fix: add null guards in IFDS solver to prevent NPE crashes on large APKs - #880
Merged
StevenArzt merged 1 commit intoAug 3, 2026
Conversation
…prevent NPE crashes on large APKs Two NullPointerExceptions in the IFDS solver crash FlowDroid on large/complex APKs (e.g., 46 MB, 336K+ methods, 6 DEX): 1. targetVal=null NPE in IFDSSolver.propagate(): When the alias solver callback injects an edge with a null abstraction, targetVal.getPathLength() throws NPE and kills the entire analysis. The memoryManager block only checks for null inside its own scope, so when memoryManager is null, targetVal is never validated. 2. targets=null NPE in FlowInsensitiveSolver.processExit(): computeReturnFlowFunction() can return null (the FlowFunction contract allows it), but the main branch of processExit() iterates over the result without a null check. The followReturnsPastSeeds branch already has this guard. Fix: Add early-return null guards before the dereference points in all three solver variants (fastSolver, gcSolver, flowInsensitive).
StevenArzt
approved these changes
Aug 3, 2026
Member
|
This merge request solves the problem, and I think it's good to have these checks for additional stability. At the same time, the checks hide the underlying problem. The alias solver should not inject If you have some time, please look into the root cause of this issue. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…prevent NPE crashes on large APKs
Two NullPointerExceptions in the IFDS solver crash FlowDroid on large/complex APKs (e.g., 46 MB, 336K+ methods, 6 DEX):
targetVal=null NPE in IFDSSolver.propagate(): When the alias solver callback injects an edge with a null abstraction, targetVal.getPathLength() throws NPE and kills the entire analysis. The memoryManager block only checks for null inside its own scope, so when memoryManager is null, targetVal is never validated.
targets=null NPE in FlowInsensitiveSolver.processExit(): computeReturnFlowFunction() can return null (the FlowFunction contract allows it), but the main branch of processExit() iterates over the result without a null check. The followReturnsPastSeeds branch already has @this guard.
Fix: Add early-return null guards before the dereference points in all three solver variants (fastSolver, gcSolver, flowInsensitive).
Closes #879