github
diff --git a/‎cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll‎
Lines changed: 5 additions & 4 deletions b/‎cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll‎
Lines changed: 5 additions & 4 deletions
@@ -20,8 +20,9 @@ class StdPairConstructor extends Constructor, TaintFunction {
   }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    // taint flow from any parameter of a value type to the qualifier
-    input.isParameterDeref(getAValueTypeParameterIndex()) and
+    // taint flow from second parameter of a value type to the qualifier
+    getAValueTypeParameterIndex() = 1 and
+    input.isParameterDeref(1) and
     (
       output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
       or
@@ -37,8 +38,8 @@ class StdMakePair extends TaintFunction {
   StdMakePair() { this.hasQualifiedName("std", "make_pair") }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
-    // taint flow from any parameter to the returned object
-    input.isParameterDeref([0, 1]) and
+    // taint flow from first parameter to the returned object
+    input.isParameterDeref(1) and
     output.isReturnValue()
   }
 }
Original file line number	Diff line number	Diff line change
`@@ -20,8 +20,9 @@ class StdPairConstructor extends Constructor, TaintFunction {`
`20`	`20`	`}`
`21`	`21`
`22`	`22`	`override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {`
`23`		`- // taint flow from any parameter of a value type to the qualifier`
`24`		`- input.isParameterDeref(getAValueTypeParameterIndex()) and`
	`23`	`+ // taint flow from second parameter of a value type to the qualifier`
	`24`	`+ getAValueTypeParameterIndex() = 1 and`
	`25`	`+ input.isParameterDeref(1) and`
`25`	`26`	`(`
`26`	`27`	`output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object`
`27`	`28`	`or`
`@@ -37,8 +38,8 @@ class StdMakePair extends TaintFunction {`
`37`	`38`	`StdMakePair() { this.hasQualifiedName("std", "make_pair") }`
`38`	`39`
`39`	`40`	`override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {`
`40`		`- // taint flow from any parameter to the returned object`
`41`		`- input.isParameterDeref([0, 1]) and`
	`41`	`+ // taint flow from first parameter to the returned object`
	`42`	`+ input.isParameterDeref(1) and`
`42`	`43`	`output.isReturnValue()`
`43`	`44`	`}`
`44`	`45`	`}`