Code Correctness: Stack Exhaustion

Java/JSP

Abstract

能夠在資料結構中建立循環連結的程式，可能在資料結構以遞迴方式處理時導致堆疊耗盡。

Explanation

使用遞迴是建立和管理已連結資料結構的主要方式。如果資料包含循環連結，遞迴也存在無限處理的風險，轉而會耗盡堆疊並使程式當機。

範例 1：以下程式碼片段使用 Apache Log4j2 示範此弱點。


Marker child = MarkerManager.getMarker("child");
Marker parent = MarkerManager.getMarker("parent");

child.addParents(parent);
parent.addParents(child); 
        
String toInfinity = child.toString();

當子項呼叫的 toString() 包括遞迴處理方法時，就會觸發堆疊溢位異常 (堆疊耗盡)。此異常起因於子項與父項之間的循環連結。

References

[1] DOS-1: Beware of activities that may use disproportionate resources Oracle

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 1

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 2

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark normal

[6] Standards Mapping - Common Weakness Enumeration CWE ID 674

[7] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective C.3.3 - Web Software Attack Mitigation

desc.controlflow.java.code_correctness_stack_exhaustion