VNX-474: Use of Function with Inconsistent Implementations

Reports C/C++ calls whose behaviour differs between platforms in a way that changes correctness: signal() installing a handler (once per file), strerror_r() outside a variant-selecting #if, realloc(p, 0), the MSVC _snprintf/_vsnprintf family, and vfork(). SIG_IGN/SIG_DFL, sigaction, snprintf, fork, test sources and comments are not reported.

Field	Value
Rule ID	`VNX-474`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-474
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`inconsistent-implementation` `portability` `cwe-474`
Source	`internal/sast/rules/vnx-474.rego`

Overview

VNX-474 maps to CWE-474: Use of Function with Inconsistent Implementations. Reports C/C++ calls whose behaviour differs between platforms in a way that changes correctness: signal() installing a handler (once per file), strerror_r() outside a variant-selecting #if, realloc(p, 0), the MSVC _snprintf/_vsnprintf family, and vfork(). SIG_IGN/SIG_DFL, sigaction, snprintf, fork, test sources and comments are not reported.

Why This Matters

This weakness class (Use of Function with Inconsistent Implementations) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-474 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: System V resets the handler after one delivery, BSD does not
signal(SIGINT, on_interrupt);

// FLAGGED: GNU strerror_r may not write buf at all
strerror_r(errno, c->errstr, sizeof(c->errstr));

// FLAGGED: frees on some libraries, allocates on others
v->items = realloc(v->items, 0);

// NOT FLAGGED: consistent everywhere
signal(SIGPIPE, SIG_IGN);
sigaction(SIGHUP, &sa, NULL);

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-474 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-474 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-474
// nosec vnx-474

Or record an ignore rule: vulnetix ignore add --rule vnx-474 --reason "...". See Suppressing findings.