An object reference value from a local assignment of a null-constant, or from a call to a function that will return null, might be dereferenced either explicitly, or through a call to a function that will dereference it, without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.

Example 1

1                  public class A {
2                      public void foo() {
3                          A c = null;
4                          if (flag)
5                              c.foo();
6                      }
8                      private bool flag;
9                  }

Null-source: explicit assignment Null-dereferencing: explicit Klocwork produces an issue report (CS.NRE.GEN.MIGHT) at line 3 for variable 'c'. If flag is greater than 0, 'c' will be dereferenced at line 5.

Security training

Application security training materials provided by Secure Code Warrior.