VNX-785: Use of Path Manipulation Function without Maximum-sized Buffer

Field	Value
Rule ID	VNX-785
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-785
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	path-manipulation-call-to-uncanonical cwe-785
Source	internal/sast/rules/vnx-785.rego

Overview

VNX-785 maps to CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer. It reports C and C++ calls to path functions that write a path of unbounded length into a caller buffer without being told its size:

• getwd(buf), always: it takes no size at all
• realpath(src, dst) where dst is a local array declared in the file with a size below PATH_MAX/MAXPATHLEN (4096)
• PathCanonicalize, PathCombine and PathAppend (A/W variants) where the output array is declared smaller than MAX_PATH (260)

realpath(p, NULL), buffers whose declaration is not visible in the file (pointers, struct members) and functions that take a size, such as getcwd(buf, sizeof buf), are not reported.

Why This Matters

These functions assume the output buffer can hold the longest possible path. A resolved path longer than the array overflows it on the stack, and an attacker who controls directory names or symlinks controls how long that path is.

What Gets Flagged

char resolved[256];
if (realpath(name, resolved) == NULL)   // FLAGGED: 256 < PATH_MAX
    return -1;

char dir[1024];
getwd(dir);                             // FLAGGED: no size argument

char clean[64];
PathCanonicalizeA(clean, input);        // FLAGGED: 64 < MAX_PATH

Remediation

1. Pass NULL to realpath() and free the returned buffer, or declare the output char buf[PATH_MAX].
2. Replace getwd() with getcwd(buf, sizeof buf).
3. On Windows, size outputs MAX_PATH or use PathCchCanonicalizeEx/PathCchCombineEx, which take the buffer length.

References

• CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
• realpath(3)

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-785
// nosec vnx-785

Or record an ignore rule: vulnetix ignore add --rule vnx-785 --reason "...". See Suppressing findings.