VNX-253: Incorrect Check of Function Return Value

Reports C/C++ return values tested against the wrong failure value: pointers compared with < 0 or -1, mmap() compared with NULL, file descriptors tested with !fd, pthread results compared with -1, and ssize_t results stored unsigned then compared with < 0.

Field	Value
Rule ID	`VNX-253`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-253
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`return-check` `error-handling` `cwe-253`
Source	`internal/sast/rules/vnx-253.rego`

Overview

A failure check that compares against the wrong value never fires, so the error path never runs and the failure is treated as success. This maps to CWE-253: Incorrect Check of Function Return Value.

What Gets Flagged

A pointer-returning call (malloc, calloc, realloc, strdup, fopen, fdopen, popen, tmpfile, fgets, getenv, opendir, readdir) compared with < 0, <= -1 or == -1, directly or through the variable it was assigned to. These return NULL.
An mmap() result compared with NULL or tested with !. mmap returns MAP_FAILED.
A descriptor from open, openat, creat, socket, accept, dup and similar tested with !fd or == NULL. They return -1, and 0 is a valid descriptor.
A pthread_* result compared with == -1 or < 0. These return a positive error number.
A read, write, recv, send, pread, readlink, getline or snprintf result stored in size_t/unsigned/uintN_t/DWORD and then compared with < 0, which can never be true.

if (fopen(path, "r") < 0)                 /* flagged */
size_t n = read(fd, buf, cap);
if (n < 0)                                /* flagged */
void *p = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
if (p == NULL)                            /* flagged */
if (pthread_create(t, NULL, fn, NULL) == -1)   /* flagged */

Not flagged: the correct checks (== NULL, == MAP_FAILED, < 0 on a signed descriptor or ssize_t, != 0 on a pthread result), comments and string literals.

Remediation

ssize_t n = read(fd, buf, cap);
if (n < 0)
    return -1;
void *p = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
if (p == MAP_FAILED)
    return NULL;
int rc = pthread_create(&t, NULL, fn, NULL);
if (rc != 0)
    return rc;

References

CWE-253

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-253
// nosec vnx-253

Or record an ignore rule: vulnetix ignore add --rule vnx-253 --reason "...". See Suppressing findings.