fix(debuginfo): Add some dwarf debuginfo recursion limits#1015
3 issues
wrdn-dos-review: Found 3 issues (3 high)
High
Nested DW_TAG_subprogram parsing has no recursion depth limit - `symbolic-debuginfo/src/dwarf.rs:920-982`
parse_function and parse_functions mutually recurse for each nested DW_TAG_subprogram in the input, but only inlinee nesting is bounded by remaining_inline_depth; deeply nested subprograms can still exhaust the native stack.
Also found at:
symbolic-debuginfo/src/dwarf.rs:1359symbolic-debuginfo/src/macho/mod.rs:324-329symbolic-debuginfo/src/dwarf.rs:1893
Empty-range DWARF inlinees bypass max_inline_depth limit - `symbolic-debuginfo/src/dwarf.rs:1893`
parse_inlinee returns early for empty-range DW_TAG_inlined_subroutine entries without decrementing remaining_inline_depth, allowing an attacker to chain empty inlinees and exhaust the stack before the depth limit is reached.
decompress_section pre-allocates from attacker-controlled size with default-unlimited cap - `symbolic-debuginfo/src/elf.rs:573`
decompress_section reads a decompressed size from the ELF compression header and pre-allocates a buffer via Vec::with_capacity(size) before the data is decompressed. The size is superficially checked against max_decompressed_section_size, but that option defaults to None (treated as usize::MAX), so the check is inactive in default configurations. A tiny crafted ELF with a compressed section claiming a huge size causes an allocator abort.
⏱ 132m 21s · 10.1M in / 787.5k out · $4.58
Annotations
Check failure on line 982 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
Nested DW_TAG_subprogram parsing has no recursion depth limit
`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.
Check failure on line 1359 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)
`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.
Check failure on line 329 in symbolic-debuginfo/src/macho/mod.rs
sentry-warden / warden: wrdn-dos-review
[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)
`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.
Check failure on line 1893 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)
`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.
Check failure on line 1893 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
Empty-range DWARF inlinees bypass max_inline_depth limit
parse_inlinee returns early for empty-range DW_TAG_inlined_subroutine entries without decrementing remaining_inline_depth, allowing an attacker to chain empty inlinees and exhaust the stack before the depth limit is reached.
Check failure on line 573 in symbolic-debuginfo/src/elf.rs
sentry-warden / warden: wrdn-dos-review
decompress_section pre-allocates from attacker-controlled size with default-unlimited cap
`decompress_section` reads a decompressed size from the ELF compression header and pre-allocates a buffer via `Vec::with_capacity(size)` before the data is decompressed. The size is superficially checked against `max_decompressed_section_size`, but that option defaults to `None` (treated as `usize::MAX`), so the check is inactive in default configurations. A tiny crafted ELF with a compressed section claiming a huge size causes an allocator abort.