Shared/C++: Handle non-standard return values in MaD flow sources/sinks

[MathiasVP]

In #19563@jketema is adding flow sources for (among other things) GetCommandLineA which should have the following MaD specification:

["", "", False, "GetCommandLineA", "", "", "ReturnValue[*]", "local", "manual"]

(because it's not the pointer returned by GetCommandLineA that's user controlled - it's the data that's pointed to!)

However, we noticed that this is not parsed correctly by the current implementation of SourceSinkInterpretation::interpretOutput since it only has a case for getStandardReturnValueKind (and ReturnValue is the standard return value kind, not ReturnValue[*]).

This PR fixes that missing case, and I've checked that this makes the MaD specifications we want to have in #19563 work 🎉

[Copilot]

Pull Request Overview

This PR extends the MaD flow specification to correctly handle non-standard return-value indirections (e.g. ReturnValue[*]) by delegating to a new getReturnValueKind helper in both the QL and C++ FlowSummary implementations.
Key changes:

• Introduce getReturnValueKind(string) and update interpretOutput/interpretInput to use it when ReturnValue has an argument.
• Delegate getStandardReturnValueKind() to getReturnValueKind("") in both QL and C++ modules.
• Update model-as-data tests to expect indirect return-value flows (fix missing $ ir marks).

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll	Add getReturnValueKind, extend interpretOutput/interpretInput to handle starred return kinds.
cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp	Update test expectations for indirect return-value sources.
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll	Route getStandardReturnValueKind() through new getReturnValueKind.

[jketema]

One small comment, otherwise LGTM. Does this need a C++ DCA experiment?

[MathiasVP]

One small comment, otherwise LGTM. Does this need a C++ DCA experiment?

Thanks! Yeah, I've started a DCA run now. I don't think we have any MaD specifications that are currently affected by this, but it doesn't hurt to double check

[jketema]

LGTM.

[MathiasVP]

DCA was uneventful (as expected)