VNX-761: free() of a pointer that is not at the start of its buffer

Field	Value
Rule ID	VNX-761
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-761
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	memory free-pointer-not-at-start cwe-761
Source	internal/sast/rules/vnx-761.rego

Overview

VNX-761 maps to CWE-761: Free of Pointer not at Start of Buffer. It reports free(p + n), free(s->data + s->off), free(&buf[i]) with a non-zero index and free(++p), and a local pointer that was assigned from malloc, calloc, realloc, strdup or strndup, advanced in the same function (p++, *p++ = c, p += n), and then freed without being reset.

It does not report free(ptr - HEADER) (the allocator-wrapper idiom), a separate cursor that walks the buffer while the original pointer is freed, free(items[i]), free(&buf[0]) or wrapper functions such as sdsfree.

Why This Matters

free() must receive exactly the pointer the allocator returned. An interior pointer makes the allocator read a chunk header from the wrong place, which corrupts the heap and can be turned into an arbitrary write.

What Gets Flagged

free(packet + hdr);          // flagged
free(&buf[4]);               // flagged

char *line = strdup(in);
while (isspace(*line))
    line++;
free(line);                  // flagged

Remediation

1. Keep the original pointer and walk the buffer with a separate cursor (char *p = buf; ... free(buf);).
2. Free only the pointer that malloc, calloc, realloc or strdup returned.

References

• CWE-761: Free of Pointer not at Start of Buffer

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-761
// nosec vnx-761

Or record an ignore rule: vulnetix ignore add --rule vnx-761 --reason "...". See Suppressing findings.