VNX-676: Use of Potentially Dangerous Function

Reports C and C++ calls to gets(), and to strcpy/strcat/sprintf/vsprintf/scanf-family functions in the forms that can overflow their destination: a non-constant unmeasured source, a %s without precision, a %s or %[ without width.

Field	Value
Rule ID	`VNX-676`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-676
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`dangerous-function` `cwe-676` `buffer-overflow`
Source	`internal/sast/rules/vnx-676.rego`

Overview

VNX-676 maps to CWE-676: Use of Potentially Dangerous Function. The classic C string functions write as much as their input holds into a buffer they are given no size for. The rule reports them in the forms that can actually overflow:

gets() and _getws(): always.
strcpy, stpcpy, strcat, wcscpy, wcscat (also std::): when the source is not a string literal, an upper-case macro or a choice between literals, and neither was its length measured (strlen/wcslen/strnlen) nor the destination’s sizeof compared in an if/assert in the 15 lines above.
sprintf with a literal format containing %s/%ls without precision; vsprintf always.
scanf, fscanf, sscanf, the v and wide forms, with %s, %ls or %[ and no field width.

Calls that wrap over several lines are read across them.

What Gets Flagged

gets(line);                                       /* FLAGGED */
strcpy(name, user);                               /* FLAGGED */
sprintf(out, "hello %s, you have %d", who, n);    /* FLAGGED */
scanf("%s", word);                                /* FLAGGED */

What Is Not Flagged

fgets, strncpy, strlcpy, strncat, snprintf, vsnprintf and the _s functions.
%.20s, %15s, %*s and %ms; sprintf with only numeric conversions or a non-literal format.
strcpy(c->name, "default"), strcpy(p, s) after malloc(strlen(s) + 1).
Prototypes, #define lines, methods and lookalike names (b.strcpy, p->gets, my_strcpy), comments and string literals.

VNX-C-001 reports the same copies (with more Windows variants), and VNX-242 reports gets().

Remediation

fgets(line, sizeof line, stdin);
snprintf(name, sizeof name, "%s", user);
scanf("%31s", word);

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-676
// nosec vnx-676

Or record an ignore rule: vulnetix ignore add --rule vnx-676 --reason "...". See Suppressing findings.