NULL Pointers in C: What NULL Means and How to Check for It

A pointer always holds some value. When it has no object to point at yet - before it is assigned, after the thing it pointed at is freed, or when a function has nothing to return - it needs a value that unmistakably means "nothing here". That value is the null pointer, and NULL is the name you write.

The discipline around it is small and pays for itself constantly: set pointers to NULL when they have no target, check for NULL before dereferencing, and return NULL when you have no result.

What NULL Actually Is

NULL is a macro, defined in <stddef.h> and also pulled in by <stdio.h>, <stdlib.h>, <string.h>, and others. It expands to a null pointer constant - typically ((void*)0) or plain 0.

The C standard guarantees the property that matters: a null pointer compares unequal to a pointer to any actual object or function. Two null pointers of the same type always compare equal to each other.

#include <stdio.h>

int main(void) {
    int value = 42;
    int *good = &value;
    int *none = NULL;

    printf("good = %p\n", (void *)good);
    printf("none = %p\n", (void *)none);

    printf("\ngood == NULL? %s\n", good == NULL ? "yes" : "no");
    printf("none == NULL? %s\n", none == NULL ? "yes" : "no");

    return 0;
}

Most systems print (nil) or 0x0 for the null pointer - address zero. That is a common implementation, not a rule; the standard never promises the bits are zero. What it promises is the comparison, so write p == NULL, never anything that depends on the representation.

Dereferencing NULL Crashes

The reason for every null check in existence:

int *p = NULL;
printf("%d\n", *p);   // undefined behavior - almost certainly a crash

On Windows, macOS, and Linux the first page of the address space is deliberately left unmapped, so the CPU traps the access and the operating system kills the program. You will see:

Segmentation fault (core dumped)          # Linux
zsh: segmentation fault  ./program        # macOS

That immediate crash is a feature. It converts a logic bug into a loud failure at the exact line that caused it, instead of a silent corruption you find three weeks later. See segmentation fault for how to read the crash and find the line.

This is why "null pointer" is not an exception you catch in C. There is no mechanism to recover; there is only checking beforehand.

Check What Might Fail

Functions that can fail signal it by returning NULL. Checking is not optional politeness - the crash is the alternative.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void) {
    // 1. malloc returns NULL when allocation fails
    int *numbers = malloc(5 * sizeof *numbers);
    if (numbers == NULL) {
        fprintf(stderr, "out of memory\n");
        return 1;
    }
    for (int i = 0; i < 5; i++) {
        numbers[i] = i * i;
    }
    printf("allocated ok: %d %d %d %d %d\n",
           numbers[0], numbers[1], numbers[2], numbers[3], numbers[4]);
    free(numbers);

    // 2. strchr returns NULL when the character is not found
    const char *text = "hello world";
    const char *found = strchr(text, 'w');
    if (found != NULL) {
        printf("found 'w' at index %td\n", found - text);
    }

    const char *missing = strchr(text, 'z');
    printf("'z' found? %s\n", missing != NULL ? "yes" : "no");

    return 0;
}

The standard library is full of these: malloc, calloc, realloc, fopen, strchr, strstr, getenv, bsearch. Every one of them answers "no result" with NULL. See dynamic memory for the full allocation story.

Two idioms for the check, both common:

if (p == NULL) { /* handle */ }   // explicit - preferred for clarity
if (!p)        { /* handle */ }   // terse - relies on NULL being falsy

A null pointer tests as false in a condition and a valid pointer as true, so both work. The explicit form reads better when a stranger is scanning your code for bugs.

NULL vs 0 vs Uninitialized

Three distinct situations that beginners blur together:

int *a = NULL;     "points at nothing" - testable, safe to check
int *b;            uninitialized - holds garbage, NOT testable
int *c = &x;       points at a real object

The dangerous one is b. Its bytes are whatever was left in that stack slot, which might be zero (and look fine) or might be a plausible-looking address from an earlier call. No check can distinguish it from a valid pointer, and the behavior changes between debug and release builds.

#include <stdio.h>

int main(void) {
    int *safe = NULL;      // definitely nothing

    if (safe == NULL) {
        printf("safe is null - we can test for this\n");
    }

    // an uninitialized pointer cannot be tested; the fix is not to have one
    int *fixed = NULL;
    int value = 7;

    if (fixed == NULL) {
        printf("fixed starts null\n");
        fixed = &value;
    }
    printf("fixed now points at %d\n", *fixed);

    return 0;
}

Initialize every pointer. If you have no address yet, NULL is the address. Compile with -Wall -Wextra and the compiler will flag many uninitialized uses for you.

On 0: in a pointer context the integer constant 0 is the null pointer constant, so p = 0; is valid C. Prefer NULL anyway. It signals intent, and it matters in variadic calls where the compiler cannot convert for you:

execl("/bin/ls", "ls", 0);       // risky - may pass an int where a pointer is expected
execl("/bin/ls", "ls", (char *)NULL);   // correct

C23 adds nullptr, a keyword with its own type that avoids this class of ambiguity entirely; NULL remains correct and portable everywhere.

Defensive Patterns

Guard at the top of a function that takes pointers.

#include <stdio.h>

// returns 0 on success, nonzero on bad input
int average(const int *arr, int n, double *out) {
    if (arr == NULL || out == NULL || n <= 0) {
        return 1;                    // refuse rather than crash
    }
    long total = 0;
    for (int i = 0; i < n; i++) {
        total += arr[i];
    }
    *out = (double)total / n;
    return 0;
}

int main(void) {
    int data[4] = {10, 20, 30, 41};
    double result;

    if (average(data, 4, &result) == 0) {
        printf("average = %.2f\n", result);
    }

    if (average(NULL, 4, &result) != 0) {
        printf("rejected a NULL array instead of crashing\n");
    }

    return 0;
}

Set to NULL after freeing. free does not change your pointer - it only releases the memory. The stale pointer left behind is a dangling pointer, and using it is undefined behavior that often does not crash right away.

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(sizeof *p);
    if (p == NULL) return 1;

    *p = 99;
    printf("value = %d\n", *p);

    free(p);
    p = NULL;          // now the mistake is a loud crash, not a quiet one

    if (p == NULL) {
        printf("p is null - safe to test, safe to free again\n");
    }

    free(p);           // free(NULL) is explicitly a no-op, always safe
    return 0;
}

Two facts inside that example are worth committing to memory. free(NULL) is defined to do nothing, so cleanup code never needs to guard it. And setting p = NULL after free turns a use-after-free - which may silently corrupt data - into an immediate, debuggable crash.

Return NULL to mean "no result", and say so.

// returns a pointer to the matching element, or NULL if there is none
int *find(int *arr, int n, int target);

Document it in the comment above the function. A caller who knows a NULL is possible writes the check; one who does not, will not.

A Quick Checklist

• Initialize every pointer, with a real address or with NULL.
• Check the return of malloc, calloc, realloc, and fopen before using it.
• Check pointer parameters at the top of any function that could be called with bad input.
• Set pointers to NULL immediately after free.
• Write NULL, not 0, whenever a pointer is meant.
• Build with -Wall -Wextra and, when you can, run under a sanitizer: gcc -fsanitize=address,undefined catches null dereferences with a precise report.