VNX-771: Missing Reference to Active Allocated Resource

Field	Value
Rule ID	VNX-771
Severity	Medium
SARIF level	warning
Kind	sast
Languages	C, C++
CWE	CWE-771
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	missing-reference-to-resource cwe-771
Source	internal/sast/rules/vnx-771.rego

Overview

VNX-771 maps to CWE-771: Missing Reference to Active Allocated Resource. It reports two shapes in C and C++:

1. p = realloc(p, n), including through a cast, static_cast or std::realloc, and for members such as v->items. When realloc fails it returns NULL and leaves the original block allocated; the assignment overwrites the only pointer to it.
2. A pointer initialised or assigned from malloc, calloc, realloc, strdup, strndup or new that is assigned a fresh allocation again in the same function, within 40 lines, with no free/delete, return, copy to another variable or hand-off to a function in between.

Not reported: realloc into a temporary that is checked before replacing the original; a pointer freed, returned, stored or passed to another function (other than mem*/str* and printf-style calls) before reassignment; reassignment in an alternative branch (else, case) or only after a failed allocation (if (p == NULL)); comments and string literals. Allocations that are simply never freed (CWE-401) are not judged.

Why This Matters

Memory whose last reference is overwritten can never be freed. An input that drives the path repeatedly (a growing buffer, a retry loop) leaks until the process is killed, and the realloc shape also turns an out-of-memory condition into a NULL dereference.

What Gets Flagged

buf = realloc(buf, cap);                 /* flagged */

char *s = strdup(a);                     /* flagged: overwritten below */
if (strlen(b) > strlen(a)) {
    s = strdup(b);
}

Not flagged:

char *tmp = realloc(*out, next);
if (tmp == NULL) return -1;
*out = tmp;

Remediation

Assign realloc to a temporary and replace the original only on success. Free (or hand off) a block before assigning its pointer a new one.

References

• CWE-771: Missing Reference to Active Allocated Resource
• SEI CERT MEM04-C / MEM31-C

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-771
// nosec vnx-771

Or record an ignore rule: vulnetix ignore add --rule vnx-771 --reason "...". See Suppressing findings.