C++: Minor correction in one of the string models.

geoffw0 · geoffw0 · commit 0952fb9777da · 2020-08-27T10:13:12.000+01:00
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll
@@ -16,7 +16,7 @@ class StdStringCStr extends TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
     input.isQualifierObject() and
-    output.isReturnValue()
+    output.isReturnValueDeref()
   }
 }
 
@@ -29,7 +29,7 @@ class StdStringData extends TaintFunction {
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     // flow from string itself (qualifier) to return value
     input.isQualifierObject() and
-    output.isReturnValue()
+    output.isReturnValueDeref()
     or
     // reverse flow from returned reference to the qualifier (for writes to
     // `data`)
