C++: Add ComPtr conversion operators

cpp/ql/lib/change-notes/2025-08-28-comptr.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow summaries for the `Microsoft::WRL::ComPtr` member functions.

cpp/ql/lib/ext/ComPtr.model.yml

@@ -13,9 +13,19 @@ extensions:
       - ["Microsoft::WRL", "ComPtr<T>", True, "CopyTo", "(T **)", "", "Argument[-1].Element[@]", "Argument[**@0]", "value", "manual"]
       - ["Microsoft::WRL", "ComPtr", True, "CopyTo<T>", "(T **)", "", "Argument[-1].Element[@]", "Argument[**@0]", "value", "manual"]
       - ["Microsoft::WRL", "ComPtr", True, "CopyTo", "(REFIID,void **)", "", "Argument[-1].Element[@]", "Argument[**@1]", "value", "manual"]
-      - ["Microsoft::WRL", "ComPtr", True, "Detach", "", "", "Argument[-1].Element[@]", "ReturnValue[*]", "value", "manual"]
-      - ["Microsoft::WRL", "ComPtr", True, "Get", "", "", "Argument[-1].Element[@]", "ReturnValue[*]", "value", "manual"]
-      - ["Microsoft::WRL", "ComPtr", True, "GetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**]", "value", "manual"]
-      - ["Microsoft::WRL", "ComPtr", True, "ReleaseAndGetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "Detach", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "Get", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "GetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "ReleaseAndGetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
       - ["Microsoft::WRL", "ComPtr", True, "Swap", "", "", "Argument[-1]", "Argument[*0]", "value", "manual"]
       - ["Microsoft::WRL", "ComPtr", True, "Swap", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator&", "", "", "Argument[-1]", "ReturnValue.Element", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator->", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr<T>", True, "operator=", "(T *)", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr<T>", True, "operator=", "(T *)", "", "Argument[*@0]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=<U>", "(U *)", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=<U>", "(U *)", "", "Argument[*@0]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=", "(const ComPtr &)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=", "(const ComPtr &)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=", "(ComPtr &&)", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
+      - ["Microsoft::WRL", "ComPtr", True, "operator=", "(ComPtr &&)", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]

cpp/ql/lib/ext/ComPtrRef.model.yml

@@ -0,0 +1,12 @@
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["Microsoft::WRL::Details", "ComPtrRef", True, "ComPtrRef", "", "", "Argument[*0]", "Argument[-1].Element[@]", "value", "manual"]
+      - ["Microsoft::WRL::Details", "ComPtrRef", True, "GetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+      # TODO: We cannot yet model https://learn.microsoft.com/en-us/cpp/cppcx/wrl/comptrref-class?view=msvc-170#operator-interfacetype-star-star
+      - ["Microsoft::WRL::Details", "ComPtrRef", True, "operator*", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
+      # TODO: We cannot yet model https://learn.microsoft.com/en-us/cpp/cppcx/wrl/comptrref-class?view=msvc-170#operator-t-star
+      - ["Microsoft::WRL::Details", "ComPtrRef", True, "operator void**", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]
+      - ["Microsoft::WRL::Details", "ComPtrRef", True, "ReleaseAndGetAddressOf", "", "", "Argument[-1].Element[@]", "ReturnValue[**@]", "value", "manual"]

cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected

@@ -6,12 +6,14 @@
 | Dubious member name "operator LPWSTR" in summary model. |
 | Dubious member name "operator PCXSTR" in summary model. |
 | Dubious member name "operator PXSTR" in summary model. |
+| Dubious member name "operator void**" in summary model. |
 | Dubious member name "operator&" in summary model. |
 | Dubious member name "operator*" in summary model. |
 | Dubious member name "operator+" in summary model. |
 | Dubious member name "operator+=" in summary model. |
 | Dubious member name "operator->" in summary model. |
 | Dubious member name "operator=" in summary model. |
+| Dubious member name "operator=<U>" in summary model. |
 | Dubious member name "operator[]" in summary model. |
 | Dubious signature "(..(*)(..))" in summary model. |
 | Dubious signature "(..(*)(..),..(*)(..),..(*)(..),..(*)(..))" in summary model. |
@@ -2497,6 +2499,7 @@
 | Dubious signature "(TS_VERIFY_CTX *,unsigned char *,long)" in summary model. |
 | Dubious signature "(TXT_DB *,OPENSSL_STRING *)" in summary model. |
 | Dubious signature "(TXT_DB *,int,..(*)(..),OPENSSL_LH_HASHFUNC,OPENSSL_LH_COMPFUNC)" in summary model. |
+| Dubious signature "(U *)" in summary model. |
 | Dubious signature "(UI *)" in summary model. |
 | Dubious signature "(UI *,UI_STRING *,const char *)" in summary model. |
 | Dubious signature "(UI *,UI_STRING *,const char *,int)" in summary model. |

cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp

@@ -1258,6 +1258,24 @@ namespace Microsoft {
 
   class WeakRef;
 
+  namespace Details {
+    template <typename T>
+    class ComPtrRef {
+      public:
+      using InterfaceType = T;
+
+      ComPtrRef(T*);
+
+      InterfaceType* const * GetAddressOf() const;
+      InterfaceType** ReleaseAndGetAddressOf();
+
+      operator InterfaceType**();
+      operator T*();
+      operator void**() const;
+      InterfaceType* operator *();
+    };
+  }
+
   template <typename T>
   class ComPtr
   {
@@ -1301,7 +1319,22 @@ namespace Microsoft {
     void Swap(ComPtr &&r);
 
     void Swap(ComPtr &r);
-  };
+
+    Details::ComPtrRef<ComPtr<T>> operator&();
+    const Details::ComPtrRef<const ComPtr<T>> operator&() const;
+
+    InterfaceType* operator->() const; // return type simplified from Microsoft::WRL::Details::RemoveIUnknown<InterfaceType>*
+
+    ComPtr& operator=(T *);
+    template <typename U>
+    ComPtr& operator=(U *);
+    ComPtr& operator=(const ComPtr &);
+    template<class U>
+    ComPtr& operator=(const ComPtr<U>&);
+    ComPtr& operator=(ComPtr &&);
+    template<class U>
+    ComPtr& operator=(ComPtr<U>&&);
+    };
 
   }
 }
@@ -1331,9 +1364,9 @@ void test_As()
 {
   int x = source<int>();
   Microsoft::WRL::ComPtr<int> p1(new int(x));
-  Microsoft::WRL::ComPtr<int> p2;
-  p1.As(&p2);
-  sink(*p2.Get()); // $ ir MISSING: ast
+  Microsoft::WRL::ComPtr<int>* p2;
+  p1.As(p2);
+  sink(*p2->Get()); // $ ir MISSING: ast
 }
 
 void test_CopyTo()
@@ -1377,4 +1410,52 @@ void test_GetAddressOf()
   Microsoft::WRL::ComPtr<int> p3(new int(x));
   int **pp = p3.ReleaseAndGetAddressOf();
   sink(**pp); // $ ir MISSING: ast
+}
+
+struct S {
+  int x;
+};
+
+void test_address_of_deref_operators() {
+  int x = source<int>();
+  Microsoft::WRL::ComPtr<int> p1(new int(x));
+  Microsoft::WRL::Details::ComPtrRef<Microsoft::WRL::ComPtr<int>> pp = &p1;
+  Microsoft::WRL::ComPtr<int>* qq = *pp;
+  sink(*qq->Get()); // $ ir MISSING: ast
+
+  const Microsoft::WRL::ComPtr<int> p2(new int(x));
+  Microsoft::WRL::Details::ComPtrRef<const Microsoft::WRL::ComPtr<int>> pp2 = &p2;
+  const Microsoft::WRL::ComPtr<int>* qq2 = *pp2;
+  sink(*qq2->Get()); // $ ir MISSING: ast
+
+  S s;
+  s.x = source<int>();
+  Microsoft::WRL::ComPtr<S> p3(&s);
+  sink(p3->x); // $ ir MISSING: ast
+}
+
+void test_assignments() {
+  Microsoft::WRL::ComPtr<int> p1;
+  p1 = new int(source<int>());
+  sink(*p1.Get()); // $ ir MISSING: ast
+
+  Microsoft::WRL::ComPtr<int> p2;
+  p2 = new long(source<long>());
+  sink(*p2.Get()); // $ ir MISSING: ast
+
+  Microsoft::WRL::ComPtr<int> p3;
+  p3 = p1;
+  sink(*p3.Get()); // $ ir MISSING: ast
+
+  Microsoft::WRL::ComPtr<long> p4;
+  p4 = p1;
+  sink(*p4.Get()); // $ ir MISSING: ast
+
+  Microsoft::WRL::ComPtr<int> p5;
+  p5 = std::move(p1);
+  sink(*p5.Get()); // $ ir MISSING: ast
+
+  Microsoft::WRL::ComPtr<long> p6;
+  p6 = std::move(p1);
+  sink(*p6.Get()); // $ ir MISSING: ast
 }