Skip to content

fix(debuginfo): Add some dwarf debuginfo recursion limits#1015

Open
klochek wants to merge 7 commits into
masterfrom
christopherklochek/dwarf_recursion_limits
Open

fix(debuginfo): Add some dwarf debuginfo recursion limits#1015
klochek wants to merge 7 commits into
masterfrom
christopherklochek/dwarf_recursion_limits

rebase fallout

4b5e224
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden: wrdn-dos-review completed Jul 24, 2026 in 0s

3 issues

wrdn-dos-review: Found 3 issues (3 high)

High

Nested DW_TAG_subprogram parsing has no recursion depth limit - `symbolic-debuginfo/src/dwarf.rs:920-982`

parse_function and parse_functions mutually recurse for each nested DW_TAG_subprogram in the input, but only inlinee nesting is bounded by remaining_inline_depth; deeply nested subprograms can still exhaust the native stack.

Also found at:

  • symbolic-debuginfo/src/dwarf.rs:1359
  • symbolic-debuginfo/src/macho/mod.rs:324-329
  • symbolic-debuginfo/src/dwarf.rs:1893
Empty-range DWARF inlinees bypass max_inline_depth limit - `symbolic-debuginfo/src/dwarf.rs:1893`

parse_inlinee returns early for empty-range DW_TAG_inlined_subroutine entries without decrementing remaining_inline_depth, allowing an attacker to chain empty inlinees and exhaust the stack before the depth limit is reached.

decompress_section pre-allocates from attacker-controlled size with default-unlimited cap - `symbolic-debuginfo/src/elf.rs:573`

decompress_section reads a decompressed size from the ELF compression header and pre-allocates a buffer via Vec::with_capacity(size) before the data is decompressed. The size is superficially checked against max_decompressed_section_size, but that option defaults to None (treated as usize::MAX), so the check is inactive in default configurations. A tiny crafted ELF with a compressed section claiming a huge size causes an allocator abort.


⏱ 132m 21s · 10.1M in / 787.5k out · $4.58

Annotations

Check failure on line 982 in symbolic-debuginfo/src/dwarf.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

Nested DW_TAG_subprogram parsing has no recursion depth limit

`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.

Check failure on line 1359 in symbolic-debuginfo/src/dwarf.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)

`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.

Check failure on line 329 in symbolic-debuginfo/src/macho/mod.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)

`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.

Check failure on line 1893 in symbolic-debuginfo/src/dwarf.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

[UW4-FSB] Nested DW_TAG_subprogram parsing has no recursion depth limit (additional location)

`parse_function` and `parse_functions` mutually recurse for each nested `DW_TAG_subprogram` in the input, but only inlinee nesting is bounded by `remaining_inline_depth`; deeply nested subprograms can still exhaust the native stack.

Check failure on line 1893 in symbolic-debuginfo/src/dwarf.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

Empty-range DWARF inlinees bypass max_inline_depth limit

parse_inlinee returns early for empty-range DW_TAG_inlined_subroutine entries without decrementing remaining_inline_depth, allowing an attacker to chain empty inlinees and exhaust the stack before the depth limit is reached.

Check failure on line 573 in symbolic-debuginfo/src/elf.rs

See this annotation in the file changed.

@sentry-warden sentry-warden / warden: wrdn-dos-review

decompress_section pre-allocates from attacker-controlled size with default-unlimited cap

`decompress_section` reads a decompressed size from the ELF compression header and pre-allocates a buffer via `Vec::with_capacity(size)` before the data is decompressed. The size is superficially checked against `max_decompressed_section_size`, but that option defaults to `None` (treated as `usize::MAX`), so the check is inactive in default configurations. A tiny crafted ELF with a compressed section claiming a huge size causes an allocator abort.