Another Lesson From My First CVE: Use Assertions to Guard Against Infinite Loops

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

(This article follows on the previous one about lessons from CVE-2024-2757.) After going through the experience of accidentally introducing a denial-of-service vulnerability into PHP (due to an unintentional infinite loop), I adopted a software development practice which I haven’t seen others write about. The short version is: use assertions to ensure that non-trivial loops terminate. The rest of…

Read on /guard-against-infinite-loops/ ↗