From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id 4yR3FqVOzmrMlwIAWB0awg (envelope-from ) for ; Tue, 13 Oct 2026 11:30:45 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=W7SJimPg; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 245DC1E04E; Tue, 13 Oct 2026 11:30:45 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 8AED91E04E for ; Tue, 13 Oct 2026 11:30:44 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 2379B4BA7988 for ; Tue, 13 Oct 2026 15:30:42 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 2379B4BA7988 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=W7SJimPg Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTP id 92DEF4BA798C for ; Tue, 13 Oct 2026 15:30:17 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 92DEF4BA798C Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 92DEF4BA798C Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791905417; cv=none; b=TYbVYaVryCOPnZQCc+s6xXbUVoYKq9LeWVEHvX3I9Np1uXOXWhHx2cB7PgBnpQHQyKAkAm51gzwRNK2WAwS7Om705C6UJT/G7fhZWMyhZfnUfKRZNrxUdkLWie786PxILCPPXwLOkfzlu5oOIbA3hZlaUgrzEZNEmK8I0y7aPoc= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791905417; c=relaxed/simple; bh=wA6tVKxuinRtN5Qxk9ohhyd1iZJPCw5JTimWuVJtS2A=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=C6lZlCinjzyzjmmGel+lWyWtLT5q2/DLCWbeid+ULXMGhAamPqvB/1yyGuTlaX5vB9ZfH2IkI3PDvyeuzZnmN78GA9ropG3K96y4Hwyt/AcwRy9SM8+mutAQMrJtr2m+25M2UeJo6JxWW43VmzeICSwZzJcLfiWFJY/92kAk0Ng= ARC-Authentication-Results: i=1; sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791905415; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=MHGhJSaqXceLZX8o4TPXHTQ16v3Cu45/oMFGFsuXtYM=; b=W7SJimPgiWLxz8UK/tPX7BhNOYMcCIvHCyRLK1oZ/8rcsLQMQ3dw87Ac0aRQuDlCSql3Cx zWmCHqwdtqOuzLSSnJcAezrnaLKLJcXdkE7QT6Ou3g6nZwNIvLdEqmDpJnv9WBkJpA4YD8 KL7u5bWNHEQbHOmkFAcmfMA4aPOdrlw= Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-609-QBbDgXZWO2SK6OPS86LNyw-1; Tue, 13 Oct 2026 15:30:14 +0000 X-MC-Unique: QBbDgXZWO2SK6OPS86LNyw-1 X-Mimecast-MFC-AGG-ID: QBbDgXZWO2SK6OPS86LNyw_1791905413 Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-91b4bf686ceso107529896d6.3 for ; Tue, 13 Oct 2026 08:30:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791905413; x=1792510213; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MHGhJSaqXceLZX8o4TPXHTQ16v3Cu45/oMFGFsuXtYM=; b=cRbrNpQkyaqQtS+KWAxyfV1fYCoP7p+xUdQGkpABR8vKf3STM7J4vSLWfPWGCwiDpK O0C+5nopR38b1Ce6rhna2cebgdPkYsV1teqwzEnwH2tKbC9CDbVHq4bt3N/JxIRdDscO cbHBiAw8Fu7XPD8Pa4jgJyG0Z9Nh41OXj0RLOlyd1mL3oSJDxvTYleHWTnX4mNr/O21Y 0+qoVtWnqlVxPxCDTaBAt9iJpj3Q5Ota9+9gYIDtkBq27MWVUE6woepnFvXoOdjKT3jo +VCknToG5TezF+uAo+hrtPQsQz8jEM7gbnKKp52uEZB9sckS/VRdh+Y7Df+NxraWoMwI 2GKg== X-Forwarded-Encrypted: i=1; AKwUvBwFQLpGdJmZCZTkzTR7MEU3AWCcSIR/yjt040m2yc+eayNwwoF5t7N0TTx04Raef+FzKtKYgKpYWx400Q==@sourceware.org X-Gm-Message-State: AFq9FYI6zmAgoN6NvC02U0dkH23ikaZqDHPf1PitAa+X0l2crdgt+Lxy BzxMa1knzUz6FbviMoCBUt0ro8+3s55Oho84mSc+tsyXYIIxsOI9pzjLm9FkhcwvRHbMN2MNxnr jCfDMI4lI4unt7bgUhUXjTa+JeRBXkJpzqLXddsf6YPm3t5o+uNcOKdCVBT/W/9ziSO7OkF0= X-Gm-Gg: AYBFou0Khy3YjP0h2dNeZf1A12yUJ7MgFC0KhKsrC+Br5BAGfq1bskNavQsmutj5EKq 7oEmLK9eCUThhnZqnXGe4f5eSfY3986fTqQ5+zBfO+EfsDYvAD4C/HT9nZw8OFsbzMUB0fmTUun xNhLVezUSoxik6bKZ33mHJs4nEl0NkylyYjXb+TwLOoPndJ+OJlRJ2aTOSI4fyZoM0IBx3EUM26 gvH2NVXzs/g6wSD6AIEcLgqEvS2qGzVSMjmCe9R5ESQzOVIdpiE38tZxNqOdAe7+S90WwQGPTs+ sZikuaG1Ba7rfhs+feHjRLThmDw3cw6ElUGe6zM3mOAIYbFeQyV+MYAACLVu4OWzBD35iVySDmd ScA== X-Received: by 2002:a05:620a:660a:b0:93c:7955:afd9 with SMTP id af79cd13be357-93ebd27ab42mr2028705885a.52.1791905413354; Tue, 13 Oct 2026 08:30:13 -0700 (PDT) X-Received: by 2002:a05:620a:660a:b0:93c:7955:afd9 with SMTP id af79cd13be357-93ebd27ab42mr2028689085a.52.1791905412123; Tue, 13 Oct 2026 08:30:12 -0700 (PDT) Received: from [192.168.42.182] ([38.74.41.78]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91b97bdf05dsm27907126d6.38.2026.10.13.08.30.11 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 13 Oct 2026 08:30:11 -0700 (PDT) Message-ID: <32c303aa-bd42-43b0-a141-9ee425859c38@redhat.com> Date: Tue, 13 Oct 2026 11:30:08 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 3/5] gdb: extend SECURITY.txt discussion of DWARF/BFD parser bugs To: Andrew Burgess , gdb-patches@sourceware.org References: <9147299b6936533f5a056b9475f9b41b164bb1ff.1791812758.git.aburgess@redhat.com> From: Siddhesh Poyarekar In-Reply-To: <9147299b6936533f5a056b9475f9b41b164bb1ff.1791812758.git.aburgess@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: S6P8uvunbvn3pY_S8dWXPhUmbIlQx5cc7g_HCkwkJTQ_1791905413 X-Mimecast-Originator: redhat.com Content-Language: en-US, en-CA, en-GB, en-IN Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org On 10/12/26 9:49 AM, Andrew Burgess wrote: > 3. The real change: clearly state that bugs in the DWARF/BFD parser > can be security bugs, but they are unlikely to be considered high > priority, and users should instead use sandboxing to provide > protection. The text about bugs from well-formed programs is > retained. I don't have a strong opinion on the meat of the change, but I want to point out that this is not sufficient deterrence for people flooding the project with such reports to get CVE creds in their name. What priority a CVE gets downstream is typically a result of perception and the relatively dumb CVSS scores. Unfortunately all major distributions are currently lost to that madness and "unlikely to be considered high priority" may not actually pan out that way in practice. Sid