VNX-570: Expression is Always False

Field	Value
Rule ID	VNX-570
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++, Go, Java
CWE	CWE-570
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	always-false dead-code cwe-570
Source	internal/sast/rules/vnx-570.rego

Overview

VNX-570 maps to CWE-570: Expression is Always False. A condition that can never hold makes the branch it guards dead code. When that branch was a bounds, error or range check, the check silently never happens.

What Gets Flagged

• A length or size compared below zero: len(p) < 0, frame.length < 0, header.length() < 0, errors.size() < 0, strlen(name) < 0, sizeof(dst) < 0, and 0 > len(p).
• An unsigned variable compared below zero: a C/C++ unsigned, size_t or uintN_t variable, or a Go uint variable, declared above in the same file with no later signed redeclaration.
• One operand required to equal two different constants: type == TYPE_DATA && type == TYPE_PING.
• An empty numeric range on one operand: port > 65535 && port < 1024.

size_t remaining = len - 4;
if (remaining < 0) {      /* size_t is never negative: the underflow goes unnoticed */
    return -1;
}

if (type == 1 && type == 3) {
    return 3;
}

What Is Not Flagged

• Constant conditions written on purpose: if (false), if (0), #if 0, do { ... } while (0).
• Signed variables, cast operands ((int)cap < 0) and members of other objects (r->pos < 0, w.size < 0, a field merely named size).
• Comparisons in string literals or comments, and test code.

Remediation

1. For an unsigned value, test the operation that could underflow before it happens (if (len < 4) return -1;), or use a signed type.
2. For a size, test emptiness (len(p) == 0, isEmpty()) or the bound you actually meant.
3. For x == A && x == B, the intended operator is almost always ||.

References

• CWE-570: Expression is Always False

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-570
// nosec vnx-570

Or record an ignore rule: vulnetix ignore add --rule vnx-570 --reason "...". See Suppressing findings.