https://issues.dlang.org/show_bug.cgi?id=17368

          Issue ID: 17368
           Summary: [DIP1000] scope T** implicit convertion to scope T*
                    allow to escape pointer
           Product: D
           Version: D2
          Hardware: x86_64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: dmd
          Assignee: nobody@puremagic.com
          Reporter: mathias.lang@sociomantic.com

Code below:

```
void main () @safe
{
    getPtr();
}

void getPtr () @safe
{
    int* ptr2;
    bar(&ptr2);
    assert(ptr2 !is null, "Oops, I have a pointer to bar.value");
}

void bar (scope int** ptr2) @safe
{
    int value;
    foo(ptr2, &value);
}

// Needs to be 'return scope' so that the compiler believes 'ptr1' has longer
lifetime thatn 'ptr2'
void foo (scope int** ptr2, scope int* ptr1) @safe
{
    foobar(*ptr2, ptr1);
}

int* foobar (scope int* p1, return scope int* p2) @safe
{
    p1 = p2;
    return p2;
}
```

--