An object reference value from a call to a function that might return null might be dereferenced either explicitly or through a call to a function that can dereference it, without checking for null.
Vulnerability and risk
Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.
public Program foo()
return new Program();
public void var(bool b)
Program a = foo();
private bool flag;
Klocwork produces an issue report (CS.NRE.FUNC.MIGHT) at line 18 for variable 'a'. If Variable 'a' is assigned to a value which might be null and which comes from a call to function 'foo' at line 16, it may still be null when it is dereferenced at line 18.
Application security training materials provided by Secure Code Warrior.