What Is Doug Guller Doing Now, Where Does Kyle Gifford Live Now, Supernatural Convention 2022 Uk, Kathy Bieber Age, Articles N

Redundant Check For Null Check the JavaDoc for the method Performs a lookup operation on a Raster. When you assign the value of 10 on the second line, your value of 10 is written into the memory location referred to by x. . Closed. Null dereference is a commonly occurring defect in Java programs, and many static-analysis tools identify such defects. The suggested remedy to this problem is to use a whitelist of trusted directories as valid inputs; and, reject everything else. The following function attempts to acquire a lock in order to perform . Note that on Red Hat Enterprise Linux 6 it is not possible to exploit CVE-2010-2948 to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE. By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. Follows a very simple code sample that should reproduce the issue: public override bool Equals (object obj) { var typedObj = obj as SomeCustomClass; if (typedObj == null) return false; return this.Name == typedObj.Name; } In this simple excerpt Fortify complains that "typedObj" can be null in the return statement. For Benchmark, we've seen it report it both ways. Provide an answer or move on to the next question. Private personal information may include a password, phone number, geographic location, personal messages, credit card number, etc. We can fix this issue just by replacing the .equals() method with== so lets implement == symbol and try to compile our code. It only takes a minute to sign up. $ c:/jdk8/bin/javac -cp lib/commons-lang3-3.7.jar -d build NPE.java$ java -cp 'lib/commons-lang3-3.7.jar;build' npe.NPE fooarg is foodangerousLength is 3protected length is 3StringUtils protected length is 3(as much dangerous) length is 3StringUtils protected (no thanks to Fortify tracking) length is 3Called a method of an object returned by a method: 1OS Windows 7 is supportedOS Windows 7 is supported$ sourceanalyzer -scan -cp lib/commons-lang3-3.7.jar NPE.java[error]: Your license does not allow access to Fortify SCA for Pythoncom.fortify.licensing.UnlicensedCapabilityException: Your license does not allow access to Fortify SCA for Python at com.fortify.licensing.Licensing.getCapabilityConfig(Licensing.java:120) ~[fortify-common-18.20.0.1071.jar:?] Should Fortify be handling this correctly by default(and we have something misconfigured)? 2007 JavaOneSM Conference 4 | Session TS-2007 | . Midwest Athletics Cheer, Travel safe this upcoming week. Searching it online showed only a match in a SonarQube plugin that may be reusing the GUID by mistake. The most common quality bug identified was the null pointer dereference, which can cause . It is important to remember here to return the literal and not the char being checked. However, it is unclear if the benefits are universal in nature. By using this site, you accept the Terms of Use and Rules of Participation. Dereferencing a null pointer An impossible checked cast . Should you wish to do so, please emailFortifyTechSupport@hpe.com and reference support case#00278285 opened on Oct 10. The opinions expressed above are the personal opinions of the authors, not of Micro Focus. An attack signature is a unique arrangement of information that can be used to identify an attacker's attempt to exploit a known operating system or application vulnerability. Private information is important to consider whether the person is a user of the product, or part of a data set that is processed by the product. It essentially means that the object's reference variable is not pointing anywhere and refers to nothing or 'null'. The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. Jk Robbins wrote:The FindBugs tool is telling me that line 5 contains a null pointer dereference to the id variable but I don't see the problem. privacy statement. If not is there an option we can set so that it does? Copyright 2023 Open Text Corporation. We revisit previous work on XYLEM, an interprocedural null dereference analysis for Java, and discuss the challenge of comparing the results of different static analysis tools. Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract The program can potentially dereference a null-pointer, thereby raising a NullPointerException. PS: Yes, Fortify should know that these properties are secure. : Fortify: The method processMessage() in VET360InboundProcessService.java can crash the program by dereferencing a null pointer on line 197. a NULL pointer dereference would then occur in the call to strcpy(). Fix : Analysis found that this is a false positive result; no code changes are required. 10 Avoiding Attempt to Dereference Null Object Errors 4,029 views Oct 22, 2014 In this episode we look at 3 common ways to get - and then prevent - the "Attempt to dereference a null object". So mark them as Not an issue and move on. Jk Robbins wrote:Thanks, you are correct, I meant line 9 and I see the error now. Ventura CA 93001 This does pass the Fortify review. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. Main.java, lines 120-137: Description: SQL injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct a SQL query. A null-pointer dereference takes place when a pointer with a value of NULL is used as though it pointed to a valid memory area. Below is an example. Then by the end of this article, you will get complete knowledge about the error and able to solve your issue, lets start with an example. The program can potentially dereference a null-pointer, thereby raising a NullPointerException. A fully runnable web app written in Java, it supports analysis by Static (SAST), Dynamic (DAST), and Runtime (IAST) tools that support Java. Have a question about this project? They should be investigated and fixed OR suppressed as not a bug. So mark them as Not an issue and move on. Because your release of resources is conditional on the state of a boolean variable and encased in another try block, the static analyzer must be deciding that rollback() and close() are not guaranteed to execute.. . Initializes a new instance of the NullReferenceException class, setting the Message property of the new instance to a system-supplied message that describes the error, such as "The value 'null' was found where an instance of an object was required." This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL), if (conection.State != ConnectionState.Closed) { conection.Close(); }, This Do new devs get fired if they can't solve a certain bug? Could anyone from Fortify confirm or refute the flakiness of the null dereference check? cmheazel on Jan 7, 2018. cmheazel added the Status:Pull-Request-Issued label on Jan 9, 2018. cmheazel mentioned this issue on Feb 22, 2018. Team Collaboration and Endpoint Management. Fix: Modified rules and code to no longer dereference a null pointer. Noncompliant Code Example. Fortify source code analyzer is giving lot's of "Null Dereference" issues becausewe have used Apache Utils to ensure null check. . NPD vulnerability can be exploited by hackers to maliciously crash a process to cause a denial of service or execute an arbitrary code under specific conditions. Fortify flags this for null dereference. String fileString = new String(byteArr); String fileSHA256Hex = DigestUtils.sha256Hex(fileString); // use fileSHA256Hex to validate file. This failure seems a result of the Control Flow rules 65 // covering only simple patterns within methods: 66 // allocated -> set 67 // allocated -> checked 68 // allocated -> used 69 // as in the sample rule 70 // riches/scan/Scenario Rules/Null Pointer Check/scenarioRules.xml" 71 log("dangerousLength is " dangerousLength(arg)); 72 log("protected length is " defaultIfEmpty(arg, "").length()); 73 log("StringUtils protected length is " StringUtils.defaultIfEmpty(arg, "").length()); 74 75 // Fortify catches a possible NPE in using a formerly assigned null, 76 // showing a Null Dereference finding. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. I do not know why and how the Data Flow syntax differs from the Control Flow one. dstenger closed this as completed in #302 on Feb 22, 2018. dstenger added this to the 5.2 milestone on Feb 22, 2018. Null dereference is a common type of runtime failure in Java programs, and it is necessary to verify whether a dereference in the program is safe. Extended Description NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions. rev2023.3.3.43278. Notice how that can never be possible since the method returns early with a 'false' value on the previous 'if' statement. i know which session objects are NULL when the page loads and so i am checking it that if its null . Thanks for contributing an answer to Information Security Stack Exchange! The purpose of this Release Notes document is to announce the release of the ES 5.14. . In this episode we look at 3 common ways to get - and then prevent - the "Attempt to dereference a null object" apex error**Our new course Astronomical Apex . Team Collaboration and Endpoint Management. Making statements based on opinion; back them up with references or personal experience. Dereference before null check. operator is the logical negation operator. It could be either removed or replaced. Bangkok Bank Branch Code List, Closed; is cloned by. I need to read the properties file kept in user home folder. "Leadership is nature's way of removing morons from the productive flow" - Dogbert Articles by Winston can be found here. CVE-2009-3620. Our current plan is to remain open for https://t.co/IwbQgYoZUk, Nov 01, We love seeing this enthusiasm for structural pasteurization from realtors https://t.co/ihCVF4uUk3 https://t.co/3uMUV1VabD, Jul 28. Coppin State University Honors Program, spelling and grammar. When we dereference a pointer, then the value of the . Teams. #icon876:hover{color:;background:;} info@thermapure.com, Wishing everyone a peaceful and green holiday from here in Ventura! But it seems that fortify is not considering these checks as a valid null check. CONNECT Software project. email is in use. Exceptions. This message takes into account the current system culture. The repro was confirmed by the support representative and the case forwarded to the engineering team. In this paper we discuss some of the challenges of using a null dereference CODETOOLS-7900082 Fortify: Analize and fix "Missing Check against Null" issue CODETOOLS-7900081 Fortify: Analize and fix "Null Dereference" issues CODETOOLS-7900080 Fortify: Analize and fix "Log Forging" issues CODETOOLS-7900079 Fortify: Analize and fix "Code Correctness: Regular Expressions Denial of Service" issues CVE-2010-2949 A NULL pointer dereference flaw was found in the way the Quagga bgpd We would like to show you a description here but the site wont allow us. Explanation Just about every serious attack on a software system begins with the violation of a programmer's assumptions. . Exceptions. Fortify: Access Control Database related issue. We have these rule packs installed that seem to be relevant to the .Net, Name: Fortify Secure Coding Rules, Core, .NETVersion: 2017.3.0.0008ID: D57210E5-E762-4112-97DD-019E61D32D0ESKU: RUL13002, Version: 2017.3.0.0008ID: 557BCC56-CD42-43A7-B4FE-CDD00D58577ESKU: RUL13027Provides coverage of security relevant APIs in various extended and third-party .NET libraries including Log4Net(TM) and the Microsoft EnterpriseLibrary(TM). If I had to guess, the tool you're using is complaining about our use of Math.random() but we don't rely on it being cryptographically secure. The line where the issue is found contains only the Main method declaration, and no other debug code is present. How Intuit democratizes AI development across teams through reusability. CODETOOLS-7900080 Fortify: Analize and fix "Log Forging" issues. Coverity does not list their price publicly. In the most recent project scanned, only 1 of 24 Null Dereference issues found was legitamite. There are too few details in this report for us to be able to work on it. For instance, what's wrong with this code? Perhaps it is possible to write a custom Control Flow rule that will track previously null pointers across passing to method calls and assignments? Null Dereference C/C++ C#/VB.NET/ASP.NET Java/JSP Abstract clones. Assuming the size of the file is less than BUFSIZE, this works fine as long as the information in myFile is encoded the same as the default character set, however if it's using a different encoding, or is a binary file, it . Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. To subscribe to this RSS feed, copy and paste this URL into your RSS reader. Fix Suggenstion 11Null Dereference. Liberalism Used In A Sentence, Try this: Copy Code if (connection != null && conection.State != ConnectionState.Closed) { conection.Close (); } But better, use a using block around your connection creation so it is automatically closed and disposed when it goes out of scope. Connect and share knowledge within a single location that is structured and easy to search. (Generated from version 2022.4.0.0009 of the Fortify Secure Coding Rulepacks), Fortify Taxonomy: Software Security Errors. Learn more about Stack Overflow the company, and our products. Site design / logo 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. 1. at com.fortify.sca.Main$Sourceanalyzer.run(Main.java:527) [fortify-sca-18.20.1071.jar:? Thus, enabling the attacker do delete files or otherwise compromise your system. All rights reserved. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others. if (foo == null) { foo.setBar (val); . } Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Chain: race condition might allow resource to be released before operating on it, leading to NULL dereference. When it comes to these specific properties, you're safe. Now, let us move to the solution for this error, How to Fix "int cannot be dereferenced" error? at com.fortify.sca.frontend.Python3FrontEnd.runTranslator(Python3FrontEnd.java:158) [fortify-sca-18.20.1071.jar:?] It is not uncommon for Java programmers to misunderstand read() and related methods that are part of many java.io classes. You signed in with another tab or window. So, I suggest an alternative solution. However, its // behavior isn't consistent. #icon876{font-size:;background:;padding:;border-radius:;color:;} Sign in Accessing or modifying a null objects field. All rights reserved. The Java VM sets them so, as long as Java isn't corrupted, you're safe. : System.getProperty may return NULL NPE.java(98) : allocated -> allocated : os may be null NPE.java(101) : allocated -> used : os.equalsIgnoreCase() : os used without null check[A423998C51F661CE8B2EB269BB0AF58D : low : Poor Logging Practice : Use of a System Output Stream : structural ] NPE.java(43)[5494E2A573D3F6F3F5F24DE49D893068 : low : J2EE Bad Practices : Leftover Debug Code : structural ] NPE.java(56)$ cat -n NPE.java 1 package npe; 2 3 import org.apache.commons.lang3.StringUtils; 4 5 public class NPE { 6 int v; 7 8 9 public NPE(int v) { 10 this.v = v; 11 } 12 13 14 public static int dangerousLength(String s) { 15 return s.length(); 16 } 17 18 19 public String stringify() { 20 if (v != 0) { 21 return "non-0"; 22 } else { 23 return null; 24 } 25 } 26 27 28 public NPE frugalCopy() { 29 if (v != 0) { 30 return new NPE(v); 31 } else { 32 return null; 33 } 34 } 35 36 37 public int getV() { 38 return v; 39 } 40 41 42 public static void log(String s) { 43 System.out.println(s); 44 } 45 46 47 public static String defaultIfEmpty(String s, String v) { 48 if (s == null || s.length() == 0) { 49 return v; 50 } else { 51 return s; 52 } 53 } 54 55 56 public static void main(String[] args) { 57 String arg = null; 58 if (args.length > 0) { 59 arg = args[0]; 60 } 61 log("arg is " arg); 62 63 // Fortify fails to catch a possible NPE when the null is passed as an 64 // argument. "Security problems caused by dereferencing null . Calling equals() method on the int primitive, we encounter this error usually when we try to use the .equals() method instead of == to check the equality. Scala 2.11.6 or newer. Learn more . Agreed!!! #thanksgiving #travelsafe https://t.co/0ZP6bs2vmf, Nov 22, We hope everyone is staying safe during these Southern California Wildfires. -Wnull-dereference. How to address a NULL pointer dereference. How to add an element to an Array in Java? pass = getPassword (); jadejaan over 5 years ago I am trying to validate SMTP header so that fortify can identified it as a fix. An extremely nice thing which was discovered only by Coverity. if (ptr == null) {ptr->field = val;.} When you have a variable of non-primitive type, it is a reference to an object. On File delete, using java File delete method what could be the security issue? The program can potentially dereference a null-pointer, thereby causing a segmentation fault. In Java, a special null value can be assigned to an object reference. How to Fix int cannot be dereferenced error? These can be: Invoking a method from a null object. Fortify is giving path manipulation error in this line. If a question is poorly phrased then either ask for clarification, ignore it, or. Issue Links clones CODETOOLS-7900081 Fortify: Analize and fix "Null Dereference" issues Closed relates to CODETOOLS-7900046 Complete Fortify code updates Closed Activity All Comments Work Log History Activity If not, leave it as null. Check the documentation for the Connection object of the type returned by the getConnection() factory method, and see if the methods rollback() and close() will even throw an exception. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The program can dereference a null-pointer because it does not check the return value of a function that might return null. Null-pointer errors are usually the result of one or more programmer assumptions being violated. to fix over 7500 defects across 250 open source projects and 50 million lines of code. For an attacker it provides an opportunity to stress the system in unexpected ways. This option is only active when -fdelete-null-pointer-checks is active, which is enabled by optimizations in most targets. We are struggling with a large number of false positives from our scans and hoping for some it is a matter of configuration. Well, it identifies hundreds of known code vulnerabilities, covers security standard and also make sure to address industry compliance regulations. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners. In Dungeon World, is the Bard's Arcane Art subject to the same failure outcomes as other spells? We also report experimental results for XYLEM, Coverity Prevent, Fortify SCA, Eclipse and FindBugs, and observe of Computer Science University of Maryland College Park, MD pugh@cs.umd.edu Abstract Many analysis techniques have been proposed to determine when a potentially null value may be You won't find it anywhere in any official Java documents. Asking for help, clarification, or responding to other answers. +1 (416) 849-8900. If you have encountered it a lot, that just means it is a popular misconception . Fortify: Null Dereference (1 issue . Also I failed to reproduce the case. I thinkFortify should be handling this correctly, and we have not found an option that fixes this. Description The program can potentially dereference a null pointer, thereby raising a NullPointerException. Does it just mean failing to correctly check if a value is null? I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. But we have observed in practice that not every potential null dereference is a "bug " that developers want to fix. But we have observed in practice that not every potential null dereference is a "bug" that developers want to fix. How to fix null dereference in C#. Note that this code is also vulnerable to a buffer overflow . That's why it's perfectly OK to assign null to variables or pass null into a method. . current ranch time (not your local time) is, dynamic table creation problem calling onchange, Need to Hide Table inside div:Code is Working Fine in FireFox but Not in IE..Please Help. Difference Between FileInputStream and FileReader in Java, Introduction about the error with example. 2.1. Null Dereference (Code Quality, Control Flow): The method ThroughDate() in Program.cs can dereference a null pointer, thereby raising a NullException. 109 String os2 = defaultIfEmpty(System.getProperty("os.name"), null); 110 if (os2.equalsIgnoreCase("Windows 95")) { 111 log("OS " os2 " is not supported"); 112 } else { 113 log("OS " os2 " is supported"); 114 } 115 } 116 }. Thanks for contributing an answer to Stack Overflow! The main theme of Dereferencing is placing the memory address into the reference. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Well occasionally send you account related emails. The content must be between 30 and 50000 characters. Java/JSP Abstract The program can dereference a null-pointer because it does not check the return value of a function that might return null. Now, let us move to the solution for this error. From a user's perspective that often manifests itself as poor usability. How can I reduce false positives and maintain the rule? 2.1.1Null Dereference. One of the more common false positives is is a Null Dereference when the access is guarded by the, Name: Fortify Secure Coding Rules, Core, .NET, Network Operations Management (NNM and Network Automation). Neuropsychologist Salary Us, So "dereferencing a null pointer" means trying to do something to the object that it's pointing to. The Null dereference error was on the line of code sortName = lastName; not the call of the setter : fortify do not want you to conditionnally change the value of a variable that was set to null without doing so in all the branches. #icon5632{font-size:;background:;padding:;border-radius:;color:;} I'm using "HP Fortify v3.50" on a java project and I find lots of false positive on "Null Dereference", because Fortify doesn't see the control against null is in another method. null dereference fortify fix javameat carving knife blank. . If you get an exception, don't catch it and return null, instead wrap and rethrow the exception. JavaDereference before null check . The precision of the warnings depends on the optimization options used. The text was updated successfully, but these errors were encountered: Code modified to fix all identified instances. Real Estate Software Dubai > blog > how to fix null dereference in java fortify Jun 12, 2022 beauty appeal in advertising It serves as a common language, a measuring stick for security tools, and as a baseline for weakness identification, mitigation, and prevention efforts. Redundant Null Check. */ } What I am trying to do is initialize ApplicanteeTO object with null, then check if it is under certain population type, populate it. EXP01-J-EX0: A method may dereference an object-typed parameter without guarantee that it is a valid object reference provided that the method documents that it (potentially) throws a NullPointerException, either via the throws clause of the method or in the method comments. I believe this particular behavior is a gap in the Fortify analyzer implementation, as all other static analysis tools seem to understand the code flow and will not complain about potential null references in this case. To learn more, see our tips on writing great answers. However, Fortify is throwing me this warning in the report: The method initForm() in SingleReplacementController.java can crash the program by dereferencing a null-pointer on line 110. a NULL pointer dereference would then occur in the call to strcpy(). Example 1: In the following code, the programmer confirms that the variable foo is null and subsequently dereferences it erroneously. For example, In the ClassWriter class, a call is made to the set method of an Item object. Could you share the minimal test case? Fix Suggenstion null null Null 12NULL_RETURNS. I have a solution to the Fortify Path Manipulation issues. Note: Before moving to this, to fix the issue in Example 1 we can print, This means sum.something() is an INVALID Syntax in Java. But we have observed in practice that not every potential null dereference is a "bug " that developers want to fix. Even if you were to add input filtering, the odds are low that Fortify were to recognize it and stop producing the issue. Dereference before null check (REVERSE_INULL) There may be a null pointer exception, or else the . Do you need your, CodeProject, It would probably help prioritizing a fix if you could attach your repro code. I have problem to understand how is that solving original issue - path in configuration file How to resolve Path Manipulation error given by fortify? 2Null Dereference 2.1 null null dereference-after-store . Take the following code: Integer num; num = new Integer(10); . Already on GitHub? It has no particular knowledge of 83 // the Apache Commons null-checking method. Chain: The return value of a function returning a pointer is not checked for success ( CWE-252) resulting in the later use of an uninitialized variable ( CWE-456) and a null pointer dereference ( CWE-476) CVE-2007-3798. (Generated from version 2022.1.0.0007 of the Fortify Secure Coding Rulepacks) Exceptions. 77 log("(as much dangerous) length is " arg.length()); 78 79 arg = StringUtils.defaultIfEmpty(arg, ""); 80 // Fortify stays properly mum below. For an attacker it provides an opportunity to stress the system in unexpected ways. CWE-476: NULL Pointer Dereference: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. . We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. 1 solution Solution 1 Nothing. By using our site, you NullPointerException is thrown when program attempts to use an object reference that has the null value. The unary prefix ! In particular, the ability to write custom rules to handle internal null check functions has been added. Is Made In Chelsea Scripted, of Computer Science University of Maryland College Park, MD ayewah@cs.umd.edu William Pugh Dept. . Example. #icon8226:hover{color:;background:;} 800-366-2022 The program can dereference a null-pointer because it does not check the return value of a function that might return null. Why is this sentence from The Great Gatsby grammatical? int count = fis.read(byteArr);. It's simply a check to make sure the variable is not null. Jira will be down for Maintenance on June 6,2022 from 9.00 AM - 2.PM PT, Monday(4.00 PM - 9.00PM UTC, Monday) +1 for a very succinct answer that pretty much sums up the way I feel: "it depends." 2 Answers Sorted by: 4 Fortify is raising an issue, not an error because you are taken input from the process's environment and then opening a path with it without doing any input filtering. In this example, the variable x is an int and Java will initialize it to 0 for you. Request PDF | Tracking Null Checks in Open-Source Java Systems | It is widely acknowledged that null values should be avoided if possible or carefully used when necessary in Java code. Free source code and tutorials for Software developers and Architects. Custom Component : Missing Update Model Phase? But what exactly does it mean to "dereference a null pointer"? #channelislandsharbor #oxnard @ C https://t.co/ns1WvY7xHh, Nov 29, Happy Thanksgiving from all of us at ThermaPure! Network Operations Management (NNM and Network Automation). #icon5632:hover{color:;background:;} 180 Canada Larga Rd. I've been searching for an explanation of this message and can't find anything that clearly explains it. To actually scan translated code for vulnerabilities, you must either: be a licensed Fortify SCA user. As a matter of fact, any miss in dealing with null cannot be identified at compile time and results in a NullPointerException at runtime. CiteSeerX - Document Details (Isaac Councill, Lee Giles, Pradeep Teregowda): Many analysis techniques have been proposed to determine when a potentially null value may be dereferenced.