An object reference value from a call to a function that might return null might be dereferenced either explicitly or through a call to a function that can dereference it, without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.

Example 1

1                  public class A {
2                      public A foo() {
3                          if (flag)
4                              return null;
5                          return new A();
6                      }
7  
8                      public void var() {
9                          A a = foo();
10                         if (flag)
11                             a.foo();
12                     }
13 
14                     private bool flag;
15                 }

Klocwork produces an issue report (CS.NRE.FUNC.MIGHT) at line 11 for variable 'a'. If Variable 'a' is assigned to a value which might be null and which comes from a call to function 'foo' at line 9, it may still be null when it is dereferenced at line 11.