1486
Ensure an end condition will be reached under all logic conditions. The end condition may
include testing against the depth of recursion and exiting with an error if the recursion goes too
deep. The complexity of the end condition contributes to the effectiveness of this action.
Effectiveness = Moderate
Phase: Implementation
Increase the stack size.
Effectiveness = Limited
Increasing the stack size might only be a temporary measure, since the stack typically is still not
very large, and it might remain easy for attackers to cause an out-of-stack fault.
Demonstrative Examples
Example 1:
In this example a mistake exists in the code where the exit condition contained in flg is never
called. This results in the function calling itself over and over again until the stack is exhausted.
Example Language: C (Bad)
void do_something_recursive (int flg)
{
... // Do some real work here, but the value of flg is unmodified
if (flg) { do_something_recursive (flg); } // flg is never modified so it is always TRUE - this call will continue until the stack
explodes
}
int flag = 1; // Set to TRUE
do_something_recursive (flag);
Note that the only difference between the Good and Bad examples is that the recursion flag will
change value and cause the recursive call to return.
Example Language: C (Good)
void do_something_recursive (int flg)
{
... // Do some real work here
// Modify value of flg on done condition
if (flg) { do_something_recursive (flg); } // returns when flg changes to 0
}
int flag = 1; // Set to TRUE
do_something_recursive (flag);
Observed Examples
Reference Description
CVE-2007-1285 Deeply nested arrays trigger stack exhaustion.
https://www.cve.org/CVERecord?id=CVE-2007-1285
CVE-2007-3409 Self-referencing pointers create infinite loop and resultant stack exhaustion.
https://www.cve.org/CVERecord?id=CVE-2007-3409
CVE-2016-10707 Javascript application accidentally changes input in a way that prevents a
recursive call from detecting an exit condition.
https://www.cve.org/CVERecord?id=CVE-2016-10707
CVE-2016-3627 An attempt to recover a corrupted XML file infinite recursion protection counter
was not always incremented missing the exit condition.
https://www.cve.org/CVERecord?id=CVE-2016-3627
CVE-2019-15118 USB-audio driver's descriptor code parsing allows unlimited recursion leading
to stack exhaustion.
https://www.cve.org/CVERecord?id=CVE-2019-15118
CWE Version 4.14
CWE-675: Multiple Operations on Resource in Single-Operation Context
CWE-675: Multiple Operations on Resource in Single-Operation Context