|
|
|
|
CWE-690: Unchecked Return Value to NULL Pointer Dereference
| | Unchecked Return Value to NULL Pointer Dereference |
Definition in a New Window 
|
| Compound Element ID: 690 (Compound Element Base: Chain) | | Status: Draft |
 Description
Description Summary The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
Extended Description While unchecked return value weaknesses are not limited to returns of NULL pointers (see the examples in CWE-252), functions often return NULL to indicate an error status. When this error condition is not checked, a NULL pointer dereference can occur.
Common Consequences | Scope | Effect |
|---|
Availability | Technical Impact: DoS: crash / exit /
restart |
Detection Methods
Black Box This typically occurs in rarely-triggered error conditions, reducing
the chances of detection during black box testing. |
White Box Code analysis can require knowledge of API behaviors for library
functions that might return NULL, reducing the chances of detection when
unknown libraries are used. |
Demonstrative Examples Example 1 The code below makes a call to the getUserName() function but
doesn't check the return value before dereferencing (which may cause a
NullPointerException). (Bad Code) Example
Language: Java String username = getUserName(); if (username.equals(ADMIN_USER)) { } Example 2 This example takes an IP address from a user, verifies that it is
well formed and then looks up the hostname and copies it into a
buffer. (Bad Code) Example
Language: C void host_lookup(char *user_supplied_addr){
struct hostent *hp;
in_addr_t *addr;
char hostname[64];
in_addr_t inet_addr(const char *cp);
/*routine that ensures user_supplied_addr is in the right
format for conversion */
validate_addr_form(user_supplied_addr);
addr = inet_addr(user_supplied_addr);
hp = gethostbyaddr( addr, sizeof(struct in_addr),
AF_INET);
strcpy(hostname, hp->h_name);
} If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy(). Note that this example is also vulnerable to a buffer overflow (see CWE-119). Observed Examples | Reference | Description |
|---|
| CVE-2008-1052 | Large Content-Length value leads to NULL pointer
dereference when malloc fails. |
| CVE-2006-6227 | Large message length field leads to NULL pointer
dereference when malloc fails. |
| CVE-2006-2555 | Parsing routine encounters NULL dereference when
input is missing a colon separator. |
| CVE-2003-1054 | URI parsing API sets argument to NULL when a
parsing failure occurs, such as when the Referer header is missing a
hostname, leading to NULL dereference. |
| CVE-2008-5183 | chain: unchecked return value can lead to NULL
dereference |
Other Notes
|
A typical occurrence of this weakness occurs when an application includes
user-controlled input to a malloc() call. The related code might be correct
with respect to preventing buffer overflows, but if a large value is
provided, the malloc() will fail due to insufficient memory. This problem
also frequently occurs when a parsing routine expects that certain elements
will always be present. If malformed input is provided, the parser might
return NULL. For example, strtok() can return NULL.
|
Relationships Relevant Properties Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| CERT Java Secure Coding | ERR08-J | | Do not catch NullPointerException or any of its
ancestors |
| CERT C++ Secure Coding | MEM32-CPP | | Detect and handle memory allocation errors |
Content History | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Sean Eidemiller | Cigital | External | | added/updated demonstrative
examples | | 2008-07-01 | Eric Dalci | Cigital | External | | updated Time_of_Introduction | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Applicable_Platforms, Description,
Detection_Factors, Relationships, Other_Notes | | 2009-12-28 | CWE Content Team | MITRE | Internal | | updated Demonstrative_Examples | | 2010-09-27 | CWE Content Team | MITRE | Internal | | updated Observed_Examples | | 2011-06-01 | CWE Content Team | MITRE | Internal | | updated Common_Consequences, Relationships,
Taxonomy_Mappings | | 2011-09-13 | CWE Content Team | MITRE | Internal | | updated Relationships,
Taxonomy_Mappings |
|
