fix(debuginfo): Add some dwarf debuginfo recursion limits#1015
3 issues
wrdn-dos-review: Found 3 issues (2 high, 1 medium)
High
Nested DW_TAG_subprogram recursion has no depth limit - `symbolic-debuginfo/src/dwarf.rs:1359`
max_inline_depth only bounds DW_TAG_inlined_subroutine nesting, but nested DW_TAG_subprogram entries recurse through parse_function → parse_function_children without decrementing any limit, so a crafted DWARF binary with deeply nested subprograms can still exhaust the native stack.
Also found at:
symbolic-debuginfo/src/dwarf.rs:1756symbolic-debuginfo/src/dwarf.rs:881
ELF decompression size guard defaults to unlimited, allowing OOM abort on tiny input - `symbolic-debuginfo/src/elf.rs:174-175`
max_decompressed_section_size defaults to None, which disables the size check and lets a tiny crafted ELF file declare a multi-GB compressed section, causing Vec::with_capacity(size) to abort the allocator.
Also found at:
symbolic-debuginfo/src/elf.rs:359symbolic-debuginfo/src/object.rs:148-160
Medium
parse_inlinee early return bypasses inline recursion limit - `symbolic-debuginfo/src/dwarf.rs:1115`
When an inline subroutine has empty ranges, parse_inlinee delegates to parse_functions without decrementing remaining_inline_depth. Since parse_functions can encounter nested subprograms whose children include further DW_TAG_inlined_subroutine entries, a crafted chain of empty-range inlinees (interleaved with subprograms) can recurse arbitrarily without ever reducing the depth budget, bypassing the intended stack-overflow protection.
⏱ 57m 10s · 14.2M in / 521.0k out · $4.38
Annotations
Check failure on line 1359 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
Nested DW_TAG_subprogram recursion has no depth limit
`max_inline_depth` only bounds `DW_TAG_inlined_subroutine` nesting, but nested `DW_TAG_subprogram` entries recurse through `parse_function` → `parse_function_children` without decrementing any limit, so a crafted DWARF binary with deeply nested subprograms can still exhaust the native stack.
Check failure on line 1756 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
[QEF-D9J] Nested DW_TAG_subprogram recursion has no depth limit (additional location)
`max_inline_depth` only bounds `DW_TAG_inlined_subroutine` nesting, but nested `DW_TAG_subprogram` entries recurse through `parse_function` → `parse_function_children` without decrementing any limit, so a crafted DWARF binary with deeply nested subprograms can still exhaust the native stack.
Check failure on line 881 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
[QEF-D9J] Nested DW_TAG_subprogram recursion has no depth limit (additional location)
`max_inline_depth` only bounds `DW_TAG_inlined_subroutine` nesting, but nested `DW_TAG_subprogram` entries recurse through `parse_function` → `parse_function_children` without decrementing any limit, so a crafted DWARF binary with deeply nested subprograms can still exhaust the native stack.
Check failure on line 175 in symbolic-debuginfo/src/elf.rs
sentry-warden / warden: wrdn-dos-review
ELF decompression size guard defaults to unlimited, allowing OOM abort on tiny input
`max_decompressed_section_size` defaults to `None`, which disables the size check and lets a tiny crafted ELF file declare a multi-GB compressed section, causing `Vec::with_capacity(size)` to abort the allocator.
Check failure on line 359 in symbolic-debuginfo/src/elf.rs
sentry-warden / warden: wrdn-dos-review
[NRR-XKG] ELF decompression size guard defaults to unlimited, allowing OOM abort on tiny input (additional location)
`max_decompressed_section_size` defaults to `None`, which disables the size check and lets a tiny crafted ELF file declare a multi-GB compressed section, causing `Vec::with_capacity(size)` to abort the allocator.
Check failure on line 160 in symbolic-debuginfo/src/object.rs
sentry-warden / warden: wrdn-dos-review
[NRR-XKG] ELF decompression size guard defaults to unlimited, allowing OOM abort on tiny input (additional location)
`max_decompressed_section_size` defaults to `None`, which disables the size check and lets a tiny crafted ELF file declare a multi-GB compressed section, causing `Vec::with_capacity(size)` to abort the allocator.
Check warning on line 1115 in symbolic-debuginfo/src/dwarf.rs
sentry-warden / warden: wrdn-dos-review
parse_inlinee early return bypasses inline recursion limit
When an inline subroutine has empty ranges, `parse_inlinee` delegates to `parse_functions` without decrementing `remaining_inline_depth`. Since `parse_functions` can encounter nested subprograms whose children include further `DW_TAG_inlined_subroutine` entries, a crafted chain of empty-range inlinees (interleaved with subprograms) can recurse arbitrarily without ever reducing the depth budget, bypassing the intended stack-overflow protection.