CS.NRE.GEN.MUST

An object reference value from either a local assignment of a null-constant, or a call to function that will return null, will be dereferenced either explicitly or through a call to a function that may dereference it, without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.

Example 1

1
2
3
4
5
6
              public class A {
                  public void foo() {
                      A c = null;
                      c.foo();
                  }
              }

Null-source: explicit assignmentNull-dereferencing: explicitKlocwork produces an issue report (CS.NRE.GEN.MUST) at line 4 for variable 'c'. Variable 'c' is explicitly assigned to null value at line 3 and will be dereferenced at line 4.

External guidance

• CWE-476: NULL Pointer Dereference

Security training

Application security training materials provided by Secure Code Warrior.

• Null Dereference Training Video - Test your skills with a training example