C++: Block summary flow through strdup and friends

[MathiasVP]

This PR fixes a TODO that I left in as part of #14799.

In the above PR we removed false flow in code like:

void modify_copy(int* p) {
  int x = *p; // (1)
  taint(&x);
}

void test() {
  int x;
  modify_copy(&x);
  sink(x);
}

by teaching the C/C++ dataflow library to rule out certain flow steps that shouldn't be used when calculating summaries (i.e., there shouldn't be a summary from the indirection of the input argument to modify_copy to the output indirection of modify_copy). The terminology I used was that the step from *p to x at // (1) isn't "identity preserving".

This PR extends this set of exclusion rules to also block flow when a modelled function isn't identity preserving. A common example that we've seen in many FPs is strdup(str).

To verify that a functions input -> output relation is identity preserving, we check that *input -> *output and input -> output both holds (i.e., not only does the function has flow from the indirection of the input to the indirection of the output, but it also has flow from the input pointer to the output pointer).

[jketema]

LGTM if the DCA result changes make sense.

One question: This seems to work for cases where the modification occurs at indirection index 1. If it would occur at a higher indirection index, this is not covered, is that a correct observation? If so, this is probably not super relevant, as we likely don't model functions that behave in this way and have more than 1 indirection.

[MathiasVP]

One question: This seems to work for cases where the modification occurs at indirection index 1. If it would occur at a higher indirection index, this is not covered, is that a correct observation? If so, this is probably not super relevant, as we likely don't model functions that behave in this way and have more than 1 indirection.

It actually does work perfectly fine for any indirection level. You're right in that we don't actually model any such strange function that modifies something two indirections away, but that should still Just Work. To test this out, I've:

1. added some strange versions of strdup that takes an char** parameter and returns a char** value
2. Added a test model for various variations of how flow could travel between the parameter and the return value

The tests aren't pretty, but hopefully it should demonstrate that this isn't only working for indirection index 1 🤞

[MathiasVP]

I've looked at the lost results and they're all FPs which are now removed for the exact right reason 🎉