CS.NRE.CONST.CALL

A null object reference constant value is passed to a function that may dereference it without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.

Example 1

1                      class Param {
2                          public int par1() {
3                              return 0;
4                          }
5                      }
6                      class NPD3 {
7                          public void foo() {
8                              foo2(null);
9                          }
10                         public void foo2(Param param) {
11                             if (flag)
12                                 return;
13                             param.par1();
14                         }
15                         private bool flag;
16                     }

Klocwork produces an issue report (CS.NRE.CONST.CALL) at line 8. Constant null-pointer value is passed as argument 1 to function 'foo2' at line 8, which may dereference it.