# Null Pointer Dereference

> Detects code that dereferences pointers or return values that could be NULL without validation, causing crashes or privilege escalation.

- Skill: `zakirkun/null-pointer-dereference` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/null-pointer-dereference`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/null-pointer-dereference/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/null-pointer-dereference

---


# Null Pointer Dereference

## Overview
Null pointer dereference occurs when code uses a pointer without checking whether it's NULL. This causes:
- **Crash/DoS**: SIGSEGV on Unix, access violation on Windows
- **Kernel privilege escalation**: NULL pointer dereference in kernel context can map page 0 and execute attacker code
- **Logic bypass**: Skipping NULL checks allows unexpected code paths

## Detection Strategy
- Return values of `malloc()`, `calloc()`, `realloc()` used without NULL check
- Results of `fopen()`, `popen()` dereferenced without NULL check
- Java objects returned from `getById()` or map lookups used without null check

## Remediation
Always check pointers for NULL before dereferencing.

**Vulnerable (C):**
```c
char *buf = malloc(256);
strcpy(buf, input); // buf might be NULL if malloc failed!
```

**Safe (C):**
```c
char *buf = malloc(256);
if (buf == NULL) { perror("malloc"); exit(1); }
strcpy(buf, input);
```