An object reference value from a call to a function that might return null will be dereferenced either explicitly, or through a call to a function that can dereference it, without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operation systems or throw a runtime exception on others.

Example 1

                  public class A {
                      public A foo() {
                          if (flag)
                              return null;
                          return new A();
                      public void var() {
                          A a = foo();
                     private bool flag;

Klocwork produces an issue report (CS.NRE.FUNC.MUST) at line 10 for variable 'a'. Variable 'a' is assigned to a value which might be null and which comes from a call to function 'foo' at line 9, and will be dereferenced at line 10.

Security training

Application security training materials provided by Secure Code Warrior.