VNX-401: Missing Release of Memory after Effective Lifetime (memory leak)

A C/C++ heap block held in a local variable (malloc, calloc, strdup, kzalloc, new and friends) is abandoned by a later return or throw before it is freed, stored, handed off or returned; or `p = realloc(p, n)` overwrites the only pointer to the old block, which leaks when realloc fails.

Field	Value
Rule ID	`VNX-401`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-401
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`memory-leak` `cwe-401`
Source	`internal/sast/rules/vnx-401.rego`

Overview

VNX-401 maps to CWE-401: Missing Release of Memory after Effective Lifetime. A C/C++ heap block held in a local variable (malloc, calloc, strdup, kzalloc, new and friends) is abandoned by a later return or throw before it is freed, stored, handed off or returned; or p = realloc(p, n) overwrites the only pointer to the old block, which leaks when realloc fails.

Why This Matters

This weakness class (CWE-401) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-401 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

char *buf = malloc(len);
if (!buf)
    return -1;                       /* not flagged: nothing was allocated */
if (read(fd, buf, len) != (ssize_t)len)
    return -1;                       /* FLAGGED: buf leaks on this path */

int *vals = calloc(n, sizeof(int));
if (vals == NULL) return NULL;       /* FLAGGED: keys, allocated above, leaks */

v->items = realloc(v->items, cap);   /* FLAGGED: old block lost if realloc fails */

Node *root = new Node(text);
if (!tokenize(text)) {
    return false;                    // FLAGGED: root is never deleted
}

Not flagged: a free(buf) before the return, a block stored (c->buf = b;), returned or passed to another function (ownership may move), tmp = realloc(p, n) with a temporary, or an old pointer saved just before p = realloc(p, n). Paths longer than 100 lines, macros and goto-cleanup flows are not modelled.

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-401 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-401 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-401
// nosec vnx-401

Or record an ignore rule: vulnetix ignore add --rule vnx-401 --reason "...". See Suppressing findings.