Ignore me, I'm an idiot.
Mark points out that
MyObject op is a local-scope instantiation of a class, which will be placed on the stack. This means that
&op is actually the address of the class data in memory.
As such, I have no idea why this was flagged. False positive, maybe?
It's right to complain, so let's take a look at this code. What does it do?
In line 1, you define an object variable. However, you don't call its constructor, so this object variable isn't actually set to anything - right now it's just an uninitialised pointer.
memset(&op, 0, sizeof(MyObject));
In line 2, you take the address of the variable and and perform a
memset at that address with a size that's almost certainly going to be larger than the size of a pointer. Take care to note that you aren't overwriting the memory that will contain the object's data, but rather the scope-local storage space that's used to hold a pointer to the object. This is definitely an overflow condition.