Editing Null pointer (section)

== Mitigation ==

While there could be languages with no nulls, most do have the possibility of nulls so there are techniques to avoid or aid debugging null pointer dereferences.<ref name="BondNethercote2007">{{cite book|last1=Bond|first1=Michael D.|last2=Nethercote|first2=Nicholas|last3=Kent|first3=Stephen W.|last4=Guyer|first4=Samuel Z.|last5=McKinley|first5=Kathryn S.|title=Proceedings of the 22nd annual ACM SIGPLAN conference on Object oriented programming systems and applications - OOPSLA '07|chapter=Tracking bad apples|year=2007|pages=405|doi=10.1145/1297027.1297057|isbn=9781595937865|s2cid=2832749}}</ref> Bond et al.<ref name="BondNethercote2007"/> suggest modifying the Java Virtual Machine (JVM) to keep track of null propagation.

There are three levels of handling null references, in order of effectiveness:
# languages with no null;
# languages that can statically analyse code to avoid the possibility of null dereference at run time;
# if null dereference can occur at runtime, tools that aid debugging.

Pure [[functional languages]] are an example of level 1 since no direct access is provided to pointers and all code and data is immutable. User code running in [[interpreter (computing)|interpreted]] or virtual-machine languages generally does not suffer the problem of null pointer dereferencing.{{dubious|VM claim|date=September 2024}}

Where a language does provide or utilise pointers which could become void, it is possible to avoid runtime null dereferences by providing [[void safety|compilation-time checking]] via [[static analysis]] or other techniques, with syntactic assistance from language features such as those seen in the [[Eiffel programming language]] with Void safety<ref>{{cite web | url=https://www.eiffel.org/doc/eiffel/Void-safety-_Background%2C_definition%2C_and_tools |title=Void-safety: Background, definition, and tools|access-date=2021-11-24 }}</ref> to avoid null derefences, [[D programming language|D]],<ref name="SafeD">{{cite web |title=SafeD – D Programming Language |url=http://dlang.org/safed.html |author=Bartosz Milewski |access-date=17 July 2014}}</ref> and [[Rust programming language|Rust]].<ref>{{cite web|title=Fearless Security: Memory Safety|url=https://hacks.mozilla.org/2019/01/fearless-security-memory-safety/|access-date=4 November 2020|archive-date=8 November 2020|archive-url=https://web.archive.org/web/20201108003116/https://hacks.mozilla.org/2019/01/fearless-security-memory-safety/|url-status=live}}</ref>

In some languages analysis can be performed using external tools, but these are weak compared to direct language support with compiler checks since they are limited by the language definition itself.

The last resort of level 3 is when a null reference occurs at runtime, debugging aids can help.