Binutils Denial-of-Service Vulnerability in PE File Processing

A denial-of-service vulnerability has been identified in Binutils version 2.26. The issue arises in the 'd_discriminator' function within 'cp-demangle.c', where attackers can cause a segmentation fault by using a crafted Portable Executable (PE) file. This vulnerability was discovered while the software was compiled with Clang 12.0.1, using AddressSanitizer to detect memory issues.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing a crash of the 'cxxfilt' tool included in Binutils.

Reproduction

The vulnerability can be reproduced by compiling Binutils 2.26 with Clang 12.0.1. After compiling the tool with AddressSanitizer enabled, the crafted PE file can be processed using 'cxxfilt', which will trigger the segmentation fault.