VNX-789: Memory Allocation with Excessive Size Value

C/C++ malloc/calloc/realloc/alloca/new[] sized by a number parsed from input (atoi, strtol, scanf, ntohl, std::stoi) with no upper bound checked first.

Field	Value
Rule ID	`VNX-789`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-789
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`memory-allocation` `cwe-789`
Source	`internal/sast/rules/vnx-789.rego`

Overview

VNX-789 maps to CWE-789: Memory Allocation with Excessive Size Value. It reports C and C++ allocations (malloc, calloc, realloc, reallocarray, alloca, valloc, new T[n], and the container calls v.resize(n), v.reserve(n) and std::vector<T> v(n)) whose size is an externally controlled number:

a value parsed with atoi/atol/strtol/strtoul/std::stoi and friends
a value read with scanf/fscanf/sscanf
a length decoded from the wire with ntohl/ntohs/be32toh/le32toh and friends

The value must be assigned in the ten lines above the allocation (or the parse call written inline in the size argument). A comparison against an upper limit or a MIN()/std::min clamp between the read and the allocation suppresses the report; a lower-bound check such as n < 0 alone does not. Sizes from strlen(), sizeof or constants, and flows across functions, are not reported.

Why This Matters

The requester chooses how much memory the process allocates. A 4 GiB length prefix exhausts memory, alloca() with a large value runs past the stack guard page, and a size that wraps after arithmetic allocates a tiny buffer that a later copy overflows.

What Gets Flagged

int count = atoi(argv[1]);
char *buf = malloc(count * sizeof(char));    // FLAGGED

len = ntohl(raw);
payload = malloc(len);                       // FLAGGED

Not flagged:

int count = atoi(argv[1]);
if (count <= 0 || count > MAX_COUNT)
    return NULL;
return malloc(count);

Remediation

Reject sizes above a fixed maximum appropriate to the data before allocating.
Use calloc/reallocarray for counts times element sizes so the multiplication is overflow-checked.
Never pass input-derived sizes to alloca() or variable-length arrays.

References

CWE-789: Memory Allocation with Excessive Size Value

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-789
// nosec vnx-789

Or record an ignore rule: vulnetix ignore add --rule vnx-789 --reason "...". See Suppressing findings.