Skip to content

fix(debuginfo): Remove recursive function parsing - #1063

Merged
klochek merged 5 commits into
masterfrom
christopherklochek/ingest-1149-residual-unbounded-recursion-in-dwarf
Sep 2, 2026
Merged

fix(debuginfo): Remove recursive function parsing#1063
klochek merged 5 commits into
masterfrom
christopherklochek/ingest-1149-residual-unbounded-recursion-in-dwarf

feedback

b3002d6
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed Sep 1, 2026 in 0s

2 issues

High

ELF section decompression defaults to unbounded allocation - `symbolic-debuginfo/src/elf.rs:74`

With default ParseObjectOptions, max_decompressed_section_size is None so decompress_section treats the attacker-controlled ELF compressed-size field as unlimited and pre-allocates that many bytes, enabling a tiny compressed section to OOM the process. Set a finite default (or require an explicit cap) before Vec::with_capacity / zstd::bulk::decompress.

Also found at:

  • symbolic-debuginfo/src/elf.rs:573

Medium

finish() does O(ranges × variables) work with no count caps - `symbolic-debuginfo/src/dwarf/mod.rs:706-775`

InProgressSubProgram::finish nests attacker-controlled DW_AT_ranges counts against unbounded variable lists (and clones per pair), so one DIE with many ranges and many DW_TAG_variable children can burn large CPU/heap before any existing depth/inlinee guard applies.

2 skills analyzed
Skill Findings Duration Cost
security-review 0 4m 39s $1.66
wrdn-dos-review 2 14m 32s $4.92

⏱ 19m 11s · 5.8M in / 228.1k out · $6.58