Split the security aspect of PWR018 into PWR085

Author: d-alonso

Checks/PWR018/README.md

@@ -19,7 +19,7 @@ control flow logic which the compilers cannot vectorize automatically.
 > In addition to facilitating vectorization, rewriting algorithms in a
 > non-recursive way increases code resilience. Recursive calls may rapidly lead
 > to stack overflows when the recursion depth is too high, potentially causing
-> crashes.
+> crashes. See check [PWR085](../PWR085/README.md) for more details.
 
 > [!NOTE]
 > Whether the loop with a recursive function call is vectorizable or not after

Checks/PWR085/README.md

@@ -0,0 +1,145 @@
+# PWR085: Favor iterative implementations over recursion to prevent stack overflows
+
+### Issue
+
+Uncontrolled recursive calls may lead to program crashes.
+
+### Actions
+
+Rewrite the function using an iterative approach to avoid exhausting stack
+memory.
+
+### Relevance
+
+Recursive functions might seem the most intuitive approaches to implement some
+algorithms. However, a recursive algorithm that is not able to be "tail call
+optimized" can consume excessive stack memory, since the stack memory will need
+to grow with each call.
+
+This can be the case in a variety and a mix of scenarios, such as:
+- A system with limited stack memory.
+- An algorithm that requires a high number of recursive iterations.
+- A badly implemented control condition that does not exit when needed or when
+the recursion becomes too deep.
+
+> [!TIP]
+> In addition to increasing code resilience, rewriting algorithms
+> in a non-recursive way facilitates vectorization.See check
+> [PWR018](../PWR018/README.md) for more details.
+
+### Code example
+
+#### C
+
+In the following example, the loop is invoking a recursive function computing
+the Fibonacci number:
+
+```c
+double fib(unsigned n) {
+  if (n == 0) {
+    return 0.0;
+  }
+  if (n == 1) {
+    return 1.0;
+  }
+  return fib(n - 1) + fib(n - 2);
+}
+
+double example(unsigned times) {
+  double sum = 0.0;
+  for (unsigned i = 0; i < times; i++) {
+    sum += fib(i);
+  }
+  return sum;
+}
+```
+
+As an alternative, Fibonacci's sequence can be calculated non-recursively:
+
+```c
+__attribute__((pure)) double example(unsigned times) {
+  double sum = 0.0;
+  double fib_0 = 0.0;
+  double fib_1 = 1.0;
+  for (unsigned i = 2; i < times; i++) {
+    double fib = fib_0 + fib_1;
+    sum += fib;
+    fib_0 = fib_1;
+    fib_1 = fib;
+  }
+  return sum;
+}
+```
+
+#### Fortran
+
+In the following example, the loop is invoking a recursive function computing
+the Fibonacci number:
+
+```fortran
+module mod_fibonacci
+  implicit none
+  contains
+  recursive function fibonacci(n) result(fibo)
+    implicit none
+    integer, intent(in) :: n
+    integer :: fibo
+
+    if (n == 0) then
+      fibo = 0
+    else if (n == 1) then
+      fibo = 1
+    else
+      fibo = fibonacci(n - 1) + fibonacci(n - 2)
+    end if
+  end function fibonacci
+end module mod_fibonacci
+
+subroutine example(times)
+  use mod_fibonacci, only : fibonacci
+
+  implicit none
+  integer, intent(in) :: times
+  integer :: i, sum
+
+  sum = 0
+
+  do i = 0, times - 1
+    sum = sum + fibonacci(i)
+  end do
+end subroutine example
+```
+
+As an alternative, Fibonacci's sequence can be calculated non-recursively:
+
+```fortran
+subroutine example(times)
+  implicit none
+  integer, intent(in) :: times
+  integer :: i, sum
+  integer :: fib_0, fib_1, fib
+
+  sum = 0
+  fib_0 = 0
+  fib_1 = 1
+
+  do i = 2, times - 1
+    fib = fib_0 + fib_1
+    sum = sum + fib
+    fib_0 = fib_1
+    fib_1 = fib
+  end do
+end subroutine example
+```
+
+### Related resources
+
+* [PWR085 examples](https://github.com/codee-com/open-catalog/tree/main/Checks/PWR085/)
+
+### References
+
+* [CWE - CWE-674: Uncontrolled Recursion](https://cwe.mitre.org/data/definitions/674.html)
+[last checked February 2026]
+
+* [Tail call optmization](https://en.wikipedia.org/wiki/Tail_call)
+[last checked February 2026]

Checks/PWR085/example.c

@@ -0,0 +1,19 @@
+// PWR085: Favor iterative implementations over recursion to prevent stack overflows
+
+double fib(unsigned n) {
+  if (n == 0) {
+    return 0.0;
+  }
+  if (n == 1) {
+    return 1.0;
+  }
+  return fib(n - 1) + fib(n - 2);
+}
+
+double example(unsigned times) {
+  double sum = 0.0;
+  for (unsigned i = 0; i < times; i++) {
+    sum += fib(i);
+  }
+  return sum;
+}

Checks/PWR085/example.f90

@@ -0,0 +1,33 @@
+! PWR085: Favor iterative implementations over recursion to prevent stack overflows
+
+module mod_fibonacci
+  implicit none
+  contains
+  recursive function fibonacci(n) result(fibo)
+    implicit none
+    integer, intent(in) :: n
+    integer :: fibo
+
+    if (n == 0) then
+      fibo = 0
+    else if (n == 1) then
+      fibo = 1
+    else
+      fibo = fibonacci(n - 1) + fibonacci(n - 2)
+    end if
+  end function fibonacci
+end module mod_fibonacci
+
+subroutine example(times)
+  use mod_fibonacci, only : fibonacci
+
+  implicit none
+  integer, intent(in) :: times
+  integer :: i, sum
+
+  sum = 0
+
+  do i = 0, times - 1
+    sum = sum + fibonacci(i)
+  end do
+end subroutine example

Checks/PWR085/solution.c

@@ -0,0 +1,14 @@
+// PWR085: Favor iterative implementations over recursion to prevent stack overflows
+
+__attribute__((pure)) double example(unsigned times) {
+  double sum = 0.0;
+  double fib_0 = 0.0;
+  double fib_1 = 1.0;
+  for (unsigned i = 2; i < times; i++) {
+    double fib = fib_0 + fib_1;
+    sum += fib;
+    fib_0 = fib_1;
+    fib_1 = fib;
+  }
+  return sum;
+}

Checks/PWR085/solution.f90

@@ -0,0 +1,19 @@
+! PWR085: Favor iterative implementations over recursion to prevent stack overflows
+
+subroutine example(times)
+  implicit none
+  integer, intent(in) :: times
+  integer :: i, sum
+  integer :: fib_0, fib_1, fib
+
+  sum = 0
+  fib_0 = 0
+  fib_1 = 1
+
+  do i = 2, times - 1
+    fib = fib_0 + fib_1
+    sum = sum + fib
+    fib_0 = fib_1
+    fib_1 = fib
+  end do
+end subroutine example