BlackDuck scan reports this as a Use After Free Vulnerability

[kumaran (kumaran-id-git)]

https://github.com/microsoft/react-native-windows/blame/cc126e4e42ed2dea020655264af0cfb5b1d6ea12/vnext/Mso/src/future/futureImpl.cpp

Static Scan by BlackDuck reports this as a Use After Free Vulnerability

// "this->Mso::Futures::FutureCallback::~FutureCallback()" manually destructs "this".
this->~FutureCallback();
// Passing freed pointer "this" as an argument to "GetFutureImpl".
GetFutureImpl(this)->Release();
}

[Chris Glein (chrisglein)]

Interesting find. Here's the specific line:
https://github.com/microsoft/react-native-windows/blame/cc126e4e42ed2dea020655264af0cfb5b1d6ea12/vnext/Mso/src/future/futureImpl.cpp#L1006

Invoking the destructor won't actually release the object. It's a little strange, but not necessarily wrong. But... worth looking at! Vladimir Morozov (@vmoroz) give this a look?