Arithmetic operation with NULL pointer

Arithmetic operation performed on NULL pointer

Description

This defect occurs when an arithmetic operation involves a pointer whose value is NULL.

Risk

Performing pointer arithmetic on a null pointer and dereferencing the resulting pointer is undefined behavior. In most implementations, the dereference can cause your program to crash.

Fix

Check a pointer for NULL before arithmetic operations on the pointer.

If the issue occurs despite an earlier check for NULL, look for intermediate events between the check and the subsequent dereference. Often the result details (or source code tooltips in Polyspace^® as You Code™) show a sequence of events that led to the defect. You can implement the fix on any event in the sequence. If the result details do not show this event history, you can search for previous references of variables relevant to the defect using right-click options in the source code and find related events. See also Interpret Polyspace Bug Finder Results in Polyspace Platform User Interface or Interpret Bug Finder Results in Polyspace Access Web Interface (Polyspace Access).

See examples of fixes below.

Examples

Arithmetic Operation with NULL Pointer Error

#include<stdlib.h>

int Check_Next_Value(int *loc, int val) 
 {
  int *ptr = loc, found = 0; 
  
  if (ptr==NULL)
   { 
      ptr++; 
      /* Defect: NULL pointer shifted */

      if (*ptr==val) found=1;
   } 
   
  return(found);    
 }

When ptr is a NULL pointer, the code enters the if statement body. Therefore, a NULL pointer is shifted in the statement ptr++.

Correction — Avoid NULL Pointer Arithmetic

One possible correction is to perform the arithmetic operation when ptr is not NULL.

#include<stdlib.h>

int Check_Next_Value(int *loc, int val) 
 {
  int *ptr = loc, found = 0; 
  
  /* Fix: Perform operation when ptr is not NULL */
  if (ptr!=NULL)
   { 
      ptr++;

      if (*ptr==val) found=1;
   }
   
  return(found);    
 }

Result Information

Group: Static memory

Language: C | C++

Default: Off

Command-Line Syntax: NULL_PTR_ARITH

Impact: Low

PQL Name: std.defects.NULL_PTR_ARITH

Version History

Introduced in R2013b

R2023a: Defect not reported if pointer is NULL only in error states

Starting in R2023a, Polyspace no longer reports this defect if you dereference pointers that can be NULL only in certain error states. For instance:

struct A {
    int i;
    int j;
};


int *foo(struct A* a) {

    if (a == NULL) {
        return 0;
    }
    return &(a->j);
}


void bar(struct A* b) {
    int * x = foo(b);
    *x = 0; //Not a defect
}

Here, the pointer *x can be NULL if the input a is NULL. The error state (a==NULL) might be checked and remedied elsewhere. Starting in R2023a, Polyspace does not flag dereferencing *x or arithmetic operations on *x.