An attempt to access data using a null pointer causes a runtime error. When a program dereferences a pointer that is expected to be valid but turns out to be null, a null pointer dereference occurs. Null-pointer dereference defects often occur due to ineffective error handling or race conditions, and typically cause abnormal program termination. Before a pointer is dereferenced in C/C++ code, it must be checked to confirm that it is not equal to null.

The NPD checkers look for instances in which a null or possibly null pointer is dereferenced.

The NPD.GEN.MIGHT checker flags situations in which a pointer that's been assigned a null constant value locally might subsequently be dereferenced explicitly or passed to a function that might dereference it without checking it for null.

Vulnerability and risk

Null-pointer dereferences usually result in the failure of the process. These issues typically occur due to ineffective exception handling.

Mitigation and prevention

To avoid this vulnerability:

Check for a null value in the results of all functions that return values
Make sure all external inputs are validated
Explicitly initialize variables
Make sure that unusual exceptions are handled correctly

Vulnerable code example

1  void xstrcpy(char *dst, char *src) {
2    if (!src) return;
3    dst[0] = src[0];
4  }
5  
6  char global_buf[256];
7  
8  void npd_gen_might(int flag, char *arg) {
9    char *p = global_buf;
10   if (flag) p = NULL;
11   if (arg) { p = arg; }
12   xstrcpy(p, "Hello");
13 }

Klocwork produces an issue report at line 3 indicating that the dereferenced pointer 'dst' may be null. The constant null that is assigned to 'p' under condition 'flag' is true may be passed to function xstrcpy, in which it's dereferenced. Here, the NPD.GEN.MIGHT checker has found code that dereferences a pointer that may be equal to null. In this example, a MIGHT issue is reported, rather than a MUST, because 'p' may change value if condition 'arg' is true. This type of vulnerability can produce unexpected and unintended results.

Fixed code example

1  void xstrcpy(char *dst, char *src) {
2    if (!src) return;
3    if (!dst) return;
4    dst[0] = src[0];
5  }
6  
7  char global_buf[256];
8  
9  void npd_gen_might(int flag, char *arg) {
10   char *p = global_buf;
11   if (flag) p = NULL;
12   if (arg) { p = arg; }
13   xstrcpy(p, "Hello");
14 }

In the fixed code example, the function 'xstrcpy' will return at line 3 if the pointer 'dst' is null, preventing the possible null pointer dereference at line 4.

Related checkers

External guidance

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning C/C++ analysis for more information.