VNX-484: Omitted Break Statement in Switch

A case or default label of a C, C++ or Java switch whose statements run into the next label of the same switch: the label has a body of its own, and its last statement is not a break, return, throw, continue, goto, yield or a call that does not return (exit, abort, System.exit), so control falls through into the next case. Not reported: stacked labels with no statements between them (case 1: case 2:), a fall-through marked as deliberate (a /* fall through */ or FALLTHROUGH comment, [[fallthrough]], __attribute__((fallthrough))), Java arrow labels (case X ->), which never fall through, the last label of a switch, and labels in comments or string literals. A body whose last statement is a bare if guarding the exit (if (x) return -1;, with no else) is reported, because the other branch falls through. A body ending in an inner block (an if/else or loop closed by a brace) is not judged.

Field	Value
Rule ID	`VNX-484`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-484
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`omitted-break` `switch` `fall-through` `cwe-484`
Source	`internal/sast/rules/vnx-484.rego`

Overview

VNX-484 maps to CWE-484: Omitted Break Statement in Switch. It reports a case (or default) label whose own statements run on into the next label of the same switch because the body does not end in break, return, throw, continue, goto, yield or a call that never returns.

Why This Matters

A forgotten break runs the next case’s code as well: a permission granted for one role is also applied for the role below it, a state machine skips a state, or a buffer is written twice. The compiler accepts it, and the code reads correctly at a glance.

What Gets Flagged

switch (cmd) {
case 2:                 // FLAGGED: runs on into case 3
    *state = 20;
    log_cmd(cmd);
case 3:
    *state = 30;
    break;
}

switch (tier) {
    case GOLD:          // FLAGGED
        pct = 20;
    case SILVER:
        pct = 10;
        break;
}

Not flagged: case 1: case 2: stacked labels, /* fall through */ or [[fallthrough]]; before the next label, case X -> arrow labels, and bodies ending in return, throw, exit() or abort().

Remediation

Add the missing break (or return) at the end of the case body.
If the fall-through is intended, say so: [[fallthrough]]; in C++17/C23, __attribute__((fallthrough)); in GCC/Clang C, or a // fall through comment in Java, and enable -Wimplicit-fallthrough / -Xlint:fallthrough.
In Java 14+, prefer arrow labels (case X ->), which cannot fall through.

References

CWE-484: Omitted Break Statement in Switch

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-484
// nosec vnx-484

Or record an ignore rule: vulnetix ignore add --rule vnx-484 --reason "...". See Suppressing findings.