Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Dereferencing a null pointer can lead to a denial of service. In multithreaded programs, null pointer dereferences can violate cache coherency policies and can cause resource leaks.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

EXP01-J

Low

Likely

High

P3

L3

Automated Detection

Null pointer dereferences can happen in path-dependent ways. Limitations of automatic detection tools can require manual inspection of code [Hovemeyer 2007] to detect instances of null pointer dereferences. Annotations for method parameters that must be non-null can reduce the need for manual inspection by assisting automated null pointer dereference detection; use of these annotations is strongly encouraged.

ToolVersionCheckerDescription
The Checker Framework
Include Page
The Checker Framework_V
The Checker Framework_V

Nullness Checker
Initialization Checker
Map Key Checker

Null pointer errors (see Chapter 3)
Ensure all fields are set in the constructor (see Chapter 3.8)
Track which values are keys in a map (see Chapter 4)

CodeSonar4.2FB.CORRECTNESS.NP_ALWAYS_NULL
FB.CORRECTNESS.NP_ALWAYS_NULL_EXCEPTION
FB.CORRECTNESS.NP_ARGUMENT_MIGHT_BE_NULL
FB.BAD_PRACTICE.NP_BOOLEAN_RETURN_NULL
FB.BAD_PRACTICE.NP_CLONE_COULD_RETURN_NULL
FB.CORRECTNESS.NP_CLOSING_NULL
FB.STYLE.NP_DEREFERENCE_OF_READLINE_VALUE
FB.BAD_PRACTICE.NP_EQUALS_SHOULD_HANDLE_NULL_ARGUMENT
FB.CORRECTNESS.NP_GUARANTEED_DEREF
FB.CORRECTNESS.NP_GUARANTEED_DEREF_ON_EXCEPTION_PATH
FB.STYLE.NP_IMMEDIATE_DEREFERENCE_OF_READLINE
FB.STYLE.NP_LOAD_OF_KNOWN_NULL_VALUE
FB.CORRECTNESS.NP_NONNULL_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR
FB.CORRECTNESS.NP_NONNULL_PARAM_VIOLATION
FB.CORRECTNESS.NP_NONNULL_RETURN_VIOLATION
FB.STYLE.NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE
FB.CORRECTNESS.NP_NULL_ON_SOME_PATH_EXCEPTION
FB.STYLE.NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE
FB.CORRECTNESS.NP_NULL_ON_SOME_PATH
FB.CORRECTNESS.NP_NULL_PARAM_DEREF
FB.CORRECTNESS.NP_NULL_PARAM_DEREF_NONVIRTUAL

FB.CORRECTNESS.NP_NULL_PARAM_DEREF_ALL_TARGETS_DANGEROUS
FB.STYLE.NP_PARAMETER_MUST_BE_NONNULL_BUT_MARKED_AS_NULLABLE
FB.CORRECTNESS.NP_STORE_INTO_NONNULL_FIELD
FB.CORRECTNESS.NP_UNWRITTEN_FIELD
FB.STYLE.NP_UNWRITTEN_PUBLIC_OR_PROTECTED_FIELD
FB.CORRECTNESS.RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE
FB.BAD_PRACTICE.NP_TOSTRING_COULD_RETURN_NULL
Null pointer dereference
Null pointer dereference in method on exception path
Method does not check for null argument
Method with Boolean return type returns explicit null
Clone method may return null
close() invoked on a value that is always null
Dereference of the result of readLine() without nullcheck
equals() method does not check for null argument
Null value is guaranteed to be dereferenced
Value is null and guaranteed to be dereferenced on exception path
Immediate dereference of the result of readLine()
Load of known null value
Non-null field is not initialized
Method call passes null to a non-null parameter
Method may return null, but is declared @Nonnull
Possible null pointer dereference due to return value of called method
Possible null pointer dereference in method on exception path
Possible null pointer dereference on branch that might be infeasible
Possible null pointer dereference
Method call passes null for non-null parameter (deref)
Non-virtual method call passes null for non-null parameter
Method call passes null for non-null parameter (deref all)
Parameter must be non-null but is marked as nullable
Store of null value into field annotated @Nonnull
Read of unwritten field
Read of unwritten public or protected field
Nullcheck of value previously dereferenced
toString method may return null
Coverity

v7.5

 


FORWARD_NULL
NULL_RETURNS
REVERSE_INULL
FB.BC_NULL_INSTANCEOF
FB.NP_ALWAYS_NULL
FB.NP_ALWAYS_NULL_EXCEPTION
FB.NP_ARGUMENT_MIGHT_BE_NULL
FB.NP_BOOLEAN_RETURN_NULL
FB.NP_CLONE_COULD_RETURN_NULL
FB.NP_CLOSING_NULL
FB.NP_DEREFERENCE_OF_ READLINE_VALUE
FB.NP_DOES_NOT_HANDLE_NULL
FB.NP_EQUALS_SHOULD_HANDLE_ NULL_ARGUMENT
FB.NP_FIELD_NOT_INITIALIZED_ IN_CONSTRUCTOR
FB.NP_GUARANTEED_DEREF
FB.NP_GUARANTEED_DEREF_ON_ EXCEPTION_PATH
FB.NP_IMMEDIATE_DEREFERENCE_ OF_READLINE
FB.NP_LOAD_OF_KNOWN_NULL_ VALUE
FB.NP_NONNULL_FIELD_NOT_ INITIALIZED_IN_CONSTRUCTOR
FB.NP_NONNULL_PARAM_VIOLATION
FB.NP_NONNULL_RETURN_VIOLATION
FB.NP_NULL_INSTANCEOF
FB.NP_NULL_ON_SOME_PATH
FB.NP_NULL_ON_SOME_PATH_ EXCEPTION
FB.NP_NULL_ON_SOME_PATH_ FROM_RETURN_VALUE
FB.NP_NULL_ON_SOME_PATH_ MIGHT_BE_INFEASIBLE
FB.NP_NULL_PARAM_DEREF
FB.NP_NULL_PARAM_DEREF_ALL_ TARGETS_DANGEROUS
FB.NP_NULL_PARAM_DEREF_ NONVIRTUAL
FB.NP_PARAMETER_MUST_BE_NON - NULL_BUT_MARKED_AS_NULLABLE
FB.NP_STORE_INTO_NONNULL_FIELD
FB.NP_TOSTRING_COULD_ RETURN_NULL
FB.NP_UNWRITTEN_FIELD
FB.NP_UNWRITTEN_PUBLIC_OR_ PROTECTED_FIELD
FB.RCN_REDUNDANT_COMPARISON_ OF_NULL_AND_NONNULL_VALUE
FB.RCN_REDUNDANT_COMPARISON_ TWO_NULL_VALUES
FB.RCN_REDUNDANT_NULLCHECK_ OF_NONNULL_VALUE
FB.RCN_REDUNDANT_NULLCHECK_ OF_NULL_VALUE
FB.RCN_REDUNDANT_NULLCHECK_ WOULD_HAVE_BEEN_A_NPE

Implemented
Fortify
Include Page
Fortify_V
Fortify_V

Missing_Check_against_Null
Null_Dereference
Redundant_Null_Check

Implemented
Findbugs
Include Page
Findbugs_V
Findbugs_V

NP_DEREFERENCE_OF_READLINE_VALUE
NP_NULL_PARAM_DEREF
NP_TOSTRING_COULD_RETURN_NULL

Implemented
Parasoft Jtest
Include Page
java:
Parasoft_V
java:
Parasoft_V
BD.EXCEPT.NP, PB-RE-NMCD
 

SonarQube
Java Plugin
Include Page
SonarQube
Java Plugin
_V
SonarQube
Java Plugin
_V

S2259
S2225
S2447
S2637

 
Null pointers should not be dereferenced
"toString()" and "clone()" methods should not return null
Null should not be returned from a "Boolean" method
"@NonNull" values should not be set to null

Related Vulnerabilities

Java Web Start applications and applets particular to JDK version 1.6, prior to update 4, were affected by a bug that had some noteworthy security consequences. In some isolated cases, the application or applet's attempt to establish an HTTPS connection with a server generated a NullPointerException [SDN 2008]. The resulting failure to establish a secure HTTPS connection with the server caused a denial of service. Clients were temporarily forced to use an insecure HTTP channel for data exchange.

Related Guidelines

Android Implementation Details

Android applications are more sensitive to NullPointerException because of the constraint of the limited mobile device memory. Static members or members of an Activity may become null when memory runs out.

Bibliography

 


...