From a32f4a54ac57ff6195c12862be1c3319bb6969cd Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Sun, 8 Nov 2026 19:04:45 +0100 Subject: [PATCH 1/2] C++: Accept test changes after github/codeql#23046. --- .../OwnedPointerValueStoredInUnrelatedSmartPointer.expected | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected b/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected index 00f3128a8b..2e1a77ec93 100644 --- a/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected +++ b/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected @@ -21,6 +21,8 @@ edges | test.cpp:5:24:5:25 | call to shared_ptr | test.cpp:6:28:6:29 | p1 | provenance | | | test.cpp:5:27:5:28 | v1 | test.cpp:5:24:5:25 | call to shared_ptr | provenance | Config | | test.cpp:5:27:5:28 | v1 | test.cpp:5:24:5:25 | call to shared_ptr | provenance | Config | +| test.cpp:5:27:5:28 | v1 | test.cpp:5:24:5:25 | call to shared_ptr | provenance | TaintFunction | +| test.cpp:5:27:5:28 | v1 | test.cpp:5:24:5:25 | call to shared_ptr | provenance | TaintFunction | | test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance | Config | | test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance | Config | | test.cpp:8:3:8:14 | ... = ... | test.cpp:9:28:9:29 | v2 | provenance | | From 887cc8dba2c66366a948504122e747b87707da18 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 9 Nov 2026 21:17:19 +0100 Subject: [PATCH 2/2] C++: Select the indirect node for the sink in 'cpp/autosar/invalid-function-return-type'. --- cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql b/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql index 6b94c68cff..cbcc59d0f4 100644 --- a/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql +++ b/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql @@ -24,7 +24,9 @@ where p.getUnderlyingType().isDeeplyConst() and p.getType() instanceof DerivedType and p.getFunction().getType().stripTopLevelSpecifiers() instanceof DerivedType and - DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::exprNode(ret.getExpr())) + // `parameterNode` on a reference parameter gives back the node representing the indirection of the + // reference, so we pick the indirect node for the return expression. + DataFlow::localFlow(DataFlow::parameterNode(p), DataFlow::indirectExprNode(ret.getExpr())) select ret, "Function " + p.getFunction().getName() + " returns a reference or a pointer to $@ that is passed by reference to const.", p, "parameter"