fix(debuginfo): Remove recursive function parsing - #1063
Merged
klochek merged 5 commits intoSep 2, 2026
Merged
@sentry/warden / warden
completed
Sep 1, 2026 in 0s
2 issues
High
ELF section decompression defaults to unbounded allocation - `symbolic-debuginfo/src/elf.rs:74`
With default ParseObjectOptions, max_decompressed_section_size is None so decompress_section treats the attacker-controlled ELF compressed-size field as unlimited and pre-allocates that many bytes, enabling a tiny compressed section to OOM the process. Set a finite default (or require an explicit cap) before Vec::with_capacity / zstd::bulk::decompress.
Also found at:
symbolic-debuginfo/src/elf.rs:573
Medium
finish() does O(ranges × variables) work with no count caps - `symbolic-debuginfo/src/dwarf/mod.rs:706-775`
InProgressSubProgram::finish nests attacker-controlled DW_AT_ranges counts against unbounded variable lists (and clones per pair), so one DIE with many ranges and many DW_TAG_variable children can burn large CPU/heap before any existing depth/inlinee guard applies.
2 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| security-review | 0 | 4m 39s | $1.66 |
| wrdn-dos-review | 2 | 14m 32s | $4.92 |
⏱ 19m 11s · 5.8M in / 228.1k out · $6.58
Loading