CWE-690 Unchecked Return Value to NULL Pointer Dereference

The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.

• Availability: DoS: Crash, Exit, or Restart • Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands, Read Memory, Modify Memory — In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.

• Black Box: This typically occurs in rarely-triggered error conditions, reducing the chances of detection during black box testing. • White Box: Code analysis can require knowledge of API behaviors for library functions that might return NULL, reducing the chances of detection when unknown libraries are used. • Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].

• CVE-2008-1052: Large Content-Length value leads to NULL pointer dereference when malloc fails. • CVE-2006-6227: Large message length field leads to NULL pointer dereference when malloc fails. • CVE-2006-2555: Parsing routine encounters NULL dereference when input is missing a colon separator. • CVE-2003-1054: URI parsing API sets argument to NULL when a parsing failure occurs, such as when the Referer header is missing a hostname, leading to NULL dereference. • CVE-2008-5183: Chain: unchecked return value can lead to NULL dereference