https://sourceware.org/bugzilla/show_bug.cgi?id=34497
Serhei Makarov <serhei at serhei dot io> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |serhei at serhei dot io
--- Comment #1 from Serhei Makarov <serhei at serhei dot io> ---
This falls into a wide category of errors that require the caveat "the
interface in question is not meant to be a hardened security surface". It's
worth keeping the distinction in mind for your future bug-analysis (i.e. add it
to your LLM skills): many toolchain components (a known compiler project
passing code to a known linker project) are not built to treat everything
outside the process as a hostile attacker attempting to provide malicious data.
This means a scan for errors uncovers plenty of crashes at these internal
interfaces. Sometimes the crash is easy to fix, but in general a 'hardened'
toolchain built to withstand a malicious entity inserting data at any point in
the pipeline would require a fundamental redesign, not spot fixes. Reporting
these types of bugs is appropriate, defaulting to 'security' language tends to
be a point of contention.
In this case the crash is easy to fix, but since we are deprecating/removing
the eu-stacktrace code in question in favour of:
- Sysprof builtin sysprof-live-unwinder
- Elfutils standalone tool eu-stackprof
the issue is worth documenting but not fixing. I'll mark it closed as soon as
the stackprof patches are merged.
--
You are receiving this mail because:
You are on the CC list for the bug.
