1760
if (days > 0 && days < 5) {
isReorder = true;
}
return isReorder;
}
However, the while loop will become an infinite loop if the rateSold input parameter has a value
of zero since the inventoryCount will never fall below the minimumCount. In this case the input
parameter should be validated to ensure that a value of zero does not cause an infinite loop, as in
the following code.
Example Language: Java (Good)
public boolean isReorderNeeded(String bookISBN, int rateSold) {
...
// validate rateSold variable
if (rateSold < 1) {
return isReorder;
}
...
}
Observed Examples
Reference Description
CVE-2022-22224 Chain: an operating system does not properly process malformed Open
Shortest Path First (OSPF) Type/Length/Value Identifiers (TLV) (CWE-703),
which can cause the process to enter an infinite loop (CWE-835)
https://www.cve.org/CVERecord?id=CVE-2022-22224
CVE-2022-25304 A Python machine communication platform did not account for receiving a
malformed packet with a null size, causing the receiving function to never
update the message buffer and be caught in an infinite loop.
https://www.cve.org/CVERecord?id=CVE-2022-25304
CVE-2011-1027 Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using
invalid hex-encoded characters.
https://www.cve.org/CVERecord?id=CVE-2011-1027
CVE-2011-1142 Chain: self-referential values in recursive definitions lead to infinite loop.
https://www.cve.org/CVERecord?id=CVE-2011-1142
CVE-2011-1002 NULL UDP packet is never cleared from a queue, leading to infinite loop.
https://www.cve.org/CVERecord?id=CVE-2011-1002
CVE-2006-6499 Chain: web browser crashes due to infinite loop - "bad looping logic [that relies
on] floating point math [CWE-1339] to exit the loop [CWE-835]"
https://www.cve.org/CVERecord?id=CVE-2006-6499
CVE-2010-4476 Floating point conversion routine cycles back and forth between two different
values.
https://www.cve.org/CVERecord?id=CVE-2010-4476
CVE-2010-4645 Floating point conversion routine cycles back and forth between two different
values.
https://www.cve.org/CVERecord?id=CVE-2010-4645
CVE-2010-2534 Chain: improperly clearing a pointer in a linked list leads to infinite loop.
https://www.cve.org/CVERecord?id=CVE-2010-2534
CVE-2013-1591 Chain: an integer overflow (CWE-190) in the image size calculation causes
an infinite loop (CWE-835) which sequentially allocates buffers without limits
(CWE-1325) until the stack is full.
https://www.cve.org/CVERecord?id=CVE-2013-1591
CVE-2008-3688 Chain: A denial of service may be caused by an uninitialized variable
(CWE-457) allowing an infinite loop (CWE-835) resulting from a connection to
an unresponsive server.
CWE Version 4.14
CWE-836: Use of Password Hash Instead of Password for Authentication
CWE-836: Use of Password Hash Instead of Password for Authentication