Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The result of `strtok` or `strtok_r` is used as an iterator in a `do-while` loop without a prior `NULL` check. If the input string consists entirely of delimiters, the tokenizer will return `NULL`, causing a `NULL` pointer dereference on the first loop iteration. Use a `while` loop or add a `NULL` check prior to the `do-while` block.
Conditionally skipping the initialization function leaves state uninitialized, causing downstream nil pointer dereferences.
'$RESP.$FIELD' is accessed before '$RESP' is nil-checked. When the upstream call returns nil (for example on a 404 or transport error), this dereference causes a nil pointer dereference panic (CWE-476). Move the field access '$X = $RESP.$FIELD' to after the nil/error guard block so that it only executes when '$RESP' is confirmed non-nil.
`getNearCacheStats()` returns a `@Nullable` object. Dereferencing it directly without a null check or `Objects.requireNonNull` can lead to NullPointerException, especially in delayed execution contexts like metric gauge callbacks where the state may have changed since registration.
The pointer returned by dw_get_dname() is passed to dwc_lower_case() BEFORE it is checked for NULL. If dw_get_dname() fails (for example, when parsing a malformed CNAME referral with embedded NULL bytes in a label), it returns NULL and dwc_lower_case() will dereference a NULL pointer. The NULL check on the result must be performed BEFORE calling dwc_lower_ca
A pointer returned by a custom offset-based extractor function is mapped and dereferenced in a loop without a validation boundary for NULL. This can lead to a NULL pointer dereference.
Potential null pointer dereference due to skipping object initialization for 6 or fewer channels. Ensure that necessary components are allocated regardless of channel count or properly handled otherwise.
A libnuma allocation function is called without a subsequent NULL check. This can lead to a NULL pointer dereference or memory leak if memory exhaustion occurs. Always properly check and handle the returned pointer.
Missing NULL check on the result of `strchr` or `strrchr` before using it in string/memory operations. This can lead to a NULL pointer dereference if the character is not found.
Ignoring the error returned by URL parsing functions (like `url.Parse` or `url.ParseRequestURI`) using the blank identifier `_` can lead to nil pointer dereferences. If the dynamically generated input is invalid, the resulting URL object is nil. Dereferencing it will cause a panic (Denial of Service). Ensure that the error is explicitly checked and handled.
The return value of `cram_decode_compression_header()` is used without being checked for NULL. A malformed CRAM file may cause this function to return NULL, leading to a NULL pointer dereference when passed to other functions. Ensure the return value is checked before use.
Time-of-Check to Time-of-Use (TOCTOU) data race detected. A structure field is checked for NULL and then dereferenced. In multithreaded environments, another thread can nullify or free the pointer between the check and the dereference, causing a NULL pointer dereference. Either cache the pointer in a local variable or wrap the check and use securely within a
Direct property access on a state object that was retrieved and cast using `as`. This bypasses TypeScript's null safety. If the state is undefined (e.g., due to user being unauthenticated), this will cause a fatal runtime TypeError (`Cannot read properties of undefined`). Use optional chaining (`?.`) instead, or check if the object exists before accessing.
A memory domain's architecture page tables pointer (`ptables`) is cleared during de-initialization, but its list node (`node`) is not removed from global tracking lists. This creates a dangling pointer that can lead to NULL pointer dereferences or Use-After-Free (UAF) vulnerabilities upon subsequent domain iterations.
Passing the raw `encoder` callback directly to `utils.maybeMap` over an array means `null`/`undefined` entries reach `utils.encode`, which dereferences `str.length` and throws `TypeError: Cannot read properties of null (reading 'length')`. Under `arrayFormat: 'comma'` + `encodeValuesOnly: true`, this aborts stringification before `skipNulls` or `strictNullHa
The function `cJSON_InsertItemInArray` lacks a NULL pointer check for the `newitem` parameter. Passing a NULL pointer to this function results in a NULL pointer dereference. Ensure that `newitem` is validated before operating on its fields.
Accessing a tuple via `tuple_index` without an `is_null()` check after casting with `as_tuple()`. This can lead to a Null Pointer Dereference DoS if the underlying VM parameter is not a tuple.
Directly accessing the `Params` map on a potentially absent SIP header via `.To()` or the internal `.to` field without first validating that the header is not nil can cause a nil pointer dereference. This leads to a panic and a Denial of Service (DoS) condition. Extract the header to a local variable and check if it is nil before accessing `.Params`.
Missing validation for the presence of the NodeID Information Element. A missing NodeID in PFCP messages may lead to a nil pointer dereference when calling `.NodeID()`, causing the process to panic and resulting in a denial-of-service (DoS) condition. Check that `$X.NodeID != nil` before attempting to read its value.
`DetectEngineBufferTypeGetNameById` can return NULL for registry buffer types like `base64_data`. Passing its result directly into `VarNameStoreRegister` or utilizing it without a NULL validation results in a NULL pointer dereference, crashing the Suricata engine.
The return value of a string search function (e.g., `strchr`) is advanced without checking for NULL. If the character or substring is not found, the function returns NULL. Advancing a NULL pointer results in an invalid memory address (like 0x1) that bypasses subsequent NULL sanity checks and causes a segmentation fault (Denial of Service) when dereferenced.
A missing null check for `preset` during legato mode detection can lead to a null pointer dereference later when notes are processed.
Base64 decoding results may be NULL upon failure. If this return value is assigned to a structure field or pointer without a NULL check, it can lead to a NULL pointer dereference.
Directly passing the result of `getOutput` to a container insertion method like `push_back` without checking for null can lead to a null pointer dereference later when the container elements are accessed. Assign the return value to a variable and verify it is not null before inserting.
