Tracking Taint Flow of Function Parameter

[sei-yhindka]

We are trying to track taint flow from the state parameter here: https://github.com/ggerganov/whisper.cpp/blob/master/whisper.cpp#L7118. We don't want to taint the struct itself, because then all instances of the struct are tainted. Instead, we are only interested in the taint flow of the parameter state. The query below is very close to achieving the results we want:

exists(FieldAccess fa |
            
            // check node2 is the FieldAccess
            node2.asExpr() = fa

            // check node1 is an indirect parent
            and node1.asIndirectExpr() = fa.getQualifier()
            
            // prevent false positives
            and fa.getQualifier().getType().(PointerType).getBaseType().hasName("whisper_state")

        )

When we run the quick eval on the isSource predicate, CodeQL correctly identifies the state parameter as the only source. In addition, when we run the quick eval on the isAdditionalFlowStep predicate, CodeQL correctly identifies the field accesses of the the state parameter as tainted (see the screenshot below). However, when we run the whole query, we do not get the results we expect: the field accesses of the state parameter are not part of the results. We have a feeling there is a disconnect between the source and the nodes selected by the isAdditionalFlowStep predicate. Do you have any ideas on how to proceed? We greatly appreciate your help!