Add bounds checking to solve_phi_insertion

Prevent buffer overflow in phi node insertion algorithm by adding
bounds checks to the fixed-size work_list array (64 elements).

Author: jserv

src/ssa.c

@@ -607,8 +607,11 @@ void solve_phi_insertion(void)
             int work_list_idx = 0;
 
             for (ref_block_t *ref = var->ref_block_list.head; ref;
-                 ref = ref->next)
+                 ref = ref->next) {
+                if (work_list_idx >= 64) /* Prevent buffer overflow */
+                    break;
                 work_list[work_list_idx++] = ref->bb;
+            }
 
             for (int i = 0; i < work_list_idx; i++) {
                 basic_block_t *bb = work_list[i];
@@ -653,7 +656,7 @@ void solve_phi_insertion(void)
                                 break;
                             }
                         }
-                        if (!found)
+                        if (!found && work_list_idx < 64) /* Bounds check */
                             work_list[work_list_idx++] = df;
                     }
                 }