You can probably use an alias analysis to compute stores that are tainted by input.
The following simple example shows the use of LLVM alias analysis. The example shows an implementation an intraprocedural analysis to detect the violation of rule STR30-C of the SEI-CERT C Coding Standard.
You may need to modify the code to suit your purpose.
The description of STR30-C itself is here: