...
On many platforms dereferencing a null pointer results in abnormal program termination, but this is not required by the standard. See See "Clever Attack Exploits Fully-Patched Linux Kernel" [Goodin 2009] for an example of a code execution exploit that resulted from a null pointer dereference.
...
If length has the value −1, the addition wraps around to 0, and png_malloc() subsequently returns a null pointer, which is assigned to chunkdata. The chunkdata pointer is later used as a destination argument in a call to memcpy(), resulting in user-defined data overwriting memory starting at address 0. In the case of the ARM and XScale architectures, the 0x0 address is mapped in memory and serves as the exception vector table; consequently, dereferencing 0x0 did not cause program termination.
...
This compliant solution ensures that the pointer returned by png_malloc() is not null. It It also uses the unsigned type size_t to pass the length parameter, ensuring that negative values are not passed to func().
...
In this noncompliant code example, input_str is copied into dynamically allocated memory referenced by str. If malloc() fails, it returns a null pointer that is assigned to str. When str is dereferenced in memcpy(), the program exhibits undefined behavior. Additionally, if input_str is a null pointer, the call to strlen() dereferences a null pointer, resulting in undefined behavior. This code also violates MEM32-C. Detect and handle memory allocation errors.
...
Dereferencing a null pointer results in undefined behavior, typically abnormal program termination. In some situations, however, dereferencing a null pointer can lead to the execution of arbitrary code [Jack 2007, van Sprundel 2006]. The indicated severity is for this more severe case; on platforms where it is not possible to exploit a null pointer dereference to execute arbitrary code, the actual severity is low.
...
| Tool | Version | Checker | Description | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Compass/ROSE | Can detect violations of this rule. In particular, ROSE ensures that any pointer returned by | ||||||||||
|
| CHECKED_RETURN NULL_RETURNS REVERSE_INULL FORWARD_NULL | Finds instances where a pointer is checked against Identifies functions that can return a null pointer but are not checked Identifies code that dereferences a pointer and then checks the pointer against Can find the instances where | ||||||||
5.0 | |||||||||||
| NPD.* *RNPD.* | ||||||||||
| 45 D | Fully implemented | |||||||||
| PRQA QA-C |
| 0504 | Fully implemented | ||||||||
|
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...