VNX-762: Memory released with a routine that does not match its allocator

Field	Value
Rule ID	VNX-762
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-762
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	memory mismatched-memory-mgmt cwe-762
Source	internal/sast/rules/vnx-762.rego

Overview

VNX-762 maps to CWE-762: Mismatched Memory Management Routines. For a local pointer whose most recent assignment in the same function is the allocation, it reports new T[n] released with free() or scalar delete, new T released with free() or delete[], malloc/calloc/realloc/strdup memory released with delete or delete[], and alloca memory passed to free(). It also reports std::unique_ptr<T> or std::shared_ptr<T> constructed from new T[n].

It does not report matching pairs, a pointer reassigned from another allocator before the release, releases in another function, placement new, unique_ptr<T[]>, or identifiers that only contain the word new.

Why This Matters

Each allocator keeps its own bookkeeping. Releasing through the wrong one is undefined behaviour: destructors are skipped, the array length cookie of new[] is misread, and the heap can be corrupted.

What Gets Flagged

unsigned char *pixels = new unsigned char[n];
free(pixels);                                  // flagged

char *dst = (char *)malloc(len);
delete[] dst;                                  // flagged

std::unique_ptr<char> buf(new char[n]);        // flagged

Remediation

1. Pair new/delete, new[]/delete[] and malloc/free; never free alloca memory.
2. Prefer std::vector, std::string or std::unique_ptr<T[]> so the release is chosen for you.

References

• CWE-762: Mismatched Memory Management Routines

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-762
// nosec vnx-762

Or record an ignore rule: vulnetix ignore add --rule vnx-762 --reason "...". See Suppressing findings.