C++: reverse flow for iterator operator qualifiers

Robert Marsh · Robert Marsh · commit 87b657054f1b · 2020-08-31T14:53:05.000-07:00
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
@@ -184,6 +184,9 @@ class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction, Ta
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierAddress() and
     output.isReturnValue()
+    or
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -234,6 +237,9 @@ class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFun
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierAddress() and
     output.isReturnValue()
+    or
+    input.isReturnValueDeref() and
+    output.isQualifierObject()
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
