1757
// find number of days until inventory count reaches minimum
while (inventoryCount > minimumCount) {
inventoryCount = inventoryCount - rateSold;
days++;
}
// if number of days within reorder timeframe
// set reorder return boolean to true
if (days > 0 && days < 5) {
isReorder = true;
}
return isReorder;
}
However, the while loop will become an infinite loop if the rateSold input parameter has a value
of zero since the inventoryCount will never fall below the minimumCount. In this case the input
parameter should be validated to ensure that a value of zero does not cause an infinite loop, as in
the following code.
Example Language: Java (Good)
public boolean isReorderNeeded(String bookISBN, int rateSold) {
...
// validate rateSold variable
if (rateSold < 1) {
return isReorder;
}
...
}
Observed Examples
Reference Description
CVE-2011-1027 Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using
invalid hex-encoded characters.
https://www.cve.org/CVERecord?id=CVE-2011-1027
CVE-2006-6499 Chain: web browser crashes due to infinite loop - "bad looping logic [that relies
on] floating point math [CWE-1339] to exit the loop [CWE-835]"
https://www.cve.org/CVERecord?id=CVE-2006-6499
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Weakness ID : 835
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')