You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 76 Next »

Attempting to dereference a null pointer results in undefined behavior, typically abnormal program termination.

Noncompliant Code Example

In this example, input_str is copied into dynamically allocated memory referenced by str. If malloc() fails, it returns a null pointer that is assigned to str. When str is dereferenced in memcpy(), the program behaves in an unpredictable manner.

size_t size = strlen(input_str)+1;
str = (char *)malloc(size);
memcpy(str, input_str, size);
/* ... */
free(str);
str = NULL; 

Compliant Solution

To correct this error, ensure the pointer returned by malloc() is not NULL. This also ensures compliance with MEM32-C. Detect and handle memory allocation errors.

size_t size = strlen(input_str)+1;
str = (char *)malloc(size);
if (str == NULL) {
  /* Handle Allocation Error */
}
memcpy(str, input_str, size);
/* ... */
free(str);
str = NULL; 

Risk Assessment

Dereferencing a null pointer results in undefined behavior, typically abnormal program termination. In some situations, however, dereferencing a null pointer can lead to the execution of arbitrary code [[Jack 07], [van Sprundel 06]]. The indicated severity is for this more severe case; on platforms where it is not possible to exploit a null pointer dereference to execute arbitrary code, the actual severity is low.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

EXP34-C

high

likely

medium

P18

L1

Automated Detection

The LDRA tool suite Version 7.6.0 can detect violations of this rule.

Fortify SCA Version 5.0 can detect violations of this rule.

Splint Version 3.1.1 can detect violations of this rule.

Compass/ROSE can detect violations of this rule. In particular, Rose ensures that any pointer returned by malloc(), calloc(), or realloc() is first checked for NULL before being used (otherwise it is free()-d). Rose does not handle cases where an allocation is assigned to an lvalue that is not a variable (such as a struct member or C++ function call returning a reference.)

The Coverity Prevent CHECKED_RETURN, NULL_RETURNS, and REVERSE_INULL checkers can all find violations of this rule. The CHECKED_RETURN finds instances where a pointer is checked against NULL and then later dereferenced. The NULL_RETURNS checker identifies functions that can return a null pointer but are not checked. The REVERSE_INULL identifies code that dereferences a pointer and then checks the pointer against NULL. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

Klocwork Version 8.0.4.16 can detect violations of this rule with the NPD.CHECK.CALL.MIGHT, NPD.CHECK.CALL.MUST, NPD.CHECK.MIGHT, NPD.CHECK.MUST, NPD.CONST.CALL, NPD.CONST.DEREF, NPD.FUNC.CALL.MIGHT, NPD.FUNC.CALL.MUST, NPD.FUNC.MIGHT, NPD.FUNC.MUST, NPD.GEN.CALL.MIGHT, NPD.GEN.CALL.MUST, NPD.GEN.MIGHT, and NPD.GEN.MUST checkers.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

[[ISO/IEC 9899:1999]] Section 6.3.2.3, "Pointers"
[[ISO/IEC PDTR 24772]] "HFC Pointer casting and pointer type changes" and "XYH Null Pointer Dereference"
[[Jack 07]]
[[MITRE 07]] CWE ID 476, "NULL Pointer Dereference"
[[van Sprundel 06]]
[[Viega 05]] Section 5.2.18, "Null-pointer dereference"


EXP33-C. Do not reference uninitialized memory      03. Expressions (EXP)       EXP35-C. Do not access or modify an array in the result of a function call after a subsequent sequence point

  • No labels