_function,comp_function,Curl_hash_dtor)", "", "Argument[2]", "Argument[*0].Field[*hash_func]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_init", "(Curl_hash *,size_t,hash_function,comp_function,Curl_hash_dtor)", "", "Argument[3]", "Argument[*0].Field[*comp_func]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_init", "(Curl_hash *,size_t,hash_function,comp_function,Curl_hash_dtor)", "", "Argument[4]", "Argument[*0].Field[*dtor]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_next_element", "(Curl_hash_iterator *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_hash_next_element", "(Curl_hash_iterator *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_hash_offt_init", "(Curl_hash *,size_t,Curl_hash_dtor)", "", "Argument[1]", "Argument[*0].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_offt_init", "(Curl_hash *,size_t,Curl_hash_dtor)", "", "Argument[2]", "Argument[*0].Field[*dtor]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_offt_set", "(Curl_hash *,curl_off_t,void *)", "", "Argument[**2]", "ReturnValue[**]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_offt_set", "(Curl_hash *,curl_off_t,void *)", "", "Argument[*2]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_offt_set", "(Curl_hash *,curl_off_t,void *)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_start_iterate", "(Curl_hash *,Curl_hash_iterator *)", "", "Argument[*0]", "Argument[*1].Field[**hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_start_iterate", "(Curl_hash *,Curl_hash_iterator *)", "", "Argument[0]", "Argument[*1].Field[*hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hash_str", "(void *,size_t,size_t)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_str", "(void *,size_t,size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hash_str", "(void *,size_t,size_t)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hexencode", "(const unsigned char *,size_t,unsigned char *,size_t)", "", "Argument[*0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hexencode", "(const unsigned char *,size_t,unsigned char *,size_t)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hexencode", "(const unsigned char *,size_t,unsigned char *,size_t)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hmacit", "(const HMAC_params *,const unsigned char *,const size_t,const unsigned char *,const size_t,unsigned char *)", "", "Argument[*0].Field[*ctxtsize]", "Argument[*5]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_hmacit", "(const HMAC_params *,const unsigned char *,const size_t,const unsigned char *,const size_t,unsigned char *)", "", "Argument[*0]", "Argument[*5].Field[**hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hmacit", "(const HMAC_params *,const unsigned char *,const size_t,const unsigned char *,const size_t,unsigned char *)", "", "Argument[0]", "Argument[*5].Field[*hash]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_hsts_cleanup", "(hsts **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http2_may_switch", "(Curl_easy *,connectdata *,int)", "", "Argument[*1].Field[**cfilter].Field[**next]", "Argument[*1].Field[**cfilter]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http2_request_upgrade", "(dynbuf *,Curl_easy *)", "", "Argument[*0].Field[*allc]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http2_switch", "(Curl_easy *,connectdata *,int)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http2_switch", "(Curl_easy *,connectdata *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http2_switch", "(Curl_easy *,connectdata *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http2_upgrade", "(Curl_easy *,connectdata *,int,const char *,size_t)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http2_upgrade", "(Curl_easy *,connectdata *,int,const char *,size_t)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http2_upgrade", "(Curl_easy *,connectdata *,int,const char *,size_t)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http", "(Curl_easy *,bool *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_connect", "(Curl_easy *,bool *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_decode_status", "(int *,const char *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_decode_status", "(int *,const char *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_done", "(Curl_easy *,CURLcode,bool)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_getsock_do", "(Curl_easy *,connectdata *,curl_socket_t *)", "", "Argument[*0].Field[**conn].Field[*sock]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_method", "(Curl_easy *,connectdata *,const char **,Curl_HttpReq *)", "", "Argument[*0]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_http_method", "(Curl_easy *,connectdata *,const char **,Curl_HttpReq *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_http_method", "(Curl_easy *,connectdata *,const char **,Curl_HttpReq *)", "", "Argument[*0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_http_proxy_get_destination", "(Curl_cfilter *,const char **,int *,bool *)", "", "Argument[*1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_proxy_get_destination", "(Curl_cfilter *,const char **,int *,bool *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_proxy_get_destination", "(Curl_cfilter *,const char **,int *,bool *)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make2", "(httpreq **,const char *,size_t,CURLU *,const char *)", "", "Argument[*1]", "Argument[**0].Field[*method]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make2", "(httpreq **,const char *,size_t,CURLU *,const char *)", "", "Argument[1]", "Argument[**0].Field[*method]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[*1]", "Argument[**0].Field[*method]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[*3]", "Argument[**0].Field[**scheme]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[*5]", "Argument[**0].Field[**authority]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[*7]", "Argument[**0].Field[**path]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[1]", "Argument[**0].Field[*method]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[3]", "Argument[**0].Field[**scheme]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[5]", "Argument[**0].Field[**authority]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_req_make", "(httpreq **,const char *,size_t,const char *,size_t,const char *,size_t,const char *,size_t)", "", "Argument[7]", "Argument[**0].Field[**path]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_resp_make", "(http_resp **,int,const char *)", "", "Argument[1]", "Argument[**0].Field[*status]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hd", "(Curl_easy *,const char *,size_t,bool)", "", "Argument[2]", "Argument[*0].Field[*info].Field[*header_size]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hd", "(Curl_easy *,const char *,size_t,bool)", "", "Argument[2]", "Argument[*0].Field[*req].Field[*allheadercount]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hd", "(Curl_easy *,const char *,size_t,bool)", "", "Argument[2]", "Argument[*0].Field[*req].Field[*headerbytecount]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hds", "(Curl_easy *,const char *,size_t,size_t *)", "", "Argument[*1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hds", "(Curl_easy *,const char *,size_t,size_t *)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hds", "(Curl_easy *,const char *,size_t,size_t *)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_http_write_resp_hds", "(Curl_easy *,const char *,size_t,size_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_httpchunk_free", "(Curl_easy *,Curl_chunker *)", "", "Argument[*1].Field[*trailer].Field[*allc]", "Argument[*1].Field[*trailer].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_httpchunk_init", "(Curl_easy *,Curl_chunker *,bool)", "", "Argument[2]", "Argument[*1].Field[*ignore_body]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_httpchunk_read", "(Curl_easy *,Curl_chunker *,char *,size_t,size_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_httpchunk_reset", "(Curl_easy *,Curl_chunker *,bool)", "", "Argument[2]", "Argument[*1].Field[*ignore_body]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_init_dnscache", "(Curl_hash *,size_t)", "", "Argument[1]", "Argument[*0].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_init_userdefined", "(Curl_easy *)", "", "Argument[*0].Field[*set].Field[*ssl]", "Argument[*0].Field[*set].Field[*proxy_ssl]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ip2addr", "(int,const void *,const char *,int)", "", "Argument[*1]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ip2addr", "(int,const void *,const char *,int)", "", "Argument[*2]", "ReturnValue[*].Field[**ai_canonname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ip2addr", "(int,const void *,const char *,int)", "", "Argument[0]", "ReturnValue[*].Field[*ai_family]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ip2addr", "(int,const void *,const char *,int)", "", "Argument[1]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ip2addr", "(int,const void *,const char *,int)", "", "Argument[2]", "ReturnValue[*].Field[**ai_canonname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_is_absolute_url", "(const char *,char *,size_t,bool)", "", "Argument[*0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_is_absolute_url", "(const char *,char *,size_t,bool)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_is_absolute_url", "(const char *,char *,size_t,bool)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[**1]", "Argument[*0].Field[**_head].Field[***_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[**1]", "Argument[*0].Field[**_tail].Field[***_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[**1]", "Argument[*2].Field[***_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[*1]", "Argument[*0].Field[**_head].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[*1]", "Argument[*0].Field[**_tail].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[*1]", "Argument[*2].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*0].Field[**_head].Field[*_list]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*0].Field[**_tail].Field[*_list]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*2].Field[*_list]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*0].Field[**_head].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*0].Field[**_tail].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_append", "(Curl_llist *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*2].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_count", "(Curl_llist *)", "", "Argument[*0].Field[*_size]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_head", "(Curl_llist *)", "", "Argument[*0].Field[**_head]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_head", "(Curl_llist *)", "", "Argument[*0].Field[*_head]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_init", "(Curl_llist *,Curl_llist_dtor)", "", "Argument[1]", "Argument[*0].Field[*_dtor]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[**2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[**2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[**2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*1]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[*3]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[1]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[3]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_llist_insert_next", "(Curl_llist *,Curl_llist_node *,const void *,Curl_llist_node *)", "", "Argument[3]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_memdup0", "(const char *,size_t)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_memdup0", "(const char *,size_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_memdup", "(const void *,size_t)", "", "Argument[**0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_memdup", "(const void *,size_t)", "", "Argument[*0]", "Argument[**0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_memdup", "(const void *,size_t)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_memdup", "(const void *,size_t)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_memdup", "(const void *,size_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_mime_cleanpart", "(curl_mimepart *)", "", "Argument[0]", "Argument[*0].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_mime_cleanpart", "(curl_mimepart *)", "", "Argument[0]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_mime_duppart", "(Curl_easy *,curl_mimepart *,const curl_mimepart *)", "", "Argument[1]", "Argument[*1].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_mime_duppart", "(Curl_easy *,curl_mimepart *,const curl_mimepart *)", "", "Argument[1]", "Argument[*1].Field[**arg].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_mime_duppart", "(Curl_easy *,curl_mimepart *,const curl_mimepart *)", "", "Argument[1]", "Argument[*1].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_mime_read", "(char *,size_t,size_t,void *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_mime_set_subparts", "(curl_mimepart *,curl_mime *,int)", "", "Argument[1]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_add_perform", "(Curl_multi *,Curl_easy *,connectdata *)", "", "Argument[0]", "Argument[*1].Field[*multi]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_add_perform", "(Curl_multi *,Curl_easy *,connectdata *)", "", "Argument[1]", "Argument[*1].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_add_perform", "(Curl_multi *,Curl_easy *,connectdata *)", "", "Argument[1]", "Argument[*1].Field[*multi_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_add_perform", "(Curl_multi *,Curl_easy *,connectdata *)", "", "Argument[2]", "Argument[*1].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_handle", "(size_t,size_t,size_t,size_t)", "", "Argument[0]", "ReturnValue[*].Field[*sockhash].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_handle", "(size_t,size_t,size_t,size_t)", "", "Argument[2]", "ReturnValue[*].Field[*hostcache].Field[*slots]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_handle", "(size_t,size_t,size_t,size_t)", "", "Argument[3]", "ReturnValue[*].Field[**ssl_scache].Field[*peer_count]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_max_concurrent_streams", "(Curl_multi *)", "", "Argument[*0].Field[*max_concurrent_streams]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_pollset_ev", "(Curl_multi *,Curl_easy *,easy_pollset *,easy_pollset *)", "", "Argument[1]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_xfer_buf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_multi_xfer_buf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_multi_xfer_buf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_multi_xfer_sockbuf_borrow", "(Curl_easy *,size_t,char **)", "", "Argument[*0].Field[**multi].Field[**xfer_sockbuf]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_xfer_sockbuf_borrow", "(Curl_easy *,size_t,char **)", "", "Argument[*0].Field[**multi].Field[*xfer_sockbuf]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_xfer_sockbuf_borrow", "(Curl_easy *,size_t,char **)", "", "Argument[1]", "Argument[*0].Field[**multi].Field[*xfer_sockbuf_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_multi_xfer_ulbuf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[**1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_multi_xfer_ulbuf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_multi_xfer_ulbuf_borrow", "(Curl_easy *,char **,size_t *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_netrc_cleanup", "(store_netrc *)", "", "Argument[*0].Field[*filebuf].Field[*allc]", "Argument[*0].Field[*filebuf].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_node_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_node_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "Curl_node_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_node_llist", "(Curl_llist_node *)", "", "Argument[*0].Field[**_list]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_node_llist", "(Curl_llist_node *)", "", "Argument[*0].Field[*_list]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_node_next", "(Curl_llist_node *)", "", "Argument[*0].Field[**_next]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_node_next", "(Curl_llist_node *)", "", "Argument[*0].Field[*_next]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_node_take_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_node_take_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "Curl_node_take_elem", "(Curl_llist_node *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_ntlm_core_mk_lm_hash", "(const char *,unsigned char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ntlm_core_mk_lmv2_resp", "(unsigned char *,unsigned char *,unsigned char *,unsigned char *)", "", "Argument[*1]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ntlm_core_mk_lmv2_resp", "(unsigned char *,unsigned char *,unsigned char *,unsigned char *)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ntlm_core_mk_nt_hash", "(const char *,unsigned char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ntlm_core_mk_ntlmv2_resp", "(unsigned char *,unsigned char *,ntlmdata *,unsigned char **,unsigned int *)", "", "Argument[*2]", "Argument[*4]", "taint", "df-generated"]
+      - ["", "", True, "Curl_on_disconnect", "(Curl_easy *,connectdata *,bool)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_once_resolved", "(Curl_easy *,bool *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[*0]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[*0]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[*0]", "Argument[**3]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[0]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[0]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[0]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_interface", "(const char *,char **,char **,char **)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[*0]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[*0]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[*0]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[0]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[0]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[0]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[1]", "Argument[**3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parse_login_details", "(const char *,const size_t,char **,char **,char **)", "", "Argument[1]", "Argument[**4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_parsenetrc", "(store_netrc *,const char *,char **,char **,char *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsEarlyData", "(Curl_easy *,curl_off_t)", "", "Argument[1]", "Argument[*0].Field[*progress].Field[*earlydata_sent]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsLimitWaitTime", "(pgrs_dir *,curl_off_t,curltime)", "", "Argument[*0].Field[*cur_size]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsLimitWaitTime", "(pgrs_dir *,curl_off_t,curltime)", "", "Argument[*0].Field[*limit].Field[*start_size]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsLimitWaitTime", "(pgrs_dir *,curl_off_t,curltime)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsLimitWaitTime", "(pgrs_dir *,curl_off_t,curltime)", "", "Argument[2].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsLimitWaitTime", "(pgrs_dir *,curl_off_t,curltime)", "", "Argument[2].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pgrsTimeWas", "(Curl_easy *,timerid,curltime)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_poll", "(pollfd[],unsigned int,timediff_t)", "", "Argument[0]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_pollfds_add_ps", "(curl_pollfds *,easy_pollset *)", "", "Argument[*1].Field[*sockets]", "Argument[*0].Field[**pfds].Field[*fd]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollfds_add_sock", "(curl_pollfds *,curl_socket_t,short)", "", "Argument[1]", "Argument[*0].Field[**pfds].Field[*fd]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollfds_add_sock", "(curl_pollfds *,curl_socket_t,short)", "", "Argument[2]", "Argument[*0].Field[**pfds].Field[*events]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollfds_init", "(curl_pollfds *,pollfd *,unsigned int)", "", "Argument[*1]", "Argument[*0].Field[**pfds]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollfds_init", "(curl_pollfds *,pollfd *,unsigned int)", "", "Argument[1]", "Argument[*0].Field[*pfds]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollfds_init", "(curl_pollfds *,pollfd *,unsigned int)", "", "Argument[2]", "Argument[*0].Field[*count]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_add_socks", "(Curl_easy *,easy_pollset *,..(*)(..))", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_pollset_change", "(Curl_easy *,easy_pollset *,curl_socket_t,int,int)", "", "Argument[2]", "Argument[*1].Field[*sockets]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_change", "(Curl_easy *,easy_pollset *,curl_socket_t,int,int)", "", "Argument[3]", "Argument[*1].Field[*actions]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_change", "(Curl_easy *,easy_pollset *,curl_socket_t,int,int)", "", "Argument[4]", "Argument[*1].Field[*actions]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_check", "(Curl_easy *,easy_pollset *,curl_socket_t,bool *,bool *)", "", "Argument[*4]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_check", "(Curl_easy *,easy_pollset *,curl_socket_t,bool *,bool *)", "", "Argument[4]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_check", "(Curl_easy *,easy_pollset *,curl_socket_t,bool *,bool *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pollset_set", "(Curl_easy *,easy_pollset *,curl_socket_t,bool,bool)", "", "Argument[2]", "Argument[*1].Field[*sockets]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pp_flushsend", "(Curl_easy *,pingpong *)", "", "Argument[*1].Field[*sendsize]", "Argument[*1].Field[*sendleft]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pp_getsock", "(Curl_easy *,pingpong *,curl_socket_t *)", "", "Argument[*0].Field[**conn].Field[*sock]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_pp_readresp", "(Curl_easy *,int,pingpong *,int *,size_t *)", "", "Argument[*2]", "Argument[*4]", "taint", "df-generated"]
+      - ["", "", True, "Curl_pp_state_timeout", "(Curl_easy *,pingpong *,bool)", "", "Argument[*0].Field[*set].Field[*server_response_timeout]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pp_state_timeout", "(Curl_easy *,pingpong *,bool)", "", "Argument[*0].Field[*set].Field[*timeout]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_pp_vsendf", "(Curl_easy *,pingpong *,const char *,va_list)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_psl_use", "(Curl_easy *)", "", "Argument[*0].Field[**psl].Field[**psl]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_psl_use", "(Curl_easy *)", "", "Argument[*0].Field[**psl].Field[*psl]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_rand_alnum", "(Curl_easy *,unsigned char *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_rand_bytes", "(Curl_easy *,unsigned char *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_rand_hex", "(Curl_easy *,unsigned char *,size_t)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_raw_tolower", "(char)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_raw_toupper", "(char)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read16_be", "(const unsigned char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read16_be", "(const unsigned char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read16_le", "(const unsigned char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read16_le", "(const unsigned char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read32_le", "(const unsigned char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_read32_le", "(const unsigned char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_req_hard_reset", "(SingleRequest *,Curl_easy *)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_req_send", "(Curl_easy *,dynbuf *)", "", "Argument[*1].Field[*leng]", "Argument[*0].Field[*req].Field[*sendbuf_hds_len]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_req_send", "(Curl_easy *,dynbuf *)", "", "Argument[*1].Field[*leng]", "Argument[*0].Field[*req].Field[*writebytecount]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_req_send", "(Curl_easy *,dynbuf *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_req_send_more", "(Curl_easy *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_req_soft_reset", "(SingleRequest *,Curl_easy *)", "", "Argument[*1].Field[*set].Field[*upload_buffer_size]", "Argument[*0].Field[*sendbuf].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_req_start", "(SingleRequest *,Curl_easy *)", "", "Argument[*1].Field[*set].Field[*upload_buffer_size]", "Argument[*0].Field[*sendbuf].Field[*chunk_size]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv", "(Curl_easy *,const char *,int,bool,Curl_dns_entry **)", "", "Argument[*1]", "Argument[**4].Field[**addr].Field[**ai_canonname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv", "(Curl_easy *,const char *,int,bool,Curl_dns_entry **)", "", "Argument[*1]", "Argument[**4].Field[*hostname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv", "(Curl_easy *,const char *,int,bool,Curl_dns_entry **)", "", "Argument[1]", "Argument[**4].Field[**addr].Field[**ai_canonname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolv", "(Curl_easy *,const char *,int,bool,Curl_dns_entry **)", "", "Argument[1]", "Argument[**4].Field[*hostname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolv", "(Curl_easy *,const char *,int,bool,Curl_dns_entry **)", "", "Argument[2]", "Argument[**4].Field[*hostport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_check", "(Curl_easy *,Curl_dns_entry **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_timeout", "(Curl_easy *,const char *,int,Curl_dns_entry **,timediff_t)", "", "Argument[*1]", "Argument[**3].Field[**addr].Field[**ai_canonname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_timeout", "(Curl_easy *,const char *,int,Curl_dns_entry **,timediff_t)", "", "Argument[*1]", "Argument[**3].Field[*hostname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_timeout", "(Curl_easy *,const char *,int,Curl_dns_entry **,timediff_t)", "", "Argument[1]", "Argument[**3].Field[**addr].Field[**ai_canonname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_timeout", "(Curl_easy *,const char *,int,Curl_dns_entry **,timediff_t)", "", "Argument[1]", "Argument[**3].Field[*hostname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_timeout", "(Curl_easy *,const char *,int,Curl_dns_entry **,timediff_t)", "", "Argument[2]", "Argument[**3].Field[*hostport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_resolv_unlink", "(Curl_easy *,Curl_dns_entry **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolver_duphandle", "(Curl_easy *,void **,void *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_resolver_init", "(Curl_easy *,void **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_retry_request", "(Curl_easy *,char **)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_rtsp_parseheader", "(Curl_easy *,const char *)", "", "Argument[*1]", "Argument[*0].Field[*set].Field[**str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_rtsp_parseheader", "(Curl_easy *,const char *)", "", "Argument[*1]", "Argument[*0].Field[*state].Field[*rtsp_CSeq_recv]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_rtsp_parseheader", "(Curl_easy *,const char *)", "", "Argument[1]", "Argument[*0].Field[*set].Field[**str]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_rtsp_parseheader", "(Curl_easy *,const char *)", "", "Argument[1]", "Argument[*0].Field[*state].Field[*rtsp_CSeq_recv]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_sasl_init", "(SASL *,Curl_easy *,const SASLproto *)", "", "Argument[*2].Field[*defmechs]", "Argument[*0].Field[*prefmech]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sasl_init", "(SASL *,Curl_easy *,const SASLproto *)", "", "Argument[*2]", "Argument[*0].Field[**params]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sasl_init", "(SASL *,Curl_easy *,const SASLproto *)", "", "Argument[2]", "Argument[*0].Field[*params]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sasl_start", "(SASL *,Curl_easy *,bool,saslprogress *)", "", "Argument[2]", "Argument[*0].Field[*force_ir]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_senddata", "(Curl_easy *,const void *,size_t,size_t *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_senddata", "(Curl_easy *,const void *,size_t,size_t *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sendrecv", "(Curl_easy *,curltime *)", "", "Argument[*1]", "Argument[*0].Field[*state].Field[*keeps_speed]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sendrecv", "(Curl_easy *,curltime *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sendrecv", "(Curl_easy *,curltime *)", "", "Argument[1]", "Argument[*0].Field[*state].Field[*keeps_speed]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_sendrecv", "(Curl_easy *,curltime *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_set_in_callback", "(Curl_easy *,bool)", "", "Argument[1]", "Argument[*0].Field[**multi].Field[*in_callback]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_setblobopt", "(curl_blob **,const curl_blob *)", "", "Argument[*1]", "Argument[**0]", "value", "df-generated"]
+      - ["", "", True, "Curl_setblobopt", "(curl_blob **,const curl_blob *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_setblobopt", "(curl_blob **,const curl_blob *)", "", "Argument[1]", "Argument[**0].Field[**data]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_setblobopt", "(curl_blob **,const curl_blob *)", "", "Argument[1]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_setblobopt", "(curl_blob **,const curl_blob *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_setstropt", "(char **,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_shutdown_start", "(Curl_easy *,int,curltime *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_shutdown_timeleft", "(connectdata *,int,curltime *)", "", "Argument[*0].Field[*shutdown].Field[*timeout_ms]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_shutdown_timeleft", "(connectdata *,int,curltime *)", "", "Argument[*2].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_shutdown_timeleft", "(connectdata *,int,curltime *)", "", "Argument[*2].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_shutdown_timeleft", "(connectdata *,int,curltime *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[*1]", "Argument[*0].Field[**next].Field[**data]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[*1]", "ReturnValue[*].Field[**data]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[1]", "Argument[*0].Field[**next].Field[*data]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_append_nodup", "(curl_slist *,char *)", "", "Argument[1]", "ReturnValue[*].Field[*data]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_duplicate", "(curl_slist *)", "", "Argument[*0].Field[**next].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_slist_duplicate", "(curl_slist *)", "", "Argument[*0].Field[**next]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_sock_assign_addr", "(Curl_sockaddr_ex *,const Curl_addrinfo *,int)", "", "Argument[*1]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_socket_open", "(Curl_easy *,const Curl_addrinfo *,Curl_sockaddr_ex *,int,curl_socket_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_speedcheck", "(Curl_easy *,curltime)", "", "Argument[1]", "Argument[*0].Field[*state].Field[*keeps_speed]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_splay", "(curltime,Curl_tree *)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_splay", "(curltime,Curl_tree *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Curl_splay", "(curltime,Curl_tree *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splay", "(curltime,Curl_tree *)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
+      - ["", "", True, "Curl_splay", "(curltime,Curl_tree *)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayget", "(Curl_tree *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayget", "(Curl_tree *)", "", "Argument[*0]", "ReturnValue[**]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayget", "(Curl_tree *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[*1]", "Argument[**2]", "value", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[1]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[1]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
+      - ["", "", True, "Curl_splaygetbest", "(curltime,Curl_tree *,Curl_tree **)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[*1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[*1]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[*1]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[*2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[*2]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[1]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[1]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[1]", "ReturnValue", "value", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[1]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[2]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[2]", "ReturnValue", "value", "df-generated"]
+      - ["", "", True, "Curl_splayinsert", "(curltime,Curl_tree *,Curl_tree *)", "", "Argument[2]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "Curl_splayremove", "(Curl_tree *,Curl_tree *,Curl_tree **)", "", "Argument[*0]", "Argument[**2]", "value", "df-generated"]
+      - ["", "", True, "Curl_splayremove", "(Curl_tree *,Curl_tree *,Curl_tree **)", "", "Argument[0]", "Argument[*2]", "value", "df-generated"]
+      - ["", "", True, "Curl_splayremove", "(Curl_tree *,Curl_tree *,Curl_tree **)", "", "Argument[1]", "Argument[*1].Field[**samen].Field[*samen]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_splayremove", "(Curl_tree *,Curl_tree *,Curl_tree **)", "", "Argument[1]", "Argument[*1].Field[*samen]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_splayset", "(Curl_tree *,void *)", "", "Argument[**1]", "Argument[*0].Field[***ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_splayset", "(Curl_tree *,void *)", "", "Argument[*1]", "Argument[*0].Field[**ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_splayset", "(Curl_tree *,void *)", "", "Argument[1]", "Argument[*0].Field[*ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cf_get_config", "(Curl_cfilter *,Curl_easy *)", "", "Argument[*1].Field[*set].Field[*proxy_ssl]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cf_get_config", "(Curl_cfilter *,Curl_easy *)", "", "Argument[*1].Field[*set].Field[*ssl]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cf_get_primary_config", "(Curl_cfilter *)", "", "Argument[*0].Field[**conn].Field[*proxy_ssl_config]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cf_get_primary_config", "(Curl_cfilter *)", "", "Argument[*0].Field[**conn].Field[*ssl_config]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cfilter_add", "(Curl_easy *,connectdata *,int)", "", "Argument[1]", "Argument[*1].Field[**cfilter].Field[*conn]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cfilter_add", "(Curl_easy *,connectdata *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*next]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_cfilter_add", "(Curl_easy *,connectdata *,int)", "", "Argument[2]", "Argument[*1].Field[**cfilter].Field[*sockindex]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_easy_config_init", "(Curl_easy *)", "", "Argument[*0].Field[*set].Field[*ssl]", "Argument[*0].Field[*set].Field[*proxy_ssl]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_peer_init", "(ssl_peer *,Curl_cfilter *,const char *,int)", "", "Argument[*1].Field[**conn].Field[*remote_port]", "Argument[*0].Field[*port]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_peer_init", "(ssl_peer *,Curl_cfilter *,const char *,int)", "", "Argument[3]", "Argument[*0].Field[*transport]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_create", "(size_t,size_t,Curl_ssl_scache **)", "", "Argument[0]", "Argument[**2].Field[*peer_count]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_create", "(size_t,size_t,Curl_ssl_scache **)", "", "Argument[1]", "Argument[**2].Field[**peers].Field[*max_sessions]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_get_obj", "(Curl_cfilter *,Curl_easy *,const char *,void **)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_put", "(Curl_cfilter *,Curl_easy *,const char *,Curl_ssl_session *)", "", "Argument[*3]", "Argument[*3].Field[*list].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_put", "(Curl_cfilter *,Curl_easy *,const char *,Curl_ssl_session *)", "", "Argument[3]", "Argument[*3].Field[*list].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_return", "(Curl_cfilter *,Curl_easy *,const char *,Curl_ssl_session *)", "", "Argument[*3]", "Argument[*3].Field[*list].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_scache_return", "(Curl_cfilter *,Curl_easy *,const char *,Curl_ssl_session *)", "", "Argument[3]", "Argument[*3].Field[*list].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[*0]", "Argument[**8].Field[**sdata]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[*6]", "Argument[**8].Field[**quic_tp]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[0]", "Argument[**8].Field[*sdata]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[1]", "Argument[**8].Field[*sdata_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[2]", "Argument[**8].Field[*ietf_tls_id]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[4]", "Argument[**8].Field[*valid_until]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[5]", "Argument[**8].Field[*earlydata_max]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[6]", "Argument[**8].Field[*quic_tp]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create2", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,unsigned char *,size_t,Curl_ssl_session **)", "", "Argument[7]", "Argument[**8].Field[*quic_tp_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[*0]", "Argument[**6].Field[**sdata]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[0]", "Argument[**6].Field[*sdata]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[1]", "Argument[**6].Field[*sdata_len]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[2]", "Argument[**6].Field[*ietf_tls_id]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[4]", "Argument[**6].Field[*valid_until]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_session_create", "(unsigned char *,size_t,int,const char *,curl_off_t,size_t,Curl_ssl_session **)", "", "Argument[5]", "Argument[**6].Field[*earlydata_max]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_ssl_supports", "(Curl_easy *,unsigned int)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str2addr", "(char *,int)", "", "Argument[*0]", "ReturnValue[*].Field[**ai_canonname]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str2addr", "(char *,int)", "", "Argument[0]", "ReturnValue[*].Field[**ai_canonname]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_newline", "(char **)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_newline", "(char **)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_newline", "(char **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[**0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[*0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_number", "(char **,size_t *,size_t)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_quotedword", "(char **,Curl_str *,const size_t)", "", "Argument[**0]", "Argument[*1].Field[**str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str_single", "(char **,char)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_single", "(char **,char)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_single", "(char **,char)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_singlespace", "(char **)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_singlespace", "(char **)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_singlespace", "(char **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[**0]", "Argument[*1].Field[**str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[*0]", "Argument[*1].Field[*str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_until", "(char **,Curl_str *,const size_t,char)", "", "Argument[0]", "Argument[*1].Field[*str]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[**0]", "Argument[*1].Field[**str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[*0]", "Argument[*1].Field[*str]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_str_word", "(char **,Curl_str *,const size_t)", "", "Argument[0]", "Argument[*1].Field[*str]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strerror", "(int,char *,size_t)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_strerror", "(int,char *,size_t)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "Curl_strntolower", "(char *,const char *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strntolower", "(char *,const char *,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strntolower", "(char *,const char *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strntoupper", "(char *,const char *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strntoupper", "(char *,const char *,size_t)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_strntoupper", "(char *,const char *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_thread_destroy", "(pthread_t *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_thread_join", "(pthread_t **)", "", "Argument[*0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_thread_join", "(pthread_t **)", "", "Argument[0]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_thread_join", "(pthread_t **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff", "(curltime,curltime)", "", "Argument[0].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff", "(curltime,curltime)", "", "Argument[0].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff", "(curltime,curltime)", "", "Argument[1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff", "(curltime,curltime)", "", "Argument[1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_ceil", "(curltime,curltime)", "", "Argument[0].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_ceil", "(curltime,curltime)", "", "Argument[0].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_ceil", "(curltime,curltime)", "", "Argument[1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_ceil", "(curltime,curltime)", "", "Argument[1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_us", "(curltime,curltime)", "", "Argument[0].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_us", "(curltime,curltime)", "", "Argument[0].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_us", "(curltime,curltime)", "", "Argument[1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timediff_us", "(curltime,curltime)", "", "Argument[1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timeleft", "(Curl_easy *,curltime *,bool)", "", "Argument[*0].Field[*set].Field[*connecttimeout]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timeleft", "(Curl_easy *,curltime *,bool)", "", "Argument[*0].Field[*set].Field[*timeout]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timeleft", "(Curl_easy *,curltime *,bool)", "", "Argument[*1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timeleft", "(Curl_easy *,curltime *,bool)", "", "Argument[*1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timeleft", "(Curl_easy *,curltime *,bool)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timestrcmp", "(const char *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timestrcmp", "(const char *,const char *)", "", "Argument[*1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timestrcmp", "(const char *,const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_timestrcmp", "(const char *,const char *)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_updatesocket", "(Curl_easy *)", "", "Argument[0]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_url_set_authority", "(CURLU *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**password]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_url_set_authority", "(CURLU *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**user]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_url_set_authority", "(CURLU *,const char *)", "", "Argument[1]", "Argument[*0].Field[**password]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_url_set_authority", "(CURLU *,const char *)", "", "Argument[1]", "Argument[*0].Field[**user]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_urldecode", "(const char *,size_t,char **,size_t *,urlreject)", "", "Argument[*2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_urldecode", "(const char *,size_t,char **,size_t *,urlreject)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_urldecode", "(const char *,size_t,char **,size_t *,urlreject)", "", "Argument[2]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_vsetopt", "(Curl_easy *,CURLoption,va_list)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_vsetopt", "(Curl_easy *,CURLoption,va_list)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "Curl_vsetopt", "(Curl_easy *,CURLoption,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "Curl_waitfds_add_ps", "(Curl_waitfds *,easy_pollset *)", "", "Argument[*1].Field[*sockets]", "Argument[*0].Field[**wfds].Field[*fd]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_waitfds_init", "(Curl_waitfds *,curl_waitfd *,unsigned int)", "", "Argument[*1]", "Argument[*0].Field[**wfds]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_waitfds_init", "(Curl_waitfds *,curl_waitfd *,unsigned int)", "", "Argument[1]", "Argument[*0].Field[*wfds]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_waitfds_init", "(Curl_waitfds *,curl_waitfd *,unsigned int)", "", "Argument[2]", "Argument[*0].Field[*count]", "value", "dfc-generated"]
+      - ["", "", True, "Curl_wildcard_dtor", "(WildcardData **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_xfer_send", "(Curl_easy *,const void *,size_t,bool,size_t *)", "", "Argument[*4]", "Argument[*0].Field[*info].Field[*request_size]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_xfer_send", "(Curl_easy *,const void *,size_t,bool,size_t *)", "", "Argument[4]", "Argument[*0].Field[*info].Field[*request_size]", "taint", "dfc-generated"]
+      - ["", "", True, "Curl_xfer_send", "(Curl_easy *,const void *,size_t,bool,size_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "SetHTTPrequest", "(OperationConfig *,HttpReq,HttpReq *)", "", "Argument[1]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "SetHTTPrequest", "(OperationConfig *,HttpReq,HttpReq *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "add2list", "(curl_slist **,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "add_file_name_to_url", "(CURL *,char **,const char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_easy_cleanup", "(CURL *)", "", "Argument[0]", "Argument[*0]", "value", "df-generated"]
+      - ["", "", True, "curl_easy_duphandle", "(CURL *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "curl_easy_header", "(CURL *,const char *,size_t,unsigned int,int,curl_header **)", "", "Argument[2]", "Argument[**5].Field[*index]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_nextheader", "(CURL *,unsigned int,int,curl_header *)", "", "Argument[*3].Field[**anchor].Field[**_next]", "ReturnValue[*].Field[**anchor]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_nextheader", "(CURL *,unsigned int,int,curl_header *)", "", "Argument[*3].Field[**anchor].Field[*_next]", "ReturnValue[*].Field[*anchor]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_option_next", "(const curl_easyoption *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_option_next", "(const curl_easyoption *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_easy_option_next", "(const curl_easyoption *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curl_easy_option_next", "(const curl_easyoption *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_easy_pause", "(CURL *,int)", "", "Argument[0]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_perform", "(CURL *)", "", "Argument[0]", "Argument[*0]", "value", "df-generated"]
+      - ["", "", True, "curl_easy_recv", "(CURL *,void *,size_t,size_t *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_recv", "(CURL *,void *,size_t,size_t *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_send", "(CURL *,const void *,size_t,size_t *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_send", "(CURL *,const void *,size_t,size_t *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_upkeep", "(CURL *)", "", "Argument[*0]", "Argument[*0].Field[*conn_queue].Field[**_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_easy_upkeep", "(CURL *)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_formadd", "(curl_httppost **,curl_httppost **,...)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_getdate", "(const char *,const time_t *)", "", "Argument[*0]", "Argument[0]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_getdate", "(const char *,const time_t *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curl_getdate", "(const char *,const time_t *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mime_addpart", "(curl_mime *)", "", "Argument[0]", "Argument[*0].Field[**firstpart].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_addpart", "(curl_mime *)", "", "Argument[0]", "Argument[*0].Field[**lastpart].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_addpart", "(curl_mime *)", "", "Argument[0]", "ReturnValue[*].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data", "(curl_mimepart *,const char *,size_t)", "", "Argument[*1]", "Argument[*0].Field[**data]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data", "(curl_mimepart *,const char *,size_t)", "", "Argument[0]", "Argument[*0].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data", "(curl_mimepart *,const char *,size_t)", "", "Argument[0]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data", "(curl_mimepart *,const char *,size_t)", "", "Argument[1]", "Argument[*0].Field[**data]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mime_data", "(curl_mimepart *,const char *,size_t)", "", "Argument[2]", "Argument[*0].Field[*datasize]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[**5]", "Argument[*0].Field[***arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[*5]", "Argument[*0].Field[**arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[0]", "Argument[*0].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[0]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[1]", "Argument[*0].Field[*datasize]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[2]", "Argument[*0].Field[*readfunc]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[3]", "Argument[*0].Field[*seekfunc]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[4]", "Argument[*0].Field[*freefunc]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_data_cb", "(curl_mimepart *,curl_off_t,curl_read_callback,curl_seek_callback,curl_free_callback,void *)", "", "Argument[5]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_filedata", "(curl_mimepart *,const char *)", "", "Argument[0]", "Argument[*0].Field[**arg].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_filedata", "(curl_mimepart *,const char *)", "", "Argument[0]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_headers", "(curl_mimepart *,curl_slist *,int)", "", "Argument[*1]", "Argument[*0].Field[**userheaders]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_headers", "(curl_mimepart *,curl_slist *,int)", "", "Argument[1]", "Argument[*0].Field[*userheaders]", "value", "dfc-generated"]
+      - ["", "", True, "curl_mime_subparts", "(curl_mimepart *,curl_mime *)", "", "Argument[1]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "curl_multi_add_handle", "(CURLM *,CURL *)", "", "Argument[0]", "Argument[*1].Field[*multi]", "value", "dfc-generated"]
+      - ["", "", True, "curl_multi_add_handle", "(CURLM *,CURL *)", "", "Argument[1]", "Argument[*1].Field[*multi_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_multi_info_read", "(CURLM *,int *)", "", "Argument[*0].Field[*msglist].Field[*_size]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_multi_perform", "(CURLM *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "curl_multi_remove_handle", "(CURLM *,CURL *)", "", "Argument[1]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "curl_multi_socket", "(CURLM *,curl_socket_t,int *)", "", "Argument[*0]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "curl_multi_socket_action", "(CURLM *,curl_socket_t,int,int *)", "", "Argument[*0]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "curl_multi_socket_all", "(CURLM *,int *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "curl_mvaprintf", "(const char *,va_list)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mvfprintf", "(FILE *,const char *,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mvprintf", "(const char *,va_list)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mvsnprintf", "(char *,size_t,const char *,va_list)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_mvsprintf", "(char *,const char *,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_pushheader_byname", "(curl_pushheaders *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "curl_pushheader_byname", "(curl_pushheaders *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "curl_pushheader_bynum", "(curl_pushheaders *,size_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curl_share_setopt", "(CURLSH *,CURLSHoption,...)", "", "Argument[0]", "Argument[*0].Field[*cpool].Field[*share]", "value", "dfc-generated"]
+      - ["", "", True, "curl_slist_append", "(curl_slist *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "curl_slist_append", "(curl_slist *,const char *)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curl_url_dup", "(const CURLU *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "curl_url_get", "(const CURLU *,CURLUPart,char **,unsigned int)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_url_set", "(CURLU *,CURLUPart,const char *,unsigned int)", "", "Argument[*2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "curl_url_set", "(CURLU *,CURLUPart,const char *,unsigned int)", "", "Argument[2]", "Argument[*0]", "taint", "df-generated"]
+      - ["", "", True, "curl_ws_recv", "(CURL *,void *,size_t,size_t *,const curl_ws_frame **)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_ws_recv", "(CURL *,void *,size_t,size_t *,const curl_ws_frame **)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "curl_ws_send", "(CURL *,const void *,size_t,size_t *,curl_off_t,unsigned int)", "", "Argument[0]", "Argument[*0].Field[*conn_queue].Field[*_ptr]", "value", "dfc-generated"]
+      - ["", "", True, "curl_ws_send", "(CURL *,const void *,size_t,size_t *,curl_off_t,unsigned int)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_add", "(dynbuf *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_add", "(dynbuf *,const char *)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[*1]", "Argument[*0].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[2]", "Argument[*0].Field[*allc]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_addn", "(dynbuf *,const void *,size_t)", "", "Argument[2]", "Argument[*0].Field[*leng]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_free", "(dynbuf *)", "", "Argument[*0].Field[*allc]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_init", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*toobig]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_len", "(const dynbuf *)", "", "Argument[*0].Field[*leng]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_ptr", "(const dynbuf *)", "", "Argument[*0].Field[**bufr]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_ptr", "(const dynbuf *)", "", "Argument[*0].Field[*bufr]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_setlen", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_tail", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_tail", "(dynbuf *,size_t)", "", "Argument[1]", "Argument[*0].Field[*leng]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "df-generated"]
+      - ["", "", True, "curlx_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "curlx_dyn_take", "(dynbuf *,size_t *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "curlx_dyn_uptr", "(const dynbuf *)", "", "Argument[*0].Field[**bufr]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_uptr", "(const dynbuf *)", "", "Argument[*0].Field[*bufr]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curlx_dyn_vaddf", "(dynbuf *,const char *,va_list)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_get_line", "(dynbuf *,FILE *)", "", "Argument[1]", "Argument[*0].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_mstotv", "(timeval *,timediff_t)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_mstotv", "(timeval *,timediff_t)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curlx_sitouz", "(int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "curlx_sltosi", "(long)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_sltoui", "(long)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_sltous", "(long)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_sotouz", "(curl_off_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[*0]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[*0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[*0]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[0]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[0]", "Argument[*1]", "value", "dfc-generated"]
+      - ["", "", True, "curlx_strtoofft", "(const char *,char **,int,curl_off_t *)", "", "Argument[0]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_sztosi", "(ssize_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_tvtoms", "(timeval *)", "", "Argument[*0].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_tvtoms", "(timeval *)", "", "Argument[*0].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_uitous", "(unsigned int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_ultouc", "(unsigned long)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_ultous", "(unsigned long)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_uztosi", "(size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_uztosz", "(size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_uztoui", "(size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "curlx_uztoul", "(size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "easysrc_add", "(slist_wc **,const char *)", "", "Argument[**0].Field[**last].Field[**next]", "Argument[**0].Field[**last]", "value", "dfc-generated"]
+      - ["", "", True, "easysrc_add", "(slist_wc **,const char *)", "", "Argument[**0].Field[**last].Field[*next]", "Argument[**0].Field[*last]", "value", "dfc-generated"]
+      - ["", "", True, "easysrc_add", "(slist_wc **,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "findshortopt", "(char)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[**2]", "Argument[**3]", "value", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[**2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[**3]", "Argument[**2]", "value", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[**3]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[*2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[*2]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[*2]", "Argument[*3]", "value", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[*3]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[*3]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[2]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[2]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[2]", "Argument[*2]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[2]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[3]", "Argument[**2]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[3]", "Argument[**3]", "taint", "df-generated"]
+      - ["", "", True, "formparse", "(OperationConfig *,const char *,tool_mime **,tool_mime **,bool)", "", "Argument[3]", "Argument[*3]", "taint", "df-generated"]
+      - ["", "", True, "get_url_file_name", "(GlobalConfig *,char **,const char *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "getparameter", "(const char *,char *,char *,bool *,GlobalConfig *,OperationConfig *)", "", "Argument[*0]", "Argument[*1]", "value", "df-generated"]
+      - ["", "", True, "getparameter", "(const char *,char *,char *,bool *,GlobalConfig *,OperationConfig *)", "", "Argument[*1]", "Argument[*0]", "value", "df-generated"]
+      - ["", "", True, "getparameter", "(const char *,char *,char *,bool *,GlobalConfig *,OperationConfig *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "getparameter", "(const char *,char *,char *,bool *,GlobalConfig *,OperationConfig *)", "", "Argument[4]", "Argument[*4].Field[**last].Field[*global]", "value", "dfc-generated"]
+      - ["", "", True, "getpass_r", "(const char *,char *,size_t)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "getpass_r", "(const char *,char *,size_t)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "glob_cleanup", "(URLGlob **)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_match_url", "(char **,char *,URLGlob *)", "", "Argument[*1]", "Argument[1]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_match_url", "(char **,char *,URLGlob *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_next_url", "(char **,URLGlob *)", "", "Argument[*1].Field[**glob_buffer]", "Argument[**0]", "value", "dfc-generated"]
+      - ["", "", True, "glob_next_url", "(char **,URLGlob *)", "", "Argument[*1].Field[*glob_buffer]", "Argument[**0]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_next_url", "(char **,URLGlob *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_url", "(URLGlob **,char *,curl_off_t *,FILE *)", "", "Argument[*1]", "Argument[**0].Field[*pos]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_url", "(URLGlob **,char *,curl_off_t *,FILE *)", "", "Argument[1]", "Argument[**0].Field[*pos]", "taint", "dfc-generated"]
+      - ["", "", True, "glob_url", "(URLGlob **,char *,curl_off_t *,FILE *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "helpscan", "(unsigned char *,size_t,scan_ctx *)", "", "Argument[*0]", "Argument[*2].Field[*obuf]", "value", "dfc-generated"]
+      - ["", "", True, "helpscan", "(unsigned char *,size_t,scan_ctx *)", "", "Argument[*0]", "Argument[*2].Field[*rbuf]", "value", "dfc-generated"]
+      - ["", "", True, "helpscan", "(unsigned char *,size_t,scan_ctx *)", "", "Argument[0]", "Argument[*2].Field[*obuf]", "taint", "dfc-generated"]
+      - ["", "", True, "helpscan", "(unsigned char *,size_t,scan_ctx *)", "", "Argument[0]", "Argument[*2].Field[*rbuf]", "taint", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[*1]", "Argument[*0].Field[**trigger]", "value", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[*2]", "Argument[*0].Field[**arg]", "value", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[*3]", "Argument[*0].Field[**endarg]", "value", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[1]", "Argument[*0].Field[*trigger]", "value", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[2]", "Argument[*0].Field[*arg]", "value", "dfc-generated"]
+      - ["", "", True, "inithelpscan", "(scan_ctx *,const char *,const char *,const char *)", "", "Argument[3]", "Argument[*0].Field[*endarg]", "value", "dfc-generated"]
+      - ["", "", True, "ipfs_url_rewrite", "(CURLU *,const char *,char **,OperationConfig *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "jsonquoted", "(const char *,size_t,dynbuf *,bool)", "", "Argument[*0]", "Argument[*2].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "jsonquoted", "(const char *,size_t,dynbuf *,bool)", "", "Argument[0]", "Argument[*2].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "new_getout", "(OperationConfig *)", "", "Argument[*0].Field[*default_node_flags]", "ReturnValue[*].Field[*flags]", "value", "dfc-generated"]
+      - ["", "", True, "oct2nummax", "(long *,const char *,long)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "oct2nummax", "(long *,const char *,long)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "oct2nummax", "(long *,const char *,long)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "operate", "(GlobalConfig *,int,char *[])", "", "Argument[0]", "Argument[*0].Field[**last].Field[*global]", "value", "dfc-generated"]
+      - ["", "", True, "parse_args", "(GlobalConfig *,int,char *[])", "", "Argument[0]", "Argument[*0].Field[**last].Field[*global]", "value", "dfc-generated"]
+      - ["", "", True, "parseconfig", "(const char *,GlobalConfig *)", "", "Argument[1]", "Argument[*1].Field[**last].Field[*global]", "value", "dfc-generated"]
+      - ["", "", True, "progress_meter", "(GlobalConfig *,timeval *,bool)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "progressbarinit", "(ProgressData *,OperationConfig *)", "", "Argument[*1].Field[*resume_from]", "Argument[*0].Field[*initial_size]", "value", "dfc-generated"]
+      - ["", "", True, "proto2num", "(OperationConfig *,const char *const *,char **,const char *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "secs2ms", "(long *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "secs2ms", "(long *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "setvariable", "(GlobalConfig *,const char *)", "", "Argument[*0].Field[**variables]", "Argument[*0].Field[**variables].Field[**next]", "value", "dfc-generated"]
+      - ["", "", True, "setvariable", "(GlobalConfig *,const char *)", "", "Argument[*0].Field[*variables]", "Argument[*0].Field[**variables].Field[*next]", "value", "dfc-generated"]
+      - ["", "", True, "slist_wc_append", "(slist_wc *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "df-generated"]
+      - ["", "", True, "slist_wc_append", "(slist_wc *,const char *)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "str2num", "(long *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2num", "(long *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2offset", "(curl_off_t *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2offset", "(curl_off_t *,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2offset", "(curl_off_t *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unum", "(long *,const char *)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unum", "(long *,const char *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unum", "(long *,const char *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unummax", "(long *,const char *,long)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unummax", "(long *,const char *,long)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "str2unummax", "(long *,const char *,long)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "tool2curlmime", "(CURL *,tool_mime *,curl_mime **)", "", "Argument[*2]", "Argument[**2].Field[**firstpart].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "tool2curlmime", "(CURL *,tool_mime *,curl_mime **)", "", "Argument[*2]", "Argument[**2].Field[**lastpart].Field[*parent]", "value", "dfc-generated"]
+      - ["", "", True, "tool2curlmime", "(CURL *,tool_mime *,curl_mime **)", "", "Argument[2]", "Argument[**2].Field[**firstpart].Field[*parent]", "taint", "dfc-generated"]
+      - ["", "", True, "tool2curlmime", "(CURL *,tool_mime *,curl_mime **)", "", "Argument[2]", "Argument[**2].Field[**lastpart].Field[*parent]", "taint", "dfc-generated"]
+      - ["", "", True, "tool2curlmime", "(CURL *,tool_mime *,curl_mime **)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "tool_header_cb", "(char *,size_t,size_t,void *)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tool_header_cb", "(char *,size_t,size_t,void *)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tool_mime_stdin_read", "(char *,size_t,size_t,void *)", "", "Argument[2]", "Argument[*3].Field[*curpos]", "taint", "dfc-generated"]
+      - ["", "", True, "tool_mime_stdin_read", "(char *,size_t,size_t,void *)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "tool_mime_stdin_seek", "(void *,curl_off_t,int)", "", "Argument[*0].Field[*size]", "Argument[*0].Field[*curpos]", "taint", "dfc-generated"]
+      - ["", "", True, "tool_mime_stdin_seek", "(void *,curl_off_t,int)", "", "Argument[1]", "Argument[*0].Field[*curpos]", "value", "dfc-generated"]
+      - ["", "", True, "tool_read_cb", "(char *,size_t,size_t,void *)", "", "Argument[*3]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "tool_setopt_slist", "(CURL *,GlobalConfig *,const char *,CURLoption,curl_slist *)", "", "Argument[*4].Field[**next].Field[**next]", "Argument[*4]", "value", "dfc-generated"]
+      - ["", "", True, "tool_setopt_slist", "(CURL *,GlobalConfig *,const char *,CURLoption,curl_slist *)", "", "Argument[*4].Field[**next]", "Argument[*4]", "value", "dfc-generated"]
+      - ["", "", True, "tvdiff", "(timeval,timeval)", "", "Argument[0].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tvdiff", "(timeval,timeval)", "", "Argument[0].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tvdiff", "(timeval,timeval)", "", "Argument[1].Field[*tv_sec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "tvdiff", "(timeval,timeval)", "", "Argument[1].Field[*tv_usec]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "varexpand", "(GlobalConfig *,const char *,dynbuf *,bool *)", "", "Argument[*1]", "Argument[*2].Field[**bufr]", "value", "dfc-generated"]
+      - ["", "", True, "varexpand", "(GlobalConfig *,const char *,dynbuf *,bool *)", "", "Argument[1]", "Argument[*2].Field[**bufr]", "taint", "dfc-generated"]
+      - ["", "", True, "varexpand", "(GlobalConfig *,const char *,dynbuf *,bool *)", "", "Argument[1]", "Argument[*2].Field[*allc]", "taint", "dfc-generated"]
+      - ["", "", True, "varexpand", "(GlobalConfig *,const char *,dynbuf *,bool *)", "", "Argument[1]", "Argument[*2].Field[*leng]", "taint", "dfc-generated"]
+      - ["", "", True, "xferinfo_cb", "(void *,curl_off_t,curl_off_t,curl_off_t,curl_off_t)", "", "Argument[1]", "Argument[*0].Field[*dltotal]", "value", "dfc-generated"]
+      - ["", "", True, "xferinfo_cb", "(void *,curl_off_t,curl_off_t,curl_off_t,curl_off_t)", "", "Argument[2]", "Argument[*0].Field[*dlnow]", "value", "dfc-generated"]
+      - ["", "", True, "xferinfo_cb", "(void *,curl_off_t,curl_off_t,curl_off_t,curl_off_t)", "", "Argument[3]", "Argument[*0].Field[*ultotal]", "value", "dfc-generated"]
+      - ["", "", True, "xferinfo_cb", "(void *,curl_off_t,curl_off_t,curl_off_t,curl_off_t)", "", "Argument[4]", "Argument[*0].Field[*ulnow]", "value", "dfc-generated"]

cpp/ql/lib/ext/generated/libidn2/libidn2.model.yml

@@ -0,0 +1,148 @@
+# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data:
+      - ["", "", True, "_idn2_punycode_decode", "(size_t,const char[],size_t *,uint32_t[])", "", "Argument[*1]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_decode", "(size_t,const char[],size_t *,uint32_t[])", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_decode", "(size_t,const char[],size_t *,uint32_t[])", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_decode", "(size_t,const char[],size_t *,uint32_t[])", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_encode", "(size_t,const uint32_t[],size_t *,char[])", "", "Argument[*1]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_encode", "(size_t,const uint32_t[],size_t *,char[])", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "_idn2_punycode_encode", "(size_t,const uint32_t[],size_t *,char[])", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "c_strcasecmp", "(const char *,const char *)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strcasecmp", "(const char *,const char *)", "", "Argument[*1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strcasecmp", "(const char *,const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strcasecmp", "(const char *,const char *)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strncasecmp", "(const char *,const char *,size_t)", "", "Argument[*0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strncasecmp", "(const char *,const char *,size_t)", "", "Argument[*1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strncasecmp", "(const char *,const char *,size_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_strncasecmp", "(const char *,const char *,size_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "c_tolower", "(int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "c_toupper", "(int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "cmdline_parser2", "(int,char **,gengetopt_args_info *,int,int,int)", "", "Argument[**1]", "Argument[*2].Field[***inputs]", "value", "dfc-generated"]
+      - ["", "", True, "cmdline_parser2", "(int,char **,gengetopt_args_info *,int,int,int)", "", "Argument[*1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser2", "(int,char **,gengetopt_args_info *,int,int,int)", "", "Argument[0]", "Argument[*2].Field[*inputs_num]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser2", "(int,char **,gengetopt_args_info *,int,int,int)", "", "Argument[1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser", "(int,char **,gengetopt_args_info *)", "", "Argument[**1]", "Argument[*2].Field[***inputs]", "value", "dfc-generated"]
+      - ["", "", True, "cmdline_parser", "(int,char **,gengetopt_args_info *)", "", "Argument[*1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser", "(int,char **,gengetopt_args_info *)", "", "Argument[0]", "Argument[*2].Field[*inputs_num]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser", "(int,char **,gengetopt_args_info *)", "", "Argument[1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser_ext", "(int,char **,gengetopt_args_info *,cmdline_parser_params *)", "", "Argument[**1]", "Argument[*2].Field[***inputs]", "value", "dfc-generated"]
+      - ["", "", True, "cmdline_parser_ext", "(int,char **,gengetopt_args_info *,cmdline_parser_params *)", "", "Argument[*1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser_ext", "(int,char **,gengetopt_args_info *,cmdline_parser_params *)", "", "Argument[0]", "Argument[*2].Field[*inputs_num]", "taint", "dfc-generated"]
+      - ["", "", True, "cmdline_parser_ext", "(int,char **,gengetopt_args_info *,cmdline_parser_params *)", "", "Argument[1]", "Argument[*2].Field[***inputs]", "taint", "dfc-generated"]
+      - ["", "", True, "get_map_data", "(uint32_t *,const IDNAMap *)", "", "Argument[*1].Field[*nmappings]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_map_data", "(uint32_t *,const IDNAMap *)", "", "Argument[*1].Field[*offset]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "get_map_data", "(uint32_t *,const IDNAMap *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "get_stat_atime", "(const stat *)", "", "Argument[*0].Field[*st_atim]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_stat_atime_ns", "(const stat *)", "", "Argument[*0].Field[*st_atim].Field[*tv_nsec]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_stat_ctime", "(const stat *)", "", "Argument[*0].Field[*st_ctim]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_stat_ctime_ns", "(const stat *)", "", "Argument[*0].Field[*st_ctim].Field[*tv_nsec]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_stat_mtime", "(const stat *)", "", "Argument[*0].Field[*st_mtim]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "get_stat_mtime_ns", "(const stat *)", "", "Argument[*0].Field[*st_mtim].Field[*tv_nsec]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[*0]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[*2]", "Argument[*0]", "value", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[0]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[1]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "gl_uninorm_decompose_merge_sort_inplace", "(ucs4_with_ccc *,size_t,ucs4_with_ccc *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_lookup_u8", "(const uint8_t *,uint8_t **,int)", "", "Argument[*0]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_lookup_u8", "(const uint8_t *,uint8_t **,int)", "", "Argument[0]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_decode", "(const char *,size_t,uint32_t *,size_t *)", "", "Argument[*0]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_decode", "(const char *,size_t,uint32_t *,size_t *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_decode", "(const char *,size_t,uint32_t *,size_t *)", "", "Argument[2]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_decode", "(const char *,size_t,uint32_t *,size_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_encode", "(const uint32_t *,size_t,char *,size_t *)", "", "Argument[*0]", "Argument[*2]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_encode", "(const uint32_t *,size_t,char *,size_t *)", "", "Argument[0]", "Argument[*2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_punycode_encode", "(const uint32_t *,size_t,char *,size_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_register_u8", "(const uint8_t *,const uint8_t *,uint8_t **,int)", "", "Argument[*0]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_register_u8", "(const uint8_t *,const uint8_t *,uint8_t **,int)", "", "Argument[*1]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_register_u8", "(const uint8_t *,const uint8_t *,uint8_t **,int)", "", "Argument[0]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_register_u8", "(const uint8_t *,const uint8_t *,uint8_t **,int)", "", "Argument[1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_register_ul", "(const char *,const char *,char **,int)", "", "Argument[*1]", "Argument[**2]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_register_ul", "(const char *,const char *,char **,int)", "", "Argument[1]", "Argument[**2]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_to_ascii_8z", "(const char *,char **,int)", "", "Argument[*0]", "Argument[**1]", "value", "dfc-generated"]
+      - ["", "", True, "idn2_to_ascii_8z", "(const char *,char **,int)", "", "Argument[0]", "Argument[**1]", "taint", "dfc-generated"]
+      - ["", "", True, "idn2_to_unicode_44i", "(const uint32_t *,size_t,uint32_t *,size_t *,int)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "last_component", "(const char *)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "last_component", "(const char *)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "last_component", "(const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "mem_cd_iconveh", "(const char *,size_t,const iconveh_t *,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[6]", "Argument[*6]", "taint", "dfc-generated"]
+      - ["", "", True, "mem_iconveh", "(const char *,size_t,const char *,const char *,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[*0]", "Argument[**6]", "value", "dfc-generated"]
+      - ["", "", True, "mem_iconveh", "(const char *,size_t,const char *,const char *,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[0]", "Argument[**6]", "taint", "dfc-generated"]
+      - ["", "", True, "mem_iconveh", "(const char *,size_t,const char *,const char *,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[1]", "Argument[*7]", "value", "dfc-generated"]
+      - ["", "", True, "mem_iconveh", "(const char *,size_t,const char *,const char *,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[7]", "Argument[*7]", "taint", "dfc-generated"]
+      - ["", "", True, "mem_iconveha", "(const char *,size_t,const char *,const char *,bool,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[*0]", "Argument[**7]", "value", "dfc-generated"]
+      - ["", "", True, "mem_iconveha", "(const char *,size_t,const char *,const char *,bool,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[0]", "Argument[**7]", "taint", "dfc-generated"]
+      - ["", "", True, "mem_iconveha", "(const char *,size_t,const char *,const char *,bool,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[1]", "Argument[*8]", "value", "dfc-generated"]
+      - ["", "", True, "mem_iconveha", "(const char *,size_t,const char *,const char *,bool,iconv_ilseq_handler,size_t *,char **,size_t *)", "", "Argument[8]", "Argument[*8]", "taint", "dfc-generated"]
+      - ["", "", True, "stat_time_normalize", "(int,stat *)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "str_iconveh", "(const char *,const char *,const char *,iconv_ilseq_handler)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "str_iconveh", "(const char *,const char *,const char *,iconv_ilseq_handler)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "str_iconveha", "(const char *,const char *,const char *,bool,iconv_ilseq_handler)", "", "Argument[*0]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "str_iconveha", "(const char *,const char *,const char *,bool,iconv_ilseq_handler)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[*1]", "Argument[*3]", "value", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[*1]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[*3]", "ReturnValue[*]", "value", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[1]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[1]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[3]", "Argument[*3]", "taint", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[3]", "ReturnValue", "value", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[3]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "u32_normalize", "(uninorm_t,const uint32_t *,size_t,uint32_t *,uint32_t *__restrict__,size_t *)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]
+      - ["", "", True, "u8_mbtouc_aux", "(ucs4_t *,const uint8_t *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "u8_mbtouc_aux", "(ucs4_t *,const uint8_t *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "uc_bidi_category", "(ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_bidi_class", "(ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_canonical_decomposition", "(ucs4_t,ucs4_t *)", "", "Argument[0]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "uc_canonical_decomposition", "(ucs4_t,ucs4_t *)", "", "Argument[1]", "Argument[*1]", "taint", "dfc-generated"]
+      - ["", "", True, "uc_combining_class", "(ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_composition", "(ucs4_t,ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_composition", "(ucs4_t,ucs4_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_general_category", "(ucs4_t)", "", "Argument[0]", "ReturnValue.Field[*bitmask]", "taint", "dfc-generated"]
+      - ["", "", True, "uc_is_general_category_withtable", "(ucs4_t,uint32_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_is_general_category_withtable", "(ucs4_t,uint32_t)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_joining_type", "(ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_script", "(ucs4_t)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"]
+      - ["", "", True, "uc_script", "(ucs4_t)", "", "Argument[0]", "ReturnValue[*]", "taint", "dfc-generated"]
+      - ["", "", True, "uc_script_byname", "(const char *)", "", "Argument[*0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "uc_script_byname", "(const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "uc_script_byname", "(const char *)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"]
+      - ["", "", True, "uc_script_byname", "(const char *)", "", "Argument[0]", "ReturnValue[*]", "taint", "df-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[*2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc", "(FILE *,const char *,const char *,const char *,...)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[**4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[*2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[*4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_ar", "(FILE *,const char *,const char *,const char *,const char *const *)", "", "Argument[4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[**4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[*2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[*4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_arn", "(FILE *,const char *,const char *,const char *,const char *const *,size_t)", "", "Argument[4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[*1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[*2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[*3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[*4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[1]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[2]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[3]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[4]", "Argument[*0]", "taint", "dfc-generated"]
+      - ["", "", True, "version_etc_va", "(FILE *,const char *,const char *,const char *,va_list)", "", "Argument[4]", "Argument[*4]", "taint", "dfc-generated"]