Null pointer dereferencing refers to treating a null variable as if it were a valid object or field and proceeding to use it without checking its state. Typically, this This condition results in a NullPointerException which may sometimes result in denial of service. While other runtime exceptions can produce similar effects, NullPointerException is often found to be the most frequent show-stopper.
| Wiki Markup |
|---|
The prevalence of null Null pointer dereferencing bugs is so widespread that it is not uncommon to find errorscommonly appear in security contexts. For instance, Java Webstart applications and applets particular to JDK version 1.6, prior to update 4, were affected by a bug that had some noteworthy security consequences. A {{NullPointerException}} was generated in some isolated cases when the application or applet attempted to establish an https connection with a server \[[SDN 2008|AA. Bibliography#SDN 08]\]. The failure to establish a secure https connection with the server caused a denial of service issue as clients were temporarily forced to use an insecure http channel for data exchange. |
Noncompliant Code Example
| Wiki Markup |
|---|
This noncompliant example shows a bug in Tomcat version 4.1.24 initially discovered by Reasoning \[[Reasoning 2003|AA. Bibliography#Reasoning 03]\]. The {{cardinality}} method was designed to return the number of occurrences of object {{obj}} in collection {{col}}. A valid use of the {{cardinality}} method is to determine how many objects in the collection are {{null}}. However, because membership in the collection is checked with the expression {{obj.equals(elt)}}, a null pointer dereference is guaranteed whenever {{obj}} is {{null}}. Such ambiguity can also result from the short-circuit behavior of the conditional AND and OR operators (See guideline [EXP07-J. Be aware of the short-circuit behavior of the conditional AND and OR operators].) |
| Code Block | ||
|---|---|---|
| ||
public static int cardinality(Object obj, final Collection col) {
int count = 0;
Iterator it = col.iterator();
while(it.hasNext()) {
Object elt = it.next();
if((null == obj && null == elt) || obj.equals(elt)) { // null pointer dereference
count++;
}
}
return count;
}
|
Compliant Solution
This compliant solution eliminates the null pointer dereference.
...
| Wiki Markup |
|---|
Null pointer dereferences can happen in many path dependent ways. Because of the limitations of automatic detection tools, it is required to manually inspect code \[[Hovemeyer 2007|AA. Bibliography#Hovemeyer 07]\] to detect instances of null pointer dereferences. Annotations for method parameters that must be non-null can also alleviate the problem to a certain extent by aiding automatic null pointer dereference detection. |
Risk Assessment
Dereferencing a null pointer can lead to denial of Service. In multithreaded programs, this can violate cache coherency policies and cause resource leaks.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP12-J | low | likely | high | P3 | L3 |
Automated Detection
The Coverity Prevent Version 5.0 FORWARD_NULL checker can detect the instance where reference is checked against null but then dereferenced anyway.
Related Vulnerabilities
Bibliography
| Wiki Markup |
|---|
\[[API 2006|AA. Bibliography#API 06]\] [method doPrivileged()|http://java.sun.com/javase/6/docs/api/java/security/AccessController.html#doPrivileged(java.security.PrivilegedAction)] \[[Reasoning 2003|AA. Bibliography#Reasoning 03]\] Defect ID 00-0001, Null Pointer Dereference \[[SDN 2008|AA. Bibliography#SDN 08]\] [Bug ID 6514454|http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6514454] \[[Hovemeyer 2007|AA. Bibliography#Hovemeyer 07]\] \[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 479|http://cwe.mitre.org/data/definitions/476.html] |
...