VNX-683: Function Call With Incorrect Order of Arguments

Detects C and C++ calls with visibly swapped arguments: memset value and length transposed, copies whose destination is named like the source and the source like the destination, and stdio calls given the stream first.

Field	Value
Rule ID	`VNX-683`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-683
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`function-call-wrong-argument-order` `cwe-683`
Source	`internal/sast/rules/vnx-683.rego`

Overview

VNX-683 maps to CWE-683: Function Call With Incorrect Order of Arguments. Many C library functions take several arguments of compatible types, so swapping two compiles and does the wrong thing: a key that should be wiped is left in memory, or a copy overwrites its own source.

What Gets Flagged

memset(s->key, sizeof(s->key), 0);   // FLAGGED: clears nothing
memcpy(src, dst, n);                 // FLAGGED: copies backwards
strcat(input, output);               // FLAGGED
fputs(stderr, msg);                  // FLAGGED: stream goes last
fwrite(fp, buf, 1, n);               // FLAGGED

memset()/wmemset() with a literal 0 or '\0' length after a non-zero value.
memcpy, memmove, strcpy, strncpy, strcat, strncat, strlcpy, stpcpy, wcscpy and wmemcpy whose first argument is named like a source (src, source, from, input, in, orig) and whose second is named like a destination (dst, dest, to, target, out, output).
fputs, fputc, putc, fwrite, fread and fgets with stdout, stderr, stdin, fp, fh or stream as the first argument.

What Is Not Flagged

Correctly ordered calls, and memset(p, 0, 0).
Copies where only one argument has a telling name.
Comments, string literals and files of other languages.

VNX-628 also reports the transposed memset shape.

Remediation

Compile with -Wall -Wmemset-transposed-args and match each call to its signature: memset(buf, 0, n), memcpy(dst, src, n), fputs(msg, stderr), fwrite(buf, 1, n, fp).

References

CWE-683: Function Call With Incorrect Order of Arguments

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-683
// nosec vnx-683

Or record an ignore rule: vulnetix ignore add --rule vnx-683 --reason "...". See Suppressing findings.