GNU Binutils through version 2.30 is vulnerable to a stack-overflow in the libiberty/cplus-dem.c demangling functions demangle_template_value_parm, demangle_integral_value, and demangle_expression. An attacker could exploit this to cause a crash via a crafted file. Upstream Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85304
Created binutils tracking bugs for this issue: Affects: fedora-all [bug 1566792] Created mingw-binutils tracking bugs for this issue: Affects: fedora-all [bug 1566790] Affects: epel-all [bug 1566789]
Tested in RHEL 7 and 6 but c++filt didn't crash with the provided PoC. It may be because without sanitizer it is necessary less stack per recursion level. In any case, as stated by upstream, it seems that all is working as designed and isn't a bug.
Statement: Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details.