VNX-457: Use of Uninitialized Variable

Reports a C/C++ local scalar or char array declared without an initialiser whose first mention in the same block reads it (return v, v++, v += ..., a condition, a printf argument, strcat(buf, ...)) before anything is stored in it.

Field	Value
Rule ID	`VNX-457`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-457
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`uninitialized` `cwe-457`
Source	`internal/sast/rules/vnx-457.rego`

Overview

VNX-457 maps to CWE-457: Use of Uninitialized Variable. It reports a function-local scalar (int, long, char, double, size_t, intN_t, bool…) declared without an initialiser, at its first mention within the next 25 lines of the same block, when that mention reads the value: return v, v++, a compound assignment, the right-hand side of an assignment, an if/while/switch condition, a printf-family argument or std::cout << v. A local char array is reported when its first use is strcat/strncat/strlen/strdup/puts or a printf argument. A first mention that assigns, takes the address (&v, scanf) or passes the variable to a call that may fill it is not reported, nor are static, namespace-scope and struct/class members.

Why This Matters

An uninitialised local holds whatever was on the stack. Accumulators start from garbage, status codes return stale values, and a string buffer without a terminator lets strcat walk off the end of the array.

What Gets Flagged

// FLAGGED: accumulator never zeroed
long total;
for (i = 0; i < n; i++) {
    total += samples[i];
}

// FLAGGED: buffer appended to before it holds a string
char path[256];
strcat(path, dir);

// NOT FLAGGED: assigned on every branch first
int r;
if (x > 100) r = 100; else r = x;
return r;

Remediation

Initialise locals at the declaration (long total = 0;, char path[256] = "";).
Enable compiler warnings (-Wall -Wuninitialized -Wmaybe-uninitialized) and sanitizers (MSan) for the paths a line-oriented rule cannot follow.
For confirmed false positives, add a // vulnetix-ignore: VNX-457 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-457
// nosec vnx-457

Or record an ignore rule: vulnetix ignore add --rule vnx-457 --reason "...". See Suppressing findings.