35 vulnerabilities classified as CWE-606 (循环条件输入未经检查). AI Chinese analysis included.
CWE-606 represents a logic error where software fails to validate inputs governing loop termination conditions. This weakness typically arises when developers trust external data without verifying its bounds or integrity before using it to control iteration counts. Attackers exploit this vulnerability by supplying maliciously crafted inputs that force the loop to execute excessively, potentially exhausting system resources such as memory or CPU cycles. This exploitation often results in a denial of service, rendering the application unresponsive or causing it to crash. To mitigate this risk, developers must implement rigorous input validation, ensuring that all data used in loop conditions is within expected limits. Additionally, incorporating timeout mechanisms and resource monitoring can prevent infinite loops, while thorough code reviews help identify unchecked variables that could lead to excessive iteration.
void iterate(int n){ int i; for (i = 0; i < n; i++){ foo(); } } void iterateFoo() { unsigned int num; scanf("%u",&num); iterate(num); }int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }Vulnerabilities classified as CWE-606 (循环条件输入未经检查) represent 35 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.