1135
}
If an attacker provides an address that appears to be well-formed, but the address does not resolve
to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the
return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then
occur in the call to strcpy().
Note that this code is also vulnerable to a buffer overflow (CWE-119).
Example 3:
In the following code, the programmer assumes that the system always has a property named
"cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined,
the program throws a NULL pointer exception when it attempts to call the trim() method.
Example Language: Java (Bad)
String cmd = System.getProperty("cmd");
cmd = cmd.trim();
Example 4:
This Android application has registered to handle a URL when sent an intent:
Example Language: Java (Bad)
...
IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
...
public class UrlHandlerReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
if("com.example.URLHandler.openURL".equals(intent.getAction())) {
String URL = intent.getStringExtra("URLToOpen");
int length = URL.length();
...
}
}
}
The application assumes the URL will always be included in the intent. When the URL is not
present, the call to getStringExtra() will return null, thus causing a null pointer exception when
length() is called.
Example 5:
Consider the following example of a typical client server exchange. The HandleRequest function
is intended to perform a request and use a defer to close the connection whenever the function
returns.
Example Language: Go (Bad)
func HandleRequest(client http.Client, request *http.Request) (*http.Response, error) {
response, err := client.Do(request)
defer response.Body.Close()
if err != nil {
return nil, err
}
...
}
CWE Version 4.14
CWE-476: NULL Pointer Dereference
CWE-476: NULL Pointer Dereference