VNX-1119: Excessive Use of Unconditional Branching

Reports a backward goto in C++: a goto whose label is defined earlier in the same function, so the jump builds a loop out of unconditional branches. Backward gotos in C files are reported by VNX-1075.

Field	Value
Rule ID	`VNX-1119`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C++
CWE	CWE-1119
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`excessive-unconditional-branching` `cwe-1119` `maintainability` `c` `cpp`
Source	`internal/sast/rules/vnx-1119.rego`

Overview

VNX-1119 maps to CWE-1119: Excessive Use of Unconditional Branching. It reports a goto label; in a C++ file (.cc, .cpp, .cxx, .hpp, .hh) whose label is defined above it in the same function: a loop (retry, again, restart, top) written with unconditional jumps instead of while, for or do. A retry that reaches its label through a forward jump to an error handler is reported too.

The same backward goto in a C file (.c, .h) is reported by VNX-1075, so one jump is one finding.

Not reported:

forward gotos to a cleanup or error label (goto out;, goto err;, goto cleanup;), the idiomatic error-unwinding pattern;
a backward goto between chained error handlers whose target ends in return, so control never comes back round;
a label of the same name in an earlier function, computed gotos (goto *ptr), and gotos in comments (including a /* */ block whose lines carry no leading *) or strings;
C files, which VNX-1075 covers.

Why This Matters

Backward jumps are what make goto-heavy code hard to reason about. A retry loop written with goto has no visible bound, so it is easy to loop forever on a persistent error, or to jump back over an initialisation and re-enter with stale state (a freed buffer, a closed descriptor).

What Gets Flagged

int Parser::next()
{
again:
    int c = in_.get();
    if (c == ' ')
        goto again;          // FLAGGED: backward goto
    return c;
}

    if (!buf)
        goto cleanup;        // NOT FLAGGED: forward jump to cleanup
    ...
cleanup:
    delete[] buf;

Remediation

Rewrite the backward jump as a do { ... } while (cond); or for loop with an explicit retry bound.
Keep goto for forward jumps to a single cleanup path, or replace it with RAII so the cleanup runs on every exit.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1119
// nosec vnx-1119

Or record an ignore rule: vulnetix ignore add --rule vnx-1119 --reason "...". See Suppressing findings.