VNX-824: Access of Uninitialized Pointer

Field	Value
Rule ID	VNX-824
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++
CWE	CWE-824
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	access-of-uninitialized-pointer cwe-824 c cpp memory-safety
Source	internal/sast/rules/vnx-824.rego

Overview

VNX-824 maps to CWE-824: Access of Uninitialized Pointer. It reports a local pointer declared without an initialiser (char *p;, struct node *n;, std::string *s;) whose first mention in the same function, within 40 lines, dereferences it: *p, p->field, p[i], a buffer argument of strcpy/strncpy/strcat/memcpy/memmove/memset/sprintf/snprintf/fgets/gets/read/recv/fread/strlen/strcmp/printf/puts/free, or delete p.

Not reported: a first mention that assigns the pointer (p = malloc(...), for (p = head; ...), if ((p = f()) == NULL)), takes its address (getaddrinfo(..., &res), getline(&line, ...)), or only tests it; pointers with an initialiser; static, extern and file-scope pointers (zero-initialised); struct, union and class members; K&R parameter declarations and lines that continue an expression from the line above; declarations listing several pointers; flow through other functions; comments and string literals. Uninitialised scalars and arrays are VNX-457.

Why This Matters

An uninitialised local pointer holds whatever the stack held before. Writing through it corrupts an arbitrary address; reading through it leaks or crashes. Because the stale value depends on earlier calls, the bug often works in tests and fails in production.

What Gets Flagged

char *p;
strcpy(p, who);          /* FLAGGED: p was never given an address */

struct node *n;
n->value = value;        /* FLAGGED */

Remediation

1. Initialise every pointer at its declaration (char *p = NULL;) and assign it a real object before use.
2. Allocate or point at a buffer before copying into it.

References

• CWE-824: Access of Uninitialized Pointer
• SEI CERT EXP33-C: Do not read uninitialized memory

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-824
// nosec vnx-824

Or record an ignore rule: vulnetix ignore add --rule vnx-824 --reason "...". See Suppressing findings.