VNX-463: Deletion of Data Structure Sentinel

Reports C/C++ code that overwrites a string's NUL terminator (buf[strlen(buf)] = c, or buf[n] = c after n = strlen(buf)) with another character and writes no new terminator on the following lines.

Field	Value
Rule ID	`VNX-463`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-463
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`deletion-unexpected-state` `cwe-463`
Source	`internal/sast/rules/vnx-463.rego`

Overview

VNX-463 maps to CWE-463: Deletion of Data Structure Sentinel. It reports buf[strlen(buf)] = c and buf[n] = c where n was assigned strlen(buf) in the 10 lines above and not changed since, when c is not '\0'/0 and none of the next three lines writes a NUL into the same buffer. A store of '\0', an index other than the length (buf[n - 1]), a store into a different buffer than the one measured, and an append that re-terminates (buf[n + 1] = '\0', or strcpy(buf + n + 1, ...)) are not reported, nor is a buffer that is next consumed with an explicit length (write(fd, buf, n + 1)). buf[n++] = c and wcslen are covered.

Why This Matters

The NUL terminator is the only thing that tells string functions where the data ends. Once it is overwritten, the next strlen, strcpy or printf reads past the buffer into adjacent memory, which leaks data or corrupts it.

What Gets Flagged

// FLAGGED: terminator replaced, none written
size_t len = strlen(buf);
buf[len] = '\n';
fputs(buf, stdout);

// NOT FLAGGED: re-terminated
size_t n = strlen(s);
s[n] = c;
s[n + 1] = '\0';

Remediation

Write a new terminator after the appended character, and make sure the buffer has room for it.
Prefer bounded helpers (snprintf, strlcat) or std::string for appends.
For confirmed false positives, add a // vulnetix-ignore: VNX-463 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-463
// nosec vnx-463

Or record an ignore rule: vulnetix ignore add --rule vnx-463 --reason "...". See Suppressing findings.