C++: add remote flow models for fread and gets

Author: Robert Marsh

cpp/ql/src/semmle/code/cpp/models/implementations/Fread.qll

@@ -1,6 +1,7 @@
 import semmle.code.cpp.models.interfaces.Alias
+import semmle.code.cpp.models.interfaces.FlowSource
 
-class Fread extends AliasFunction {
+class Fread extends AliasFunction, RemoteFlowFunction {
   Fread() { this.hasGlobalName("fread") }
 
   override predicate parameterNeverEscapes(int n) {
@@ -11,4 +12,8 @@ class Fread extends AliasFunction {
   override predicate parameterEscapesOnlyViaReturn(int n) { none() }
 
   override predicate parameterIsAlwaysReturned(int n) { none() }
+
+  override predicate hasFlowSource(FunctionOutput output) {
+    output.isParameterDeref(0)
+  }
 }

cpp/ql/src/semmle/code/cpp/models/implementations/Gets.qll

@@ -3,12 +3,13 @@ import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.ArrayFunction
 import semmle.code.cpp.models.interfaces.Alias
 import semmle.code.cpp.models.interfaces.SideEffect
+import semmle.code.cpp.models.interfaces.FlowSource
 
 /**
  * The standard functions `gets` and `fgets`.
  */
 class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
-  SideEffectFunction {
+  SideEffectFunction, RemoteFlowFunction {
   GetsFunction() {
     exists(string name | hasGlobalOrStdName(name) |
       name = "gets" or // gets(str)
@@ -42,4 +43,8 @@ class GetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, Alias
     buffer = true and
     mustWrite = true
   }
+
+  override predicate hasFlowSource(FunctionOutput output) {
+    output.isParameterDeref(0)
+  }
 }