VNX-475: Undefined Behavior for Input to API

Reports C/C++ calls whose arguments make the library behaviour undefined: memcpy/strcpy/strcat with the same object as source and destination, sprintf/snprintf whose destination is also an argument, fflush(stdin), and a literal NULL passed to a %s conversion or a mem*/str* pointer argument. memmove, snprintf(NULL, 0, ...), distinct objects or array elements, element-sized copies within an array, output-stream flushes, tests and comments are not reported.

Field	Value
Rule ID	`VNX-475`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-475
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`undefined-behavior-api` `cwe-475`
Source	`internal/sast/rules/vnx-475.rego`

Overview

VNX-475 maps to CWE-475: Undefined Behavior for Input to API. Reports C/C++ calls whose arguments make the library behaviour undefined: memcpy/strcpy/strcat with the same object as source and destination, sprintf/snprintf whose destination is also an argument, fflush(stdin), and a literal NULL passed to a %s conversion or a mem*/str* pointer argument. memmove, snprintf(NULL, 0, …), distinct objects or array elements, element-sized copies within an array, output-stream flushes, tests and comments are not reported.

Why This Matters

This weakness class (Undefined Behavior for Input to API) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-475 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: source and destination overlap
memcpy(buf, buf + 1, len - 1);

// FLAGGED: the destination is read by the same call
sprintf(buf, "%s/%s", buf, file);

// FLAGGED: undefined for input streams
fflush(stdin);

// NOT FLAGGED: memmove is defined for overlapping memory
memmove(buf, buf + 1, n - 1);

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-475 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-475 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-475
// nosec vnx-475

Or record an ignore rule: vulnetix ignore add --rule vnx-475 --reason "...". See Suppressing findings.