fix(decompiler): cap consecutive empty v1 frames in FrameInStreambuf

[CryptoJones]

Closes #449.

FrameInStreambuf::underflow() skipped empty-payload frames in an unbounded for(;;) loop. A peer sending an endless run of zero-length v1 frames keeps the worker spinning in underflow() — never delivering a byte, never reaching EOF. That's a CPU-spin DoS against the native decompiler worker.

(Severity note from the original review: this is localhost IPC between Ghidra and its own decompiler child process, not a network-facing service — the threat model is a misbehaving/compromised sibling process, not a remote attacker. Still worth bounding.)

Change

• New constant frame_v1::MAX_CONSECUTIVE_EMPTY_FRAMES = 16.
• New Error::TOO_MANY_EMPTY_FRAMES.
• underflow() counts consecutive empties per call and, when the run exceeds the cap, ends the stream (EOF) with lastError = TOO_MANY_EMPTY_FRAMES. The counter is correctly per-underflow(): a non-empty frame returns from the call, so all consecutive empties are always consumed within one invocation.

Tests

Two new unit tests in testframe_v1.cc:

• frame_v1_tunnel_in_skips_max_empty_frames_then_delivers — exactly CAP empties still skip through to the real frame.
• frame_v1_tunnel_in_caps_empty_frame_flood — CAP+1 empties → EOF + TOO_MANY_EMPTY_FRAMES, real frame never reached.

The existing frame_v1_tunnel_in_skips_empty_payload_frame (single empty) still holds.

Verification

The repo's decomp_test_dbg links -lbfd, which isn't available on this macOS host (the same reason CI's C++ tests are Ubuntu-only — see #447). So I compiled the actual edited frame_v1.cc + crc32.cc into a standalone driver (no BFD, no decompiler lib) exercising the real FrameInStreambuf:

MAX_CONSECUTIVE_EMPTY_FRAMES = 16
case1 (==CAP empties): delivered 'Z', OK  PASS
case2 (CAP+1 empties): EOF + TOO_MANY_EMPTY_FRAMES  PASS
case3 (1 empty): delivered 'Z', OK  PASS
ALL PASS

The TEST()-macro versions run under make decomp_test_dbg in CI on Ubuntu. No switch over frame_v1::Error exists, so the new enum value can't break -Wswitch.

🤖 Generated with Claude Code