VNX-466: Return of Pointer Value Outside of Expected Range
Reports a C/C++ function that returns a pointer offset from an unchecked strchr/strrchr/memchr/strstr/strpbrk result (return strchr(s, '=') + 1, or p = strchr(...) then return p + 2 with no NULL test), which yields NULL + n when the search fails.
| Field | Value |
|---|---|
| Rule ID | VNX-466 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++ |
| CWE | CWE-466 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | return-of-pointer-outside-range null-offset cwe-466 |
| Source | internal/sast/rules/vnx-466.rego |
Overview
VNX-466 maps to CWE-466: Return of Pointer Value Outside of Expected Range. Reports a C/C++ function that returns a pointer offset from an unchecked strchr/strrchr/memchr/strstr/strpbrk result (return strchr(s, ‘=’) + 1, or p = strchr(…) then return p + 2 with no NULL test), which yields NULL + n when the search fails.
Why This Matters
This weakness class (Return of Pointer Value Outside of Expected Range) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-466 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.
What Gets Flagged
// FLAGGED: offset added to a search that can return NULL
return strchr(entry, '=') + 1;
// FLAGGED: two-line form, no NULL test before the return
char *p = strchr(reply + 1, '\r');
return p + 2;
// NOT FLAGGED: the result is checked first
const char *p = strrchr(s, ':');
if (!p) return s;
return p + 1;Remediation
- Review each flagged line and determine whether the pattern represents a real instance of CWE-466 or a false positive.
- Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
- For confirmed false positives, add a
# vulnetix-ignore: VNX-466comment on the line. - Ensure equivalent test coverage exists to prevent regression.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-466
// nosec vnx-466Or record an ignore rule: vulnetix ignore add --rule vnx-466 --reason "...". See Suppressing findings.