addressof.ql

/**
 * @id cpp/examples/addressof
 * @name Address of reference variable
 * @description Finds address-of expressions (`&`) that take the address
 * of a reference variable
 * @tags addressof
 * reference
 */

import cpp

fromAddressOfExpraddr,VariableAccessaccess
where
access=addr.getOperand()and
access.getTarget().getType()instanceofReferenceType
selectaddr