VNX-688: Function Call With Incorrect Variable or Reference as Argument

Detects C and C++ bounded writes whose size is sizeof a different array than the destination they write, such as snprintf(name, sizeof(path), ...) or read(fd, header, sizeof(body)).

Field	Value
Rule ID	`VNX-688`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-688
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`wrong-buffer-size` `cwe-688`
Source	`internal/sast/rules/vnx-688.rego`

Overview

VNX-688 maps to CWE-688: Function Call With Incorrect Variable or Reference as Argument. The size argument names the wrong variable, usually after copy and paste: the call is bounded by another buffer’s size, so a smaller destination overflows.

What Gets Flagged

char name[16];
char path[256];
snprintf(name, sizeof(path), "%s@%s", user, host);   // FLAGGED
strncpy(name, path, sizeof path);                    // FLAGGED: bounded by the source
read(fd, header, sizeof(body));                      // FLAGGED
std::snprintf(c->host, sizeof(c->url), "%s", u);     // FLAGGED: different struct members

Calls covered: snprintf, vsnprintf, fgets, getcwd, gethostname, bzero, explicit_bzero, strncpy, strlcpy, strncat, strlcat, memset, memcpy, memmove, read, recv, recvfrom, pread and readlink, when the destination and the array in sizeof are different arrays both declared in the file.

What Is Not Flagged

A size taken from the destination itself.
memcpy/memmove sized by the source array.
sizeof of a type or of *ptr, and a pointer destination whose target is unknown.
Calls split over several lines, comments and string literals.

Remediation

Take the bound from the buffer being written: snprintf(name, sizeof(name), ...).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-688
// nosec vnx-688

Or record an ignore rule: vulnetix ignore add --rule vnx-688 --reason "...". See Suppressing findings.