[PATCH 4/5] gdb: in SECURITY.txt, add notes on reporting exec and debug bugs

[Andrew Burgess <aburgess@redhat.com>]

The previous commit clarified the wording about bugs related to
parsing malformed executables and debug information.  Bugs in this
area can be security bugs, but will not be treated with high priority
by the GDB project.

Given this, it does not seem sensible to me that these bugs should be
reported via the more secret bug reporting path.  At the end of the
day fixing these bugs is unlikely to be a priority, so the bugs will
likely end up in the public bugzilla anyway.

I propose that we advise that these bugs just be added to the public
bugzilla from the start.

I'm aware that this advice might be a little contentious, and that is
why I've carved this change out from the previous one.  This makes it
easier for people to agree with the previous commit, but disagree with
this one.
---
 gdb/SECURITY.txt | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt
index 533b70b5875..b484a1f65a1 100644
--- a/gdb/SECURITY.txt
+++ b/gdb/SECURITY.txt
@@ -238,6 +238,13 @@ Reporting Non-Security Bugs
 
     https://sourceware.org/bugzilla/
 
+  Bugs related to parsing malformed executables and debug information
+  should be reported through the public bugzilla.  This is an area of
+  GDB containing known bugs, and as discussed above, it is advised
+  that users mitigate these bugs by running within a sandboxed
+  environment.  As such, these bugs are considered to pose limited
+  risk to users.
+
 Reporting Security Bugs
 -----------------------
 
-- 
2.25.4