CS.RNRE

This warning is reported in situations where a null object reference is dereferenced, then compared with null, and there are no object reference changes on the trace between dereferencing and checking. So, it is very likely that at dereferencing, the object reference might be null, or the null check is improper.

Vulnerability and risk

Identifies one of three things:

• A pointer that can be null by design was dereferenced without a proper check, and this will lead to a runtime error.
• A condition is written incorrectly and, therefore, the code will not work as intended.
• There is a redundant check; unnecessary code will be generated.

Example

1
2
3
4
5
6
7
8
                  public class A {
                      public void foo() {
                          A a = null;
                          a.foo();
                          if (a == null)
                              a = new A();
                      }
                  }

Klocwork produces an issue report (CS.RNRE) at line 4 for variable 'a'. It's dereferenced at line 4 by calling method 'foo' and then, at line 5, 'a' is checked with null in if statement.

External guidance

• CWE-476: NULL Pointer Dereference

Security training

Application security training materials provided by Secure Code Warrior.

• Null Dereference Training Video - Test your skills with a training example