Page History

...

To correct this error, ensure the pointer returned by malloc() is not null. This also practice ensures compliance with MEM32-C. Detect and handle memory allocation errors.

...

To correct this error, ensure the pointer returned by malloc() is not null. This practice also ensures compliance with MEM32-C. Detect and handle memory allocation errors.

...

This noncompliant code example can be found in drivers/net/tun.c and affects Linux kernel 2.6.30 [Goodin 2009].:

Code Block

bgColor	#FFCCCC
lang	c

static unsigned int tun_chr_poll(struct file *file, poll_table * wait)  {
  struct tun_file *tfile = file->private_data;
  struct tun_struct *tun = __tun_get(tfile);
  struct sock *sk = tun->sk;
  unsigned int mask = 0;

  if (!tun)
    return POLLERR;

  DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name);

  poll_wait(file, &tun->socket.wait, wait);

  if (!skb_queue_empty(&tun->readq))
    mask |= POLLIN | POLLRDNORM;

  if (sock_writeable(sk) ||
     (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
     sock_writeable(sk)))
    mask |= POLLOUT | POLLWRNORM;

  if (tun->dev->reg_state != NETREG_REGISTERED)
    mask = POLLERR;

  tun_put(tun);
  return mask;
}

...

This compliant solution eliminates the null pointer deference by initializing sk to tun->sk following the null pointer check.:

Code Block

bgColor	#ccccff
lang	c

static unsigned int tun_chr_poll(struct file *file, poll_table * wait)  {
  struct tun_file *tfile = file->private_data;
  struct tun_struct *tun = __tun_get(tfile);
  struct sock *sk;
  unsigned int mask = 0;

  if (!tun)
    return POLLERR;

  sk = tun->sk;

  DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name);

  poll_wait(file, &tun->socket.wait, wait);

  if (!skb_queue_empty(&tun->readq))
    mask |= POLLIN | POLLRDNORM;

  if (sock_writeable(sk) ||
     (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
     sock_writeable(sk)))
    mask |= POLLOUT | POLLWRNORM;

  if (tun->dev->reg_state != NETREG_REGISTERED)
    mask = POLLERR;

  tun_put(tun);
  return mask;
}

...

Tool Version Checker Description

Compass/ROSE

Can detect violations of this rule. In particular, ROSE ensures that any pointer returned by malloc(), calloc(), or realloc() is first checked for NULL before being used (otherwise, it is free()-d). ROSE does not handle cases where an allocation is assigned to an lvalue that is not a variable (such as a struct member or C++ function call returning a reference).

Coverity

Include Page

	Coverity_V
	Coverity_V

CHECKED_RETURN

NULL_RETURNS

REVERSE_INULL

FORWARD_NULL

Finds instances where a pointer is checked against NULL and then later dereferenced.

Identifies functions that can return a null pointer but are not checked.

Identifies code that dereferences a pointer and then checks the pointer against NULL.

Can find the instances where NULL is explicitly dereferenced or a pointer is checked against NULL but then dereferenced anyway. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.

Fortify SCA

5.0

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

NPD.* *RNPD.*

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

45 D

Fully implemented.

PRQA QA-C

Include Page

	PRQA_V
	PRQA_V

0504
0505
0506

Fully implemented.

Splint

Include Page

	Splint_V
	Splint_V

...

[Goodin 2009]
[Jack 2007]
[Liu 2009]
[van Sprundel 2006]
[Viega 2005]	Section 5.2.18, "Null-Pointer Dereference"

...

png_charp

Space shortcuts

Page tree

Versions Compared

Old Version 118

New Version 119

Key