VNX-130: Improper Handling of Length Parameter Inconsistency

Reports C/C++ code that uses a length field decoded from a message (ntohs, ntohl, be*toh, n2s, byte shifts) as a memcpy/memmove/strncpy length or a read/recv size without comparing it with the destination or the received size: the Heartbleed shape.

Field	Value
Rule ID	`VNX-130`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	C, C++
CWE	CWE-130
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`length` `buffer` `cwe-130`
Source	`internal/sast/rules/vnx-130.rego`

Overview

VNX-130 maps to CWE-130: Improper Handling of Length Parameter Inconsistency. It reports a value decoded from wire byte order (ntohs, ntohl, be16toh/be32toh/le16toh/le32toh, get_unaligned_be16/be32/le16/le32, OpenSSL’s n2s/n2l, or bytes combined as (p[0] << 8) | p[1]) that is used as the length argument of memcpy, memmove, strncpy or strncat, or as the size of read/recv/recvfrom/fread, with no comparison against the destination or the received size in between. The conversion written directly in the length argument is reported too.

What Gets Flagged

uint16_t len = ntohs(h->len);
memcpy(payload, pkt + sizeof(*h), len);          // FLAGGED

n2s(p, payload);
pl = p;
memcpy(bp, pl, payload);                         // FLAGGED: Heartbleed

std::memcpy(body, frame + 4, ntohs(fh->length)); // FLAGGED

What Is Not Flagged

A length compared in an if/while/assert or a ternary, or clamped with MIN()/min(), before the copy.
Constant and sizeof lengths, and decoded values that are never used as a copy length.
Host-to-network conversions (htons, htonl).
Lengths that reach the copy through another function (out of scope).

Remediation

Before copying, check the decoded length against both the destination size and the number of bytes actually received, and discard the message if either check fails.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-130
// nosec vnx-130

Or record an ignore rule: vulnetix ignore add --rule vnx-130 --reason "...". See Suppressing findings.