1759
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(port);
servaddr.sin_addr.s_addr = inet_addr(hostaddr);
do {
// establish connection to server
connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr));
// if connected then read and process messages from server
if (connected > -1) {
// read and process messages
...
}
// keep trying to establish connection to the server
} while (connected < 0);
// close socket and return success or failure
...
}
However, this will create an infinite loop if the server does not respond. This infinite loop will
consume system resources and can be used to create a denial of service attack. To resolve this a
counter should be used to limit the number of attempts to establish a connection to the server, as in
the following code.
Example Language: C (Good)
int processMessagesFromServer(char *hostaddr, int port) {
...
// initialize number of attempts counter
int count = 0;
do {
// establish connection to server
connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr));
// increment counter
count++;
// if connected then read and process messages from server
if (connected > -1) {
// read and process messages
...
}
// keep trying to establish connection to the server
// up to a maximum number of attempts
} while (connected < 0 && count < MAX_ATTEMPTS);
// close socket and return success or failure
...
}
Example 2:
For this example, the method isReorderNeeded is part of a bookstore application that determines if
a particular book needs to be reordered based on the current inventory count and the rate at which
the book is being sold.
Example Language: Java (Bad)
public boolean isReorderNeeded(String bookISBN, int rateSold) {
boolean isReorder = false;
int minimumCount = 10;
int days = 0;
// get inventory count for book
int inventoryCount = inventory.getIventoryCount(bookISBN);
// find number of days until inventory count reaches minimum
while (inventoryCount > minimumCount) {
inventoryCount = inventoryCount - rateSold;
days++;
}
// if number of days within reorder timeframe
// set reorder return boolean to true
CWE Version 4.14
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')