Null Pointer Dereference Detection
Detection Workflow
- Identify pointer dereferences: Find all pointer dereferences (*ptr, ptr->field), array accesses (ptr[index]), function calls with pointer parameters, pointer operations
- Trace pointer sources: Use
xrefs_to to trace pointers, find where pointers originate, identify pointer assignments, track pointer values
- Check null validation: Verify null checks before dereference, assess check completeness, identify missing validation paths, check validation logic correctness
- Assess impact: Can attacker control pointer value? Is dereference reachable? What's the crash potential? Can it lead to security issues?
Key Patterns
- Missing null checks: pointer dereference without null check, function calls with unchecked pointers, array access through null pointers, member access through null pointers
- Conditional dereference: dereference after partial null check, dereference in only some code paths, dereference after pointer assignment, dereference in loop conditions
- Function parameter issues: unchecked function parameters, assumptions about non-null parameters, missing validation in public APIs, null pointers from external sources
- Return value issues: dereferencing potentially null return values, assuming malloc/new never returns null, missing checks on function returns, dereferencing failed allocations
Output Format
Report with: id, type, subtype, severity, confidence, location, dereferenced_pointer, dereference_type, dereference_operation, pointer_source, null_check, vulnerability, exploitable, attack_scenario, impact, mitigation.
Severity Guidelines
- HIGH: Null dereference in critical code paths
- MEDIUM: Null dereference causing crashes
- LOW: Null dereference with limited impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-null-pointer-dereference3description: Detects null pointer dereference vulnerabilities by identifying unchecked pointer usage and missing validation. Use when analyzing pointer operations, input validation, or investigating crash vulnerabilities.4---5
6# Null Pointer Dereference Detection
7
8## Detection Workflow
9
101. **Identify pointer dereferences**: Find all pointer dereferences (*ptr, ptr->field), array accesses (ptr[index]), function calls with pointer parameters, pointer operations
112. **Trace pointer sources**: Use `xrefs_to` to trace pointers, find where pointers originate, identify pointer assignments, track pointer values
123. **Check null validation**: Verify null checks before dereference, assess check completeness, identify missing validation paths, check validation logic correctness
134. **Assess impact**: Can attacker control pointer value? Is dereference reachable? What's the crash potential? Can it lead to security issues?
14
15## Key Patterns
16
17- Missing null checks: pointer dereference without null check, function calls with unchecked pointers, array access through null pointers, member access through null pointers
18- Conditional dereference: dereference after partial null check, dereference in only some code paths, dereference after pointer assignment, dereference in loop conditions
19- Function parameter issues: unchecked function parameters, assumptions about non-null parameters, missing validation in public APIs, null pointers from external sources
20- Return value issues: dereferencing potentially null return values, assuming malloc/new never returns null, missing checks on function returns, dereferencing failed allocations
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, dereferenced_pointer, dereference_type, dereference_operation, pointer_source, null_check, vulnerability, exploitable, attack_scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Null dereference in critical code paths
29- **MEDIUM**: Null dereference causing crashes
30- **LOW**: Null dereference with limited impact
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
aibot88