VNX-628: Function Call with Incorrectly Specified Arguments

Detects C and C++ calls whose arguments are wrong on the call line: memset with value and length transposed, printf-family calls whose literal format does not match the argument count, and open()/openat() with O_CREAT but no mode.

Field	Value
Rule ID	`VNX-628`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-628
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`printf-format` `memset` `open-mode` `cwe-628`
Source	`internal/sast/rules/vnx-628.rego`

Overview

VNX-628 maps to CWE-628: Function Call with Incorrectly Specified Arguments. The call compiles, but the arguments do not say what the author meant:

memset()/wmemset() with the value and the length transposed: a literal 0 length after a non-zero value, so nothing is cleared. A key that was meant to be wiped stays in memory.
printf-family format mismatch: printf, fprintf, sprintf, snprintf, dprintf and syslog with a literal format whose conversion count (including * width and precision) differs from the number of arguments. Too few arguments reads whatever is on the stack (a memory disclosure, or a crash on %s); too many silently drops a value.
open()/openat() with O_CREAT (or O_TMPFILE) and no mode: the new file’s permissions come from an indeterminate register or stack slot.

What Gets Flagged

memset(s->key, sizeof(s->key), 0);                    // FLAGGED: clears nothing
printf("user %s failed with %d\n", user);             // FLAGGED: %d has no argument
snprintf(buf, sizeof(buf), "[%s] level=%d t=%.3f", tag, level);  // FLAGGED
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC);    // FLAGGED: no mode

What Is Not Flagged

memset(buf, 0, n), memset(buf, 0, 0) and open(path, O_CREAT | O_WRONLY, 0600).
Calls split over several lines, formats assembled from macros such as PRIu64, positional %1$s conversions and %%.
Project-specific wrappers (my_printf, logging macros), whose conventions are unknown.
The calls inside comments or string literals.

Remediation

Compile with -Wall -Wformat=2 -Wmemset-transposed-args and fix every warning. Pass the mode whenever O_CREAT is set, and keep the format string and the argument list in step:

memset(s->key, 0, sizeof(s->key));
printf("user %s failed with %d\n", user, code);
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-628
// nosec vnx-628

Or record an ignore rule: vulnetix ignore add --rule vnx-628 --reason "...". See Suppressing findings.