VNX-468: Incorrect Pointer Scaling

Reports pointer arithmetic in C/C++ that multiplies an offset by sizeof() on a pointer or array whose element is wider than one byte (int, long, double, *_t, struct), which the compiler already scales, so the offset lands sizeof(T) times too far. Byte pointers (char, uint8_t, void), allocation and length arguments, and member expressions are not reported.

Field	Value
Rule ID	`VNX-468`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-468
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`incorrect-pointer-scaling` `pointer-arithmetic` `cwe-468`
Source	`internal/sast/rules/vnx-468.rego`

Overview

VNX-468 maps to CWE-468: Incorrect Pointer Scaling. Reports pointer arithmetic in C/C++ that multiplies an offset by sizeof() on a pointer or array whose element is wider than one byte (int, long, double, *_t, struct), which the compiler already scales, so the offset lands sizeof(T) times too far. Byte pointers (char, uint8_t, void), allocation and length arguments, and member expressions are not reported.

Why This Matters

This weakness class (Incorrect Pointer Scaling) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-468 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: values is int *, the compiler already scales by sizeof(int)
total += *(values + i * sizeof(int));

// FLAGGED: struct pointer advanced by a byte count
r += sizeof(struct record);

// NOT FLAGGED: byte arithmetic on an unsigned char buffer
memcpy(out + i * sizeof(uint32_t), &words[i], sizeof(uint32_t));

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-468 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-468 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-468
// nosec vnx-468

Or record an ignore rule: vulnetix ignore add --rule vnx-468 --reason "...". See Suppressing findings.