CodeQL documentation
CodeQL resources

Loop with unreachable exit condition

ID: java/unreachable-exit-in-loop
Kind: problem
Security severity: 7.5
Severity: warning
Precision: medium
Tags:
   - security
   - external/cwe/cwe-835
Query suites:
   - java-security-extended.qls
   - java-security-and-quality.qls

Click to see the query in the CodeQL repository

Loops can contain multiple exit conditions, either directly in the loop condition or as guards around break or return statements. If an exit condition cannot be satisfied, then the code is misleading at best, and the loop might not terminate.

Recommendation

When writing a loop that is intended to terminate, make sure that all the necessary exit conditions can be satisfied and that loop termination is clear.

Example

The following example shows a potentially infinite loop, since the inner loop condition is constantly true. Of course, the loop may or may not be infinite depending on the behavior of shouldBreak, but if this was intended as the only exit condition the loop should be rewritten to make this clear.

for (int i=0; i<10; i++) {
    for (int j=0; i<10; j++) {
        // do stuff
        if (shouldBreak()) break;
    }
}

To fix the loop the condition is corrected to check the right variable.

for (int i=0; i<10; i++) {
    for (int j=0; j<10; j++) {
        // do stuff
        if (shouldBreak()) break;
    }
}

References

  • © GitHub, Inc.
  • Terms
  • Privacy