github
diff --git a/‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎
Lines changed: 5 additions & 0 deletions b/‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎
Lines changed: 5 additions & 0 deletions
@@ -677,6 +677,11 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
       exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel |
         f.hasDataFlow(inModel, outModel) and
         (
+          exists(int iIn |
+            inModel.isParameterDeref(iIn) and
+            call.passesByReference(iIn, fromExpr)
+          )
+          or
           exists(int iIn |
             inModel.isParameter(iIn) and
             fromExpr = call.getArgument(iIn)