NPD.FUNC.CALL.MIGHT
Possible null pointer may be dereferenced through a conditional function call
An attempt to access data using a null pointer causes a runtime error. When a program dereferences a pointer that is expected to be valid but turns out to be null, a null pointer dereference occurs. Null-pointer dereference defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a pointer is dereferenced in C/C++ code, it must be checked to confirm that it is not equal to null.
The NPD checkers look for instances in which a null or possibly null pointer is dereferenced.
The NPD.FUNC.CALL.MIGHT checker flags situations in which a pointer value from a function call that might return null might subsequently be passed to a function that might dereference it without checking it for null.
Vulnerability and risk
Null-pointer dereferences usually result in the failure of the process. These issues typically occur due to ineffective exception handling.
Mitigation and prevention
To avoid this vulnerability:
- Check for a null value in the results of all functions that return values
- Make sure all external inputs are validated
- Explicitly initialize variables
- Make sure that unusual exceptions are handled correctly
Vulnerable code example
void reassign(int *argument, int *p) {
if (goodEnough(argument)) return;
*argument = *p;
}
int *mymalloc() {
int *res = malloc(sizeof(int));
if (!res) return 0;
*res = 0;
return res;
}
void npd_func_call_might(int *argument) {
int *p = mymalloc();
if (someCondition()){
p = f();
}
reassign(argument, p);
}
Depending on the result of the conditional statement at line 8, a null pointer may be passed to function npd_func_call_might, in which it may be dereferenced, depending on the condition at line 15. This type of vulnerability can produce unexpected and unintended results.
Fixed code example
void reassign(int *argument, int *p) {
if (goodEnough(argument)) return;
*argument = *p;
}
int *mymalloc() {
int *res = malloc(sizeof(int));
if (!res) return 0;
*res = 0;
return res;
}
void npd_func_call_might(int *argument) {
int *p = mymalloc();
if (someCondition()){
p = f();
}
if (p!= 0) reassign(argument, p);
}
In the fixed code, *p is checked for null in line 18 before the dereference.
Related checkers
External guidance
Security training
Application security training materials provided by Secure Code Warrior.
Extension
This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis for more information.