VNX-547: Use of Hard-coded, Security-relevant Constants

Detects a buffer whose literal length is repeated as a bare number in a bounded read, copy or format call (fgets(line, 256, ...) for char line[256]) in C, C++ and Java, instead of sizeof(buf), buf.length or a named constant.

Field	Value
Rule ID	`VNX-547`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-547
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`hardcoded` `buffer-size` `magic-number` `cwe-547`
Source	`internal/sast/rules/vnx-547.rego`

Overview

VNX-547 maps to CWE-547: Use of Hard-coded, Security-relevant Constants. When a buffer’s length is written out twice, once in the declaration and once in the call that bounds it, changing one without the other makes the bound stop matching the buffer and the call overflows it. This is the example the CWE itself gives.

The rule reports a bounded call on a buffer whose nearest declaration in the 60 lines above has a literal length, when the call’s bound is a literal equal to that length (or larger than it):

C/C++: fgets, snprintf, vsnprintf, strncpy, strncat, memcpy, memmove, memset, bzero, getcwd, read, recv and fread with an element size of 1 (also std:: forms and calls split over lines);
Java: read(buf, off, N) on a byte[]/char[] (also C-style byte b[]) created with new byte[N] or new char[N];
a struct member (strncpy(u->name, src, 32) for char name[32];) when every declaration of that member name in the file has the same length.

What Gets Flagged

char line[256];
if (fgets(line, 256, stdin) == NULL)   /* FLAGGED */
    return -1;

byte[] header = new byte[512];
return in.read(header, 0, 512);        // FLAGGED

What Is Not Flagged

sizeof buf, sizeof(buf), buf.length and named constants or macros as the bound.
A smaller bound that uses part of the buffer (memcpy(buf, "inf", 3), read(fd, buf, 1)).
Buffers that are parameters or are not declared with a literal length, hexadecimal lengths compared with decimal bounds, comments and string literals.

Other hard-coded security values (keys, passwords, IVs, iteration counts) are reported by the rules for those weaknesses.

Remediation

Derive the bound from the buffer: fgets(line, sizeof line, stdin), in.read(buf, 0, buf.length), or declare one named constant and use it for both.

References

CWE-547: Use of Hard-coded, Security-relevant Constants

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-547
// nosec vnx-547

Or record an ignore rule: vulnetix ignore add --rule vnx-547 --reason "...". See Suppressing findings.