An object reference value from local assignment of a null-constant or from a call to a function that will return null might be passed to a function that might dereference it, without checking for null.

Vulnerability and risk

Dereferencing a null object reference is a critical runtime problem that will crash the application on some operating systems and throw a runtime exception on others.

Example 1

1  public class A {
2    public void abc() {}
3     public void foo(A a) {
4      if (flag2)
5        return;
6      a.abc();
7     }
8  
9     public void var() {
10     A a = null;
11     if (flag)
12       foo(a);
13    }
14 
15    private bool flag;
16    private bool flag2;
17 }

Klocwork produces an issue report (CS.NRE.GEN.CALL.MIGHT) at line 12 for variable 'a'. Variable 'a' is explicitly assigned to null value at line 10. It may be passed as argument 1 to function 'foo' at line 12, which may dereference it.