CWE-690 (未检查返回值导致空指针解引用) — Vulnerability Class 21

CWE-690 represents a critical logic flaw where software fails to verify the return value of a function that may yield a NULL pointer upon failure. This weakness typically manifests when developers assume successful execution without validating the output, leading directly to a NULL pointer dereference if the underlying operation encounters an error. Attackers exploit this vulnerability by triggering the specific error condition that causes the function to return NULL, thereby forcing the application to access invalid memory. This results in immediate program crashes, denial of service, or potentially arbitrary code execution if the NULL dereference can be manipulated to overwrite critical control structures. To mitigate this risk, developers must rigorously implement defensive programming practices by explicitly checking every function return value against NULL before proceeding with any pointer operations.