fix codeql warnings

[strega-nil-ms]

Same as #3478 but not from a microsoft/STL branch.

Link to internal codeql bugs:

• VSO-1746341
• VSO-1746390

I'm still not sure if we should have these, and I'm unsure how to test these changes.

[strega-nil-ms]

@AlexGuteniev said:

Have you tried more documented and common annotations, instead of some specific to a particular tool (I first time read about)?

that would certainly make me happier, but this is an internal thing.

[CaseyCarter]

I'm not enthusiastic about adding arcane comments to our source to suppress static analysis false positives from some unknowable internal process, but if we must do so, I believe these changes are minimally damaging.

[strega-nil-ms]

@CaseyCarter fully agreed

[StephanTLavavej]

I double-checked all of the control flow - the code is safe, but it's squirrelly enough 🐿️ that I can't really blame CodeQL for warning. A handful of suppressions are acceptable, but I would reconsider if this ended up growing to dozens and dozens.

Thanks for making the changes here as non-invasive as possible.

[StephanTLavavej]

I'm mirroring this to the MSVC-internal repo - please notify me if any further changes are pushed.

(I will, of course, wait for the decision needed.)

[StephanTLavavej]

We've reluctantly decided that there's no way around merging this.

[StephanTLavavej]

Thanks for investigating and fixing these delightful warnings! ⚠️ 🛠️ 😹

[CaseyCarter]

Thanks for investigating and fixing these delightful warnings! ⚠️ 🛠️ 😹

I think you mean "possibly fixing", since we have no way to verify 🤪