Local variable address stored in non-local memory (False positive)

[uNetworkingAB]

Description of the false positive

I have 6 total false positives of the same category:

• I have structs that are heap allocated (they are NOT stack allocated), and they have methods that assign a global pointer, the value of "this".
• CodeQL has two things wrong here: a) "this" is not a parameter value in C++ and b) the so called parameter value "this" is NOT a stack address. This is clearly a bug in the scanner - had I stored the address of something actually stack allocated from within the function it would clearly be an issue but I'm storing "this" (which definitely is not stack allocated and not even created inside the function).
• All 6 alerts have the same issue; the issue of storing "this" in some global or otherwise surviving pointer. Storing "this" for an object that is heap allocated is definitely not even close to being an issue.

Code samples or links to source code

https://github.com/uNetworking/uWebSockets/blob/c4d45fbf3d282bf68a3b44d6dcabad9414f49e84/src/AsyncSocket.h#L123

URL to the alert on GitHub code scanning (optional)

https://github.com/uNetworking/uWebSockets/security/code-scanning/101

[alexet]

Indeed, this looks like a false positive. Thank you for reporting it!

Our current focus is on improving our security analysis. Because your report does not relate to a security query, we will put this on our backlog and prioritize it if we get enough reports of the same underlying issue in other projects. If you think that your report is related to our security analysis, please clarify that in a comment. Either way, we'll let you know here as soon as it's fixed!

As you might know, all of our queries are open source. If you do have an idea for a code change, we encourage you to open a pull request. GitHub Code Scanning and lgtm.com have facilities for suppressing individual alerts or disabling a query.

[uNetworkingAB]

Makes sense. It's a good service either way and I found out how to disable it. Alerts work like issues so you can easily close them - that's neat