C++: Support 'ReturnValue' in both sources and sinks.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

@@ -139,6 +139,28 @@ private class ConversionCall extends Call {
 private module Input2 implements Impl::Private::InputSig2 {
   private import codeql.util.Void
 
+  pragma[nomagic]
+  private predicate hasFunctionAndIndirectionIndex(
+    Function f, int indirectionIndex, Ssa::ExplicitDefinition def
+  ) {
+    def.getFunction() = f and
+    def.getSourceVariable().getIRVariable() instanceof IRReturnVariable and
+    def.getIndirectionIndex() = indirectionIndex
+  }
+
+  /** Holds if `def` defines `e` as a returned value with return kind `rk`. */
+  bindingset[rk, e]
+  private predicate isReturnExpr(Function f, ReturnKind rk, Expr e) {
+    exists(Ssa::ExplicitDefinition def |
+      hasFunctionAndIndirectionIndex(f, rk.getIndirectionIndex(), def) and
+      e =
+        def.getAssignedInstruction()
+            .(StoreInstruction)
+            .getSourceValue()
+            .getUnconvertedResultExpression()
+    )
+  }
+
   class SourceSinkReportingElement extends Element {
     SourceSinkReportingElement() { this instanceof Expr or this instanceof Parameter }
 
@@ -159,13 +181,25 @@ private module Input2 implements Impl::Private::InputSig2 {
       result = this.(ConversionCall).getQualifier().(LambdaExpression).getLambdaFunction()
     }
 
+    /** Gets the function invoked when this element is used as a callback. */
+    private Function getCallbackFunction() {
+      // Taking the address of a function
+      result = this.(FunctionAccess).getTarget()
+      or
+      // Passing an object with an overloaded `operator()`
+      result = this.getOperatorCallFunction()
+    }
+
     SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) {
-      exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
-        // Taking the address of a function
-        result = pos.getParameter(this.(FunctionAccess).getTarget())
+      exists(Function f | f = this.getCallbackFunction() |
+        exists(ParameterPosition pos | sc = Impl::Private::SummaryComponent::parameter(pos) |
+          result = pos.getParameter(f)
+        )
         or
-        // Passing an object with an overloaded `operator()`
-        result = pos.getParameter(this.getOperatorCallFunction())
+        exists(ReturnKind rk |
+          sc = Impl::Private::SummaryComponent::return(rk) and
+          isReturnExpr(f, rk, result)
+        )
       )
     }
   }
@@ -197,6 +231,12 @@ private module Input2 implements Impl::Private::InputSig2 {
       pragma[only_bind_out](rk.getIndirectionIndex())
   }
 
+  pragma[nomagic]
+  private predicate hasKindAndEnclosingFunction(Function f, ReturnKind rk, ReturnNode r) {
+    r.getEnclosingCallable().asSourceCallable() = f and
+    r.getKind() = rk
+  }
+
   bindingset[e, sc]
   Node getSourceDataFlowNode(SourceSinkReportingElement e, Impl::Private::SummaryComponent sc) {
     exists(DataFlowCall call |
@@ -210,14 +250,22 @@ private module Input2 implements Impl::Private::InputSig2 {
         result.(PostUpdateNode).getPreUpdateNode().asIndirectExpr(pos.getIndirectionIndex()) = e
       )
       or
-      exists(ReturnKind rk |
-        sc = Impl::Private::SummaryComponent::return(rk) and
-        e = call.asCallInstruction().getUnconvertedResultExpression()
-      |
-        rk.getIndirectionIndex() = 0 and
-        simpleOutNode(result, call.asCallInstruction())
+      exists(ReturnKind rk | sc = Impl::Private::SummaryComponent::return(rk) |
+        // When `e` is a call the node becomes an `OutNode`.
+        e = call.asCallInstruction().getUnconvertedResultExpression() and
+        (
+          rk.getIndirectionIndex() = 0 and
+          simpleOutNode(result, call.asCallInstruction())
+          or
+          result = getIndirectReturn(call.asCallInstruction(), rk)
+        )
         or
-        result = getIndirectReturn(call.asCallInstruction(), rk)
+        exists(Function f |
+          // And when `e` is the returned expression from a function the node
+          // is the `ReturnNode`.
+          isReturnExpr(f, rk, e) and
+          hasKindAndEnclosingFunction(f, rk, result)
+        )
       )
     )
     or
@@ -246,6 +294,12 @@ private module Input2 implements Impl::Private::InputSig2 {
       pos.getArgument(call.getUnconvertedResultExpression()) = e and
       result.(ArgumentNode).sourceArgumentOf(call, pos)
     )
+    or
+    exists(Function f, ReturnKind rk |
+      sc = Impl::Private::SummaryComponent::return(rk) and
+      isReturnExpr(f, rk, e) and
+      hasKindAndEnclosingFunction(f, rk, result)
+    )
   }
 }