VNX-562: Return of Stack Variable Address

A C or C++ function returns the address of a local array, local variable or by-value parameter, a local string's c_str(), a string_view of a local string, or a reference to a local object, leaving the caller with a dangling pointer.

Field	Value
Rule ID	`VNX-562`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	C, C++
CWE	CWE-562
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`return-stack-address` `dangling-pointer` `cwe-562`
Source	`internal/sast/rules/vnx-562.rego`

Overview

VNX-562 maps to CWE-562: Return of Stack Variable Address. It reports functions that hand their caller a pointer or reference into their own stack frame.

Why This Matters

A function’s locals are released when it returns. The returned pointer still points at that memory, which the next call overwrites. The program often appears to work until a different call sequence or compiler optimisation changes what lives there, and then reads garbage, leaks data from another frame or writes over a return address.

What Gets Flagged

char *format_name(const char *first, const char *last)
{
    char buf[128];
    snprintf(buf, sizeof(buf), "%s %s", first, last);
    return buf;                 /* FLAGGED: local array */
}

int *counter(int start) {
    int value = start + 1;
    return &value;              /* FLAGGED: address of a local */
}

const char *display_name(int id) {
    std::string label = "user-" + std::to_string(id);
    return label.c_str();       // FLAGGED: buffer of a local string
}

std::string &cached_title() {
    std::string title = "home";
    return title;               // FLAGGED: reference to a local
}

Not flagged: static, extern and thread_local locals; heap pointers returned by value; globals and class members; pointer and array parameters; &p->field and &p[i] through a pointer; functions returning std::string or another value type (the result is copied); comments and string literals.

Remediation

Return by value (std::string, a struct) and let the compiler elide the copy.
Take a caller-supplied buffer and its size, or allocate on the heap and document who frees it.
Use static storage only when the function is not reentrant or thread-shared.
Build with -Wreturn-local-addr / -Wreturn-stack-address and treat them as errors.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-562
// nosec vnx-562

Or record an ignore rule: vulnetix ignore add --rule vnx-562 --reason "...". See Suppressing findings.