Another Lesson From My First CVE: Use Assertions to Guard Against Infinite Loops

(This article follows on the previous one about lessons from CVE-2024-2757.) After going through the experience of accidentally introducing a denial-of-service vulnerability into PHP (due to an unintentional infinite loop), I adopted a software development practice which I haven’t seen others write about. The short version is: use assertions to ensure that non-trivial loops terminate. The rest of…