VNX-682: Incorrect Calculation

Detects calculations that are wrong for every input: integer division or remainder by a literal zero in C, C++ and Java, and Java Math.abs() of a hash or unbounded random value, which can stay negative.

Field	Value
Rule ID	`VNX-682`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-682
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`incorrect-calculation` `cwe-682`
Source	`internal/sast/rules/vnx-682.rego`

Overview

VNX-682 maps to CWE-682: Incorrect Calculation. Most incorrect calculations depend on intent, which a line-oriented rule cannot know. This rule reports the two shapes that are wrong whatever the input.

What Gets Flagged

return hits / 0;        // FLAGGED: undefined behaviour in C
int rem = hits % 0;     // FLAGGED
x /= 0;                 // FLAGGED

long bucket = sum % 0L;                              // FLAGGED: ArithmeticException
return Math.abs(key.hashCode()) % shards;            // FLAGGED: negative for Integer.MIN_VALUE
int idx = Math.abs(random.nextInt()) % items.length; // FLAGGED

What Is Not Flagged

Floating-point division by 0.0, hexadecimal or non-zero divisors, and division by a variable (VNX-369 reports unchecked external divisors).
Math.floorMod(h, n), a masked hash (h & 0x7fffffff) and Math.abs(r.nextInt(n)).
Test code, where dividing by zero is how an exception is provoked.
Comments and string literals.

Remediation

Fix the divisor, and compute a bucket with Math.floorMod(key.hashCode(), n) or (key.hashCode() & 0x7fffffff) % n.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-682
// nosec vnx-682

Or record an ignore rule: vulnetix ignore add --rule vnx-682 --reason "...". See Suppressing findings.