...
This noncompliant code example is a real-world example taken from a vulnerable version of the libpng library as deployed on a popular ARM-based cell phone [Jack 2007]. The The libpng implements its own wrapper to malloc() that returns a null pointer on error or on being passed a 0 byte length argument.
| Code Block | ||||
|---|---|---|---|---|
| ||||
png_charp chunkdata; chunkdata = (png_charp)png_malloc(png_ptr, length + 1); |
If a length field of -1 −1 is supplied to the code in this noncompliant example, the addition wraps around to 0, and png_malloc() subsequently returns a null pointer, which is assigned to chunkdata. The The chunkdata pointer is later used as a destination argument in a call to memcpy(), resulting in user-defined data overwriting memory starting at address 0. A A write from , or read to , the memory address 0x0 will generally reference invalid or unused memory. In the case of the ARM and XScale architectures, the 0x0 address is mapped in memory and serves as the Exception Vector Table.
...
To correct this error, ensure the pointer returned by malloc() is not null. This also ensures compliance with rule MEM32-C. Detect and handle memory allocation errors.
...
To correct this error, ensure the pointer returned by malloc() is not null. This also ensures compliance with rule MEM32-C. Detect and handle memory allocation errors.
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP34-C | high | likely | medium | P18 | L1 |
Automated Detection
| Tool | Version | Checker | Description | section|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 45 D | | Section | | |||||||||
| Section | Fortify SCA | | Section | V. 5.0 | section | ||||||||
Splint |
| section | ||||||||||
| Compass/ROSE | | Section | Can detect violations of this rule. In particular, RoseROSE ensures that any pointer returned by ROSE does not handle cases where an allocation is assigned to an lvalue that is not a variable (such as a struct member or C++ function call returning a reference). )section | ||||||||||
|
| CHECKED_RETURN | | Section | Finds instances where a pointer is checked against | ||||||||
| Section | |
| section NULL_RETURNS section | identifies Identifies functions that can return a null pointer but are not checked. | ||||||||
| section |
| section REVERSE_INULL section | identifies Identifies code that dereferences a pointer and then checks the pointer against | |||||||||
| section |
| section FORWARD_NULL section | can Can find the instances where against Coverity Prevent cannot discover all violations of this rule, so further verification is necessary. | |||||||||
| section |
| section NPD.* *RNPD.* |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
The CERT Oracle Secure Coding Standard for Java: EXP01-J. Never dereference null pointers
ISO/IEC 9899:19992011 Section 6.3.2.3, "Pointers"
ISO/IEC TR 17961 (Draft) Dereferencing an out-of-domain pointer [nullref]
ISO/IEC TR 24772 "HFC Pointer casting and pointer type changes" and "XYH Null Pointer Dereference"
...