VNX-788: Access of Memory Location After End of Buffer

Field	Value
Rule ID	VNX-788
Severity	High
SARIF level	error
Kind	sast
Languages	C, C++
CWE	CWE-788
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H
Tags	oob-access-after-end cwe-788
Source	internal/sast/rules/vnx-788.rego

Overview

VNX-788 maps to CWE-788: Access of Memory Location After End of Buffer. It reports C and C++ accesses one element past the end of an array declared in the same file:

• X[sizeof(X)] or X[sizeof X]
• X[N] where the nearest declaration of X is T X[N] (N a number or a constant)
• a for loop bounded by i <= N or i <= sizeof(X) that indexes X[i] in its body
• n = read(fd, X, sizeof X) (also recv, pread, fread(X, 1, ...)) followed by X[n] = ..., where a full read leaves no room for the terminator

Arrays declared elsewhere, struct members, pointer buffers, &X[N] (a valid one-past-the-end pointer) and bounds computed at run time are not reported.

Why This Matters

Valid indexes run from 0 to size - 1. Writing at index size corrupts whatever follows the array (another variable, a saved frame pointer, heap metadata), and reading it leaks adjacent memory.

What Gets Flagged

char name[32];
name[sizeof(name)] = '\0';              // FLAGGED

int vals[N];
for (i = 0; i <= N; i++)                // FLAGGED: runs to vals[N]
    total += vals[i];

ssize_t got = read(fd, req, sizeof(req));
req[got] = '\0';                        // FLAGGED: got can equal sizeof(req)

Remediation

1. Terminate at sizeof(buf) - 1 and read at most sizeof(buf) - 1 bytes.
2. Bound loops with i < N.

References

• CWE-788: Access of Memory Location After End of Buffer
• CWE-193: Off-by-one Error

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-788
// nosec vnx-788

Or record an ignore rule: vulnetix ignore add --rule vnx-788 --reason "...". See Suppressing findings.