CWE-674

Uncontrolled Recursion. [Insufficient-Control-Flow-Management]

Required inputs: IR

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Demonstrative Examples

Example 1

In this example a mistake exists in the code where the exit condition contained in flg is never called. This results in the function calling itself over and over again until the stack is exhausted.

Example Language:Cvoid do_something_recursive (int flg) (Unsupported language for documentation only)
    {

        ... // Do some real work here, but the value of flg is unmodified
        if (flg) { do_something_recursive (flg); }    // flg is never modified so it is always TRUE - this call will continue until the stack explodes
    }
    int flag = 1; // Set to TRUE
    do_something_recursive (flag);

Note that the only difference between the Good and Bad examples is that the recursion flag will change value and cause the recursive call to return.

Example Language:Cvoid do_something_recursive (int flg) (Unsupported language for documentation only)
    {

        ... // Do some real work here
        // Modify value of flg on done condition
        if (flg) { do_something_recursive (flg); }    // returns when flg changes to 0
    }
    int flag = 1; // Set to TRUE
    do_something_recursive (flag);

Excerpts from CWE [https://cwe.mitre.org], Copyright (C) 2006-2026, the MITRE Corporation. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
uncontrolled_recursion	Use of uncontrolled recursion.	None	False

Options

• This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity

• The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

allow_globals_for_recursion_control

allow_globals_for_recursion_control : bool = True

If True, checks against global variables are allowed to control recursive calls.

 

require_modification

require_modification : bool = False

If True, at least one argument to the directly recursive call must be modified (in addition to being checked) before the call.