VNX-763: Release of a pointer that never came from the heap

Reports free() or delete of an address that never came from the heap: the address of a variable, a stack or file-scope array, or a string literal, in C and C++.

Field	Value
Rule ID	`VNX-763`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-763
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`memory` `release-of-invalid-pointer` `cwe-763`
Source	`internal/sast/rules/vnx-763.rego`

Overview

VNX-763 maps to CWE-763: Release of Invalid Pointer or Reference. It reports free(&x) for a plain variable, free(arr) and delete[] arr where arr is declared as an array in the same function or at file scope, free("literal"), and C++ delete &x.

It does not report pointers from an allocator, &p[0], array parameters (which are pointers), struct members, wrapper functions such as sdsfree, or an array of the same name in another function. Offset pointers are VNX-761, mismatched allocators VNX-762 and double frees VNX-415.

Why This Matters

The allocator trusts that whatever it is given has a chunk header it wrote. A stack or static address has none, so the release corrupts the allocator’s free lists, which is a classic route to code execution.

What Gets Flagged

struct config cfg;
free(&cfg);          // flagged

char path[4096];
free(path);          // flagged

free("default");     // flagged

Remediation

Release only memory obtained from the matching allocator.
Let stack and static objects go out of scope; do not free them.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-763
// nosec vnx-763

Or record an ignore rule: vulnetix ignore add --rule vnx-763 --reason "...". See Suppressing findings.