Have callDereferences use models rather than duplicating this data itself. @MathiasVP do you have any idea what Dereferences.qll's callDereferences is used for? I'd like to figure out a way to explicitly test this change.

Not exactly sure, no. A quick search only found it being imported in semmle/code/cpp/controlflow/Dataflow.qll, where its functionality seems to be used by killedBy.

Looks like the only use is in Critical/MissingNullTest.ql.

Looks like the only use is in Critical/MissingNullTest.ql.

Ah good spot, I'd missed this use. I've added a test of MissingNullTest.ql that includes bcopy.

It looks like there's a failing test. I will have to come back to this and investigate.

semmlecode-cpp-tests/DO_NOT_DISTRIBUTE/security-tests/CWE-119/VulnC/tests/MissingNullTest.qlref

-| bad_read2.c:36:15:36:18 | buff | Value may be null; it should be checked before dereferencing. |
 | strlen_missing_null.c:32:9:32:16 | new_buff | Value may be null; it should be checked before dereferencing. |

Sorry for the long delay getting back to this...

I've fixed the failing test - callDereferences still needed a special case for the varargs parameters to printf variants.

I've also modernized some code and removed the taint flow from size parameters; we don't generally consider that taint any more.

Fixed merge conflict.

Looks like localtaint.ql is failing now

Fixed.