NPD.GEN.CALL.MUST
Possible assigned null pointer may be dereferenced through a function call
An attempt to access data using a null pointer causes a runtime error. When a program dereferences a pointer that is expected to be valid but turns out to be null, a null pointer dereference occurs. Null-pointer dereference defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a pointer is dereferenced in C/C++ code, it must be checked to confirm that it is not equal to null.
The NPD checkers look for instances in which a null or possibly null pointer is dereferenced.
The NPD.GEN.CALL.MUST checker flags situations in which a null pointer that's been assigned a constant null value locally is subsequently passed to a function that dereferences it without checking it for null.
Vulnerability and risk
Null-pointer dereferences usually result in the failure of the process. These issues typically occur due to ineffective exception handling.
Mitigation and prevention
To avoid this vulnerability:
- Check for a null value in the results of all functions that return values
- Make sure all external inputs are validated
- Explicitly initialize variables
- Make sure that unusual exceptions are handled correctly
Vulnerable code example
void reassign(int *argument, int *p) {
if (goodEnough(argument)) return;
*argument = *p;
}
void npd_gen_call_must(int *argument) {
int *p = NULL;
reassign(argument, p);
}
Klocwork reports a defect in this example because *p, which is assigned a null constant value, is passed to function reassign, in which it's dereferenced. This type of vulnerability can produce unexpected and unintended results.
Fixed code example
void reassign(int *argument, int *p) {
if (goodEnough(argument)) return;
*argument = *p;
}
void npd_gen_call_must(int *argument) {
int *p = NULL;
if (p != 0) reassign(argument, p);
}
In the fixed code, *p is checked for null in line 8 before the dereference.
Related checkers
Security training
Application security training materials provided by Secure Code Warrior.
Extension
This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis for more information.