Skip to content

fix: add null guards in IFDS solver to prevent NPE crashes on large APKs - #880

Merged
StevenArzt merged 1 commit into
secure-software-engineering:developfrom
JLEnoch1:fix/ifds-solver-npe-null-guards
Aug 3, 2026
Merged

fix: add null guards in IFDS solver to prevent NPE crashes on large APKs#880
StevenArzt merged 1 commit into
secure-software-engineering:developfrom
JLEnoch1:fix/ifds-solver-npe-null-guards

Conversation

@JLEnoch1

@JLEnoch1 JLEnoch1 commented Aug 3, 2026

Copy link
Copy Markdown

…prevent NPE crashes on large APKs

Two NullPointerExceptions in the IFDS solver crash FlowDroid on large/complex APKs (e.g., 46 MB, 336K+ methods, 6 DEX):

  1. targetVal=null NPE in IFDSSolver.propagate(): When the alias solver callback injects an edge with a null abstraction, targetVal.getPathLength() throws NPE and kills the entire analysis. The memoryManager block only checks for null inside its own scope, so when memoryManager is null, targetVal is never validated.

  2. targets=null NPE in FlowInsensitiveSolver.processExit(): computeReturnFlowFunction() can return null (the FlowFunction contract allows it), but the main branch of processExit() iterates over the result without a null check. The followReturnsPastSeeds branch already has @this guard.

Fix: Add early-return null guards before the dereference points in all three solver variants (fastSolver, gcSolver, flowInsensitive).
Closes #879

…prevent NPE crashes on large APKs

Two NullPointerExceptions in the IFDS solver crash FlowDroid on
large/complex APKs (e.g., 46 MB, 336K+ methods, 6 DEX):

1. targetVal=null NPE in IFDSSolver.propagate():
   When the alias solver callback injects an edge with a null
   abstraction, targetVal.getPathLength() throws NPE and kills
   the entire analysis. The memoryManager block only checks for
   null inside its own scope, so when memoryManager is null,
   targetVal is never validated.

2. targets=null NPE in FlowInsensitiveSolver.processExit():
   computeReturnFlowFunction() can return null (the FlowFunction
   contract allows it), but the main branch of processExit()
   iterates over the result without a null check. The
   followReturnsPastSeeds branch already has this guard.

Fix: Add early-return null guards before the dereference points
in all three solver variants (fastSolver, gcSolver, flowInsensitive).
@JLEnoch1 JLEnoch1 changed the title Add null guards in IFDS solver to prevent NPE crashes fix: add null guards in IFDS solver to prevent NPE crashes on large APKs Aug 3, 2026
@StevenArzt

Copy link
Copy Markdown
Member

This merge request solves the problem, and I think it's good to have these checks for additional stability. At the same time, the checks hide the underlying problem. The alias solver should not inject null abstractions. The flow functions should not add null elements to the list of abstractions either.

If you have some time, please look into the root cause of this issue.

@StevenArzt
StevenArzt merged commit df65a00 into secure-software-engineering:develop Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

IFDS solver NullPointerExceptions on large/complex APKs (targetVal=null, targets=null)

2 participants