Hello,

the following sample program illustrates the issue:

int taint_src(void) {
  return 42;
}

void getNumber(std::shared_ptr<int> ptr) {
  *ptr = taint_src();
}

int main(void) {
  std::shared_ptr<int> ptr_main(new int);

  getNumber(ptr_main);

  return *ptr_main;
}

The idea is to track the taint flow from the call to taint_src to the return value of main.

I'm having problems modelling getNumber to specify that ptr_main should be tainted after the call to getNumber returns. None of the predicates in DataFlowFunction or TaintFunction seem to be able to model this, as the argument ptr_main is passed by value. Is there anyway to model the taint flow for such cases?

(If anyone is trying to model this, do note that std::shared_ptr::operator* is const qualified, and hence Issue 5116 will also crop up until it is fixed.)