CodeQL library for C/C++
codeql/cpp-all 1.1.2-dev (changelog, source)

Predicate definitionByReference

Holds if va is a variable passed by reference as argument def, where the callee potentially assigns the corresponding parameter. The definitions-and-uses library models assignment by reference as if it happens on evaluation of the argument, def.

All library functions except std::move are assumed to assign call-by-reference parameters, and source code functions are assumed to assign call-by-reference parameters that are accessed somewhere within the function. The latter is an over-approximation, but avoids having to take aliasing of the parameter into account.

Import path

import cpp
predicate definitionByReference(VariableAccess va, Expr def)