CERT C++: EXP34-C

Do not dereference null pointers

Description

Rule Definition

Do not dereference null pointers.¹

Polyspace Implementation

The rule checker checks for Null pointer.

Extend Checker

A default Bug Finder analysis might not flag a Null pointer issue when the input values are unknown and only a subset of inputs cause the issue. To check for a Null pointer issue caused by specific system input values, run a stricter Bug Finder analysis. See Extend Bug Finder Checkers to Find Defects from Specific System Input Values.

Examples

Null pointer

Issue

Null pointer occurs when you use a pointer with a value of NULL as if it points to a valid memory location.

Risk

Dereferencing a null pointer is undefined behavior. In most implementations, the dereference can cause your program to crash.

Fix

Check a pointer for NULL before dereference.

If the issue occurs despite an earlier check for NULL, look for intermediate events between the check and the subsequent dereference. Often the result details show a sequence of events that led to the defect. You can implement the fix on any event in the sequence. If the result details do not show the event history, you can trace back using right-click options in the source code and see previous related events. See also Interpret Bug Finder Results in Polyspace Desktop User Interface.

See examples of fixes below.

Example - Null pointer error

#include <stdlib.h>

int FindMax(int *arr, int Size) 
{
 int* p=NULL;

 *p=arr[0];  //Noncompliant
 /* Defect: Null pointer dereference */

 for(int i=0;i<Size;i++)
  {
   if(arr[i] > (*p))
     *p=arr[i];    
  }

 return *p;
}

The pointer p is initialized with value of NULL. However, when the value arr[0] is written to *p, p is assumed to point to a valid memory location.

Correction — Assign Address to Null Pointer Before Dereference

One possible correction is to initialize p with a valid memory address before dereference.

#include <stdlib.h>

int FindMax(int *arr, int Size) 
{
 /* Fix: Assign address to null pointer */
 int* p=&arr[0];       

 for(int i=0;i<Size;i++)
  {
   if(arr[i] > (*p))
     *p=arr[i];    
  }

 return *p;
}

Check Information

Group: 02. Expressions (EXP)

Version History

Introduced in R2019a

R2023a: Violation not reported if dereferenced pointer is NULL only in error states

Polyspace^® no longer reports these defects if you dereference pointers that can be NULL only in certain error states. For instance:

struct A {
    int i;
    int j;
};


int *foo(struct A* a) {

    if (a == NULL) {
        return 0;
    }
    return &(a->j);
}


void bar(struct A* b) {
    int * x = foo(b);
    *x = 0; //Compliant
}

Here, the pointer *x can be NULL if the input a is NULL. The error state (a==NULL) might be checked and remedied elsewhere. Polyspace does not report a violation of this rule for dereferencing of *x or arithmetic operations on *x.