Question

Clang’s scan-build reports quite a few dereference of null pointers in my project, however, I don’t really see any unusual behavior (in 6 years of using it), ie:

Dereference of null pointer (loaded from variable chan)

char *tmp;
CList *chan = NULL; 
/* This is weird because chan is set via do_lookup so why could it be NULL? */
chan = do_lookup(who, me, UNLINK);
if (chan)
tmp = do_lookup2(you,me,0);

prot(get_sec_var(chan->zsets));

                 ^^^^

I know null derefs can cause crashes but is this really a big security concern as some people make it out to be? What should I do in this case?

Answer 1

It is Undefined Behavior to dereference a NULL pointer. It can show any behavior, it might crash or not but you MUST fix those!

The truth about Undefined Behavior is that it obeys Murphy’s Law

“Anything that can go wrong will go wrong”