VNX-685: Function Call With Incorrect Number of Arguments

Detects C and C++ printf- and scanf-family calls whose literal format asks for a different number of arguments than are passed, and open()/openat() with O_CREAT but no mode.

Field	Value
Rule ID	`VNX-685`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-685
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`function-arguments` `cwe-685`
Source	`internal/sast/rules/vnx-685.rego`

Overview

VNX-685 maps to CWE-685: Function Call With Incorrect Number of Arguments. Variadic functions cannot check their argument count. A printf with too few arguments reads whatever is on the stack (a disclosure, or a crash on %s); a scanf with too few pointers writes through a garbage one; open() with O_CREAT and no mode creates a file with indeterminate permissions.

What Gets Flagged

printf("user %s failed with %d\n", user);      // FLAGGED: %d has no argument
fprintf(log, "%s\n", user, code);              // FLAGGED: one argument too many
scanf("%d %d", &a);                            // FLAGGED: second %d writes through garbage
if (sscanf(line, "%d:%s", &a) != 2) {          // FLAGGED
int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC);   // FLAGGED: no mode
asprintf(&s, "%s:%d", path);                   // FLAGGED
err(1, "cannot label %s (%d)", path);          // FLAGGED
fprintf(stderr, "%s: %d of %d\n",              // FLAGGED: call continues below
        name, a);

printf, fprintf, sprintf, snprintf, dprintf, asprintf, syslog and err/errx/warn/warnx count * width and precision as arguments; scanf, fscanf and sscanf count %[...] sets and %n but not %* suppressed conversions.

What Is Not Flagged

Calls still open after three continuation lines, formats built from macros such as PRIu64, and positional %1$s conversions.
Project wrappers (my_printf, logging macros), whose conventions are unknown.
open() with a mode, or without O_CREAT.
Comments and string literals.

VNX-628 also reports the printf and open() shapes.

Remediation

Compile with -Wall -Wformat=2 and fix every warning; pass the mode whenever O_CREAT is set: open(path, O_WRONLY | O_CREAT | O_TRUNC, 0600).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-685
// nosec vnx-685

Or record an ignore rule: vulnetix ignore add --rule vnx-685 --reason "...". See Suppressing findings.