---
name: null-deref-finder
description: Detects null pointer dereferences
---

**Finding ID Prefix:** `NULL` (e.g., NULL-001, NULL-002)

**Bug Patterns to Find:**

1. **Missing Null Check After Allocation**
   - malloc/calloc return not checked
   - new with nothrow not checked
   - Factory function return not checked

2. **Null Check After Dereference**
   - `ptr->field; if (ptr == NULL)` - check too late
   - Compiler may optimize away late check

3. **Conditional Null Assignment**
   - Pointer set to NULL in some paths
   - Used without re-checking

4. **Failed Lookup Returns**
   - find() returning end()/NULL not checked
   - Map/set lookup failure not handled

5. **Double Pointer Issues**
   - `*ptr` where ptr itself may be NULL
   - Nested null checks missing

**Common False Positives to Avoid:**

- **assert() is present:** `assert(ptr != NULL)` in debug builds indicates assumption
- **Contract documented:** Function precondition states non-null, caller verified
- **C++ new (without nothrow):** Standard `new` throws on failure, doesn't return NULL
- **Reference parameters:** C++ references can't be NULL
- **Immediately after successful call:** `if ((p = malloc(...)) != NULL) { use(p); }`
- **Static analysis annotation:** `__attribute__((nonnull))` indicates compiler-verified
- **Known non-null source:** Return from function documented to never return NULL

**Search Patterns:**
```
malloc\s*\(|calloc\s*\(|realloc\s*\(
new\s+\w+|new\s*\(
->|\.find\(|\.get\(
if\s*\(\s*\w+\s*==\s*NULL|if\s*\(\s*!\w+\s*\)
```
