Add timeout to prevent verifier hang on malformed programs (#763)

* Add timeout mechanism to prevent verifier infinite loops

Add a 5-second timeout around prevail::analyze() to prevent the fuzzer
from hanging on malformed BPF programs that cause the verifier to enter
infinite loops (e.g., nested loops which are a known limitation of prevail).

The timeout uses a separate thread with std::future::wait_for() to detect
when verification takes too long. If the timeout is reached, the verification
thread is detached and the function returns false (verification failed).

This fix addresses CI failures where the fuzzer would timeout after 60+
seconds on programs that trigger verifier infinite loops.

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Update documentation with implementation notes

Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>

* Revert "Update documentation with implementation notes"

This reverts commit e1c27a1.

* Move verification state to heap to fix use-after-free on timeout

Address review feedback:
- Move all shared state (program, result, promise, completion flag) to
  heap-allocated shared_ptrs so detached thread cannot access destroyed
  stack locals on timeout.
- Add safe_set_value wrapper to guard against set_value throwing when
  promise is already satisfied or has no state.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Alan-Jowett <20480683+Alan-Jowett@users.noreply.github.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

libfuzzer/libfuzz_harness.cc

@@ -15,6 +15,9 @@
 #include <array>
 #include <cinttypes>
 #include <regex>
+#include <thread>
+#include <future>
+#include <chrono>
 
 #include "libfuzzer_config.h"
 
@@ -384,19 +387,67 @@ try {
     prevail::InstructionSeq& prog = std::get<prevail::InstructionSeq>(prog_or_error);
 
     // Convert the instruction sequence to a control-flow graph.
-    const prevail::Program program = prevail::Program::from_sequence(prog, info, options);
+    // Heap-allocated so lifetime is safe if verification thread is detached on timeout.
+    auto program = std::make_shared<prevail::Program>(prevail::Program::from_sequence(prog, info, options));
+
+    // Verify the program with a timeout to prevent infinite loops (e.g., nested loops)
+    // or crashes. Use a future with a timeout to abort verification that takes too long or crashes.
+    constexpr int verification_timeout_seconds = 5;
+    auto result_promise = std::make_shared<std::promise<bool>>();
+    std::future<bool> result_future = result_promise->get_future();
+    auto result = std::make_shared<prevail::AnalysisResult>();
+    auto verification_completed = std::make_shared<bool>(false);
+
+    std::thread verification_thread([program, result, verification_completed, result_promise]() {
+        auto safe_set_value = [&result_promise](bool value) {
+            try {
+                result_promise->set_value(value);
+            } catch (...) {
+                // Suppress exceptions from set_value (e.g., promise already satisfied or no state).
+            }
+        };
+
+        try {
+            *result = prevail::analyze(*program);
+            *verification_completed = true;
+            safe_set_value(true);
+        } catch (const std::exception& ex) {
+            // Verification threw an exception (e.g., null pointer dereference)
+            *verification_completed = false;
+            safe_set_value(false);
+        } catch (...) {
+            // Unknown exception during verification
+            *verification_completed = false;
+            safe_set_value(false);
+        }
+    });
+
+    // Wait for the verification to complete or timeout
+    if (result_future.wait_for(std::chrono::seconds(verification_timeout_seconds)) == std::future_status::timeout) {
+        // Verification timed out - detach the thread and return false.
+        // Shared state (program, result, promise) remains alive via shared_ptr until thread exits.
+        verification_thread.detach();
+        return false;
+    }
+
+    // Get the result and check if verification completed successfully
+    bool success = result_future.get();
+    verification_thread.join();
+
+    if (!success || !*verification_completed) {
+        // Verification failed or threw an exception
+        return false;
+    }
 
-    // Verify the program.
-    const prevail::AnalysisResult result = prevail::analyze(program);
-    stored_invariants = result;
+    stored_invariants = *result;
 
     if (g_ubpf_fuzzer_options.get("UBPF_FUZZER_PRINT_VERIFIER_REPORT")) {
         std::ostringstream error_stream;
-        prevail::print_invariants(error_stream, program, false, result);
+        prevail::print_invariants(error_stream, *program, false, *result);
         std::cout << error_stream.str() << std::endl;
     }
 
-    return !result.failed;
+    return !result->failed;
 } catch (const std::exception& ex) {
     return false;
 }