VNX-469: Use of Pointer Subtraction to Determine Size

Field	Value
Rule ID	VNX-469
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-469
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	pointer-subtraction cwe-469
Source	internal/sast/rules/vnx-469.rego

Overview

VNX-469 maps to CWE-469: Use of Pointer Subtraction to Determine Size. Reports C/C++ pointer subtraction between pointers that provably point into different objects: two distinct sized arrays, two separate allocations (malloc, calloc, strdup, new[]), or iterators of two different containers. The result is undefined and cannot serve as a size. Pointers that may share an object, members, element values, linked-list nodes and comments are not reported.

Why This Matters

This weakness class (Use of Pointer Subtraction to Determine Size) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-469 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: two separate allocations
char *first = malloc(count);
char *second = malloc(count);
size_t span = second - first;

// FLAGGED (C++): iterators of different containers
auto n = std::distance(left.begin(), right.end());

// NOT FLAGGED: both pointers point into the same buffer
const char *end = strchr(line, ' ');
return end - line;

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-469 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-469 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-469: Use of Pointer Subtraction to Determine Size
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-469
// nosec vnx-469

Or record an ignore rule: vulnetix ignore add --rule vnx-469 --reason "...". See Suppressing findings.