bound cf_table reads when building the cfg and call graph

[Medios-lgtm]

ReadCfTable builds the table straight from the bytes of the cf-table file and only checks that the length is a multiple of the word size, so nothing guarantees the records are terminated. InitializeControlFlowGraph then walks that table with two inner loops that index cf_table[j] without comparing j against the size, and InitializeCallGraph does the same thing a few lines down. On a table whose last record is missing its delimiters both loops run off the end of the vector and keep scanning heap memory until they happen to hit a zero word, copying whatever they read into the successor and callee lists. The FUZZTEST_CHECK_LE at the bottom of each loop body does catch the overrun, but only after the reads have already happened, so it reports the damage rather than preventing it. On a three-word table it fires with j at 11, which means eight words were read past a twenty-four byte allocation. Adding the size comparison to the four inner loop conditions leaves that check to reject a malformed table before anything is read out of bounds, and well-formed tables walk exactly as before. The two death tests cover the truncated table in each builder; both die on the out-of-bounds scan instead of the check without this change.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.