recursive call vulnerability