The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
While unchecked return value weaknesses are not limited to returns of NULL pointers (see the examples in CWE-252), functions often return NULL to indicate an error status. When this error condition is not checked, a NULL pointer dereference can occur.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2008-1052
Large Content-Length value leads to NULL pointer dereference when malloc fails.
CVE: CVE-2006-6227
Large message length field leads to NULL pointer dereference when malloc fails.
CVE: CVE-2006-2555
Parsing routine encounters NULL dereference when input is missing a colon separator.
CVE: CVE-2003-1054
URI parsing API sets argument to NULL when a parsing failure occurs, such as when the Referer header is missing a hostname, leading to NULL dereference.
CVE: CVE-2008-5183
chain: unchecked return value can lead to NULL dereference
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | A typical occurrence of this weakness occurs when an application includes user-controlled input to a malloc() call. The related code might be correct with respect to preventing buffer overflows, but if a large value is provided, the malloc() will fail due to insufficient memory. This problem also frequently occurs when a parsing routine expects that certain elements will always be present. If malformed input is provided, the parser might return NULL. For example, strtok() can return NULL. |
Intro: The code below makes a call to the getUserName() function but doesn't check the return value before dereferencing (which may cause a NullPointerException).
String username = getUserName(); if (username.equals(ADMIN_USER)) { ... }Intro: This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
Body: If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy().
void host_lookup(char *user_supplied_addr){ struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); /*routine that ensures user_supplied_addr is in the right format for conversion */ validate_addr_form(user_supplied_addr); addr = inet_addr(user_supplied_addr); hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET); strcpy(hostname, hp->h_name); }