Attempting to dereference a null NULL pointer results in undefined behavior, typically abnormal program termination.
...
In this example, input_str is copied into dynamically allocated memory referenced by str. If malloc() fails, it returns a null NULL pointer that is assigned to str. When str is dereferenced in memcpy(), the program behaves in an unpredictable manner.
...
To correct this error, ensure the pointer returned by malloc() is not nullNULL. This also ensures compliance with MEM32-C. Detect and handle memory allocation errors.
...
| Wiki Markup |
|---|
Dereferencing a nullNULL pointer results in undefined behavior, typically abnormal program termination. In some situations, however, dereferencing a nullNULL pointer can lead to the execution of arbitrary code \[[Jack 07|AA. C References#Jack 07], [van Sprundel 06|AA. C References#van Sprundel 06]\]. The indicated severity is for this more severe case; on platforms where it is not possible to exploit a nullNULL pointer dereference to execute arbitrary code, the actual severity is low. |
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP34-C | 3 ( high ) 3 ( | likely ) | 2 ( medium ) | P18 | L1 |
Automated Detection
The LDRA tool suite V 7.6.0 is able to detect violations of this rule.
...
The Coverity Prevent CHECKED_RETURN, NULL_RETURNS, and REVERSE_INULL checkers can all find violations of this rule. The CHECKED_RETURN finds instances where a pointer is checked against NULL and then later dereferenced. The NULL_RETURNS checker identifies functions that can return a null NULL pointer but are not checked. The REVERSE_INULL identifies code that dereferences a pointer and then checks the pointer against NULL. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.
...