Swift: fix inout parameter conflation at return

Author: rdmarsh2

swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll

@@ -73,7 +73,12 @@ private module Cached {
     }
 
   private predicate localSsaFlowStepUseUse(Ssa::Definition def, Node nodeFrom, Node nodeTo) {
-    def.adjacentReadPair(nodeFrom.getCfgNode(), nodeTo.getCfgNode())
+    def.adjacentReadPair(nodeFrom.getCfgNode(), nodeTo.getCfgNode()) and
+    (
+      nodeTo instanceof InoutReturnNode
+      implies
+      nodeTo.(InoutReturnNode).getParameter() = def.getSourceVariable()
+    )
   }
 
   private predicate localFlowStepCommon(Node nodeFrom, Node nodeTo) {
@@ -84,7 +89,12 @@ private module Cached {
       or
       // step from def to first read
       nodeFrom.asDefinition() = def and
-      nodeTo.getCfgNode() = def.getAFirstRead()
+      nodeTo.getCfgNode() = def.getAFirstRead() and
+      (
+        nodeTo instanceof InoutReturnNode
+        implies
+        nodeTo.(InoutReturnNode).getParameter() = def.getSourceVariable()
+      )
       or
       // use-use flow
       localSsaFlowStepUseUse(def, nodeFrom, nodeTo)

swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected

@@ -15,16 +15,12 @@ edges
 | test.swift:54:11:54:18 | call to source :  | test.swift:55:5:55:5 | arg[return] :  |
 | test.swift:55:5:55:5 | arg[return] :  | test.swift:61:5:61:24 | arg :  |
 | test.swift:61:5:61:24 | arg :  | test.swift:62:15:62:15 | x |
-| test.swift:65:16:65:28 | WriteDef :  | test.swift:69:5:69:5 | arg1[return] :  |
 | test.swift:65:16:65:28 | WriteDef :  | test.swift:69:5:69:5 | arg2[return] :  |
-| test.swift:65:16:65:28 | arg1 :  | test.swift:69:5:69:5 | arg1[return] :  |
 | test.swift:65:16:65:28 | arg1 :  | test.swift:69:5:69:5 | arg2[return] :  |
 | test.swift:73:18:73:25 | call to source :  | test.swift:75:21:75:22 | &... :  |
-| test.swift:75:5:75:33 | arg1 :  | test.swift:76:15:76:15 | x |
 | test.swift:75:5:75:33 | arg2 :  | test.swift:77:15:77:15 | y |
 | test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | WriteDef :  |
 | test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  |
-| test.swift:75:21:75:22 | &... :  | test.swift:75:5:75:33 | arg1 :  |
 | test.swift:75:21:75:22 | &... :  | test.swift:75:5:75:33 | arg2 :  |
 nodes
 | test.swift:6:19:6:26 | call to source :  | semmle.label | call to source :  |
@@ -55,18 +51,13 @@ nodes
 | test.swift:65:16:65:28 | WriteDef :  | semmle.label | arg1 :  |
 | test.swift:65:16:65:28 | arg1 :  | semmle.label | WriteDef :  |
 | test.swift:65:16:65:28 | arg1 :  | semmle.label | arg1 :  |
-| test.swift:69:5:69:5 | arg1[return] :  | semmle.label | arg1[return] :  |
 | test.swift:69:5:69:5 | arg2[return] :  | semmle.label | arg2[return] :  |
 | test.swift:73:18:73:25 | call to source :  | semmle.label | call to source :  |
-| test.swift:75:5:75:33 | arg1 :  | semmle.label | arg1 :  |
 | test.swift:75:5:75:33 | arg2 :  | semmle.label | arg2 :  |
 | test.swift:75:21:75:22 | &... :  | semmle.label | &... :  |
-| test.swift:76:15:76:15 | x | semmle.label | x |
 | test.swift:77:15:77:15 | y | semmle.label | y |
 subpaths
-| test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | WriteDef :  | test.swift:69:5:69:5 | arg1[return] :  | test.swift:75:5:75:33 | arg1 :  |
 | test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | WriteDef :  | test.swift:69:5:69:5 | arg2[return] :  | test.swift:75:5:75:33 | arg2 :  |
-| test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  | test.swift:69:5:69:5 | arg1[return] :  | test.swift:75:5:75:33 | arg1 :  |
 | test.swift:75:21:75:22 | &... :  | test.swift:65:16:65:28 | arg1 :  | test.swift:69:5:69:5 | arg2[return] :  | test.swift:75:5:75:33 | arg2 :  |
 #select
 | test.swift:7:15:7:15 | t1 | test.swift:6:19:6:26 | call to source :  | test.swift:7:15:7:15 | t1 | result |
@@ -77,5 +68,4 @@ subpaths
 | test.swift:39:15:39:29 | call to callee_source | test.swift:35:12:35:19 | call to source :  | test.swift:39:15:39:29 | call to callee_source | result |
 | test.swift:50:15:50:15 | t | test.swift:43:19:43:26 | call to source :  | test.swift:50:15:50:15 | t | result |
 | test.swift:62:15:62:15 | x | test.swift:54:11:54:18 | call to source :  | test.swift:62:15:62:15 | x | result |
-| test.swift:76:15:76:15 | x | test.swift:73:18:73:25 | call to source :  | test.swift:76:15:76:15 | x | result |
 | test.swift:77:15:77:15 | y | test.swift:73:18:73:25 | call to source :  | test.swift:77:15:77:15 | y | result |

swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected

@@ -38,9 +38,7 @@
 | test.swift:66:9:66:15 | WriteDef | test.swift:68:12:68:12 | temp |
 | test.swift:66:21:66:21 | arg1 | test.swift:66:9:66:15 | WriteDef |
 | test.swift:67:5:67:12 | WriteDef | test.swift:69:5:69:5 | arg1[return] |
-| test.swift:67:5:67:12 | WriteDef | test.swift:69:5:69:5 | arg2[return] |
 | test.swift:67:12:67:12 | arg2 | test.swift:67:5:67:12 | WriteDef |
-| test.swift:68:5:68:12 | WriteDef | test.swift:69:5:69:5 | arg1[return] |
 | test.swift:68:5:68:12 | WriteDef | test.swift:69:5:69:5 | arg2[return] |
 | test.swift:68:12:68:12 | temp | test.swift:68:5:68:12 | WriteDef |
 | test.swift:73:9:73:12 | WriteDef | test.swift:75:22:75:22 | x |