VNX-464: Addition of Data Structure Sentinel

Reports C/C++ code that stores a number parsed from input (atoi, strtol, std::stoi...) into an element of a char buffer, where an input of 0 inserts a NUL terminator mid-string.

Field	Value
Rule ID	`VNX-464`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-464
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`sentinel-added-data` `cwe-464`
Source	`internal/sast/rules/vnx-464.rego`

Overview

VNX-464 maps to CWE-464: Addition of Data Structure Sentinel. It reports buf[i] = atoi(...) (and atol, atoll, strtol, strtoul, strtoll, strtoull, std::stoi, std::stol, std::stoul), optionally cast to char, and buf[i] = v where v was assigned such a conversion in the five lines above with no if/while test of v in between, when buf is declared in the same file as a char array or char pointer. Multi-dimensional char arrays are covered. Stores into int/long arrays and unsigned char byte buffers, conversions used only as a condition (atoi(s) ? 'Y' : 'N'), range-checked values and constant characters are not reported.

Why This Matters

A character buffer treats 0 as the end of the string. Letting input choose the value stored in it lets the input end the string early, which truncates a path, a command or a log line, and other values can inject separators the code did not expect.

What Gets Flagged

// FLAGGED: argv decides whether a terminator lands at index 2
char code[8];
code[0] = 'A';
code[2] = atoi(argv[1]);

// NOT FLAGGED: range-checked first
int v = atoi(arg);
if (v <= 0 || v > 127)
    return -1;
code[2] = v;

Remediation

Validate a parsed number against the allowed character range before storing it in a string buffer.
Store numbers in integer arrays, not character buffers, unless the value is meant to be a character.
For confirmed false positives, add a // vulnetix-ignore: VNX-464 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-464
// nosec vnx-464

Or record an ignore rule: vulnetix ignore add --rule vnx-464 --reason "...". See Suppressing findings.