vbpf / prevail / 28927448050

86%

push

github

Make WTO consumers iterative to avoid stack overflow on crafted CFGs (#1181)

The WTO builder is deliberately iterative to survive large CFGs, but three
consumers recursed on cycle-nesting depth:
 - is_component_member (src/cfg/wto.cpp)
 - Wto/WtoCycle::for_each_loop_head (src/cfg/wto.hpp, used by
   pass_insert_termination_counters)
 - collect_wto_labels (src/ir/cfg_builder.cpp), invoked unconditionally by
   pass_validate_tail_call_depth for every program.

A crafted program (eBPF allows ~1M instructions) with ~N/2 nested strongly-
connected components drives recursion depth O(N); on the mandatory
collect_wto_labels path that can exhaust the C++ stack and crash -- a DoS on
untrusted bytecode.

Convert all three to explicit work-stacks, mirroring the builder. Traversal
semantics are unchanged (order is unspecified for for_each_loop_head; the label
sets are identical); verified by no regression across [yaml] and the full
non-slow [samples] suite, which drive WTO ordering through every analysis.

Signed-off-by: Elazar Gershuni <elazarg@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

21 of 33 new or added lines in 3 files covered. (63.64%)

9157 of 10586 relevant lines covered (86.5%)

6464549.41 hits per line