Null Dereference not detected in C ? about cwe_checker HOT 2 CLOSED

The CWE-416 check works by checking whether a return value from a library function call (like malloc) was checked for being a Null pointer before it gets dereferenced. In particular, it only considers the return values of such calls as sources for Null pointers. Variables, that are explicitly set to Null, like in your example, are not checked (to prevent generating a large number of false positives) and such Null dereferences thus cannot be found by the check.

The Memory analysis of the cwe_checker also generates Null Pointer Dereference warnings, but only for variables explicitly set to Null. Unfortunately, it has a high false positive rate. It cannot detect your example for a different reason: Namely, it does not propagate any information from the function call to testDereference to its function body, so the information that the parameter to testDereference is a Null pointer does not reach the site where it is dereferenced.

While we could change the behavior of the Memory analysis to also emit a warning when testDereference is called with a Null pointer as parameter, I am reluctant to do so, because it would generate even more false positives and we currently have no easy solution for preventing that.

from cwe_checker.

Thank you for the feedback!

from cwe_checker.