Duplicate of #190

…che Parameters Leaf

#190

…_LEVEL

ParseLeaf2 appends a CacheLevelInfo to CacheInfo::levels (a fixed
CPU_FEATURES_MAX_CACHE_LEVEL=10 array) for every non-zero leaf-2
descriptor byte, but the loop is bounded only by sizeof(data)==16 and
never checks info->size against the array capacity. A CPUID leaf 2
advertising more than 10 non-zero descriptors (up to 15 are possible)
writes past levels[10] -- an out-of-bounds write reachable from public
GetX86CacheInfo() on hardware/hypervisor-controlled CPUID input. The
sibling ParseCacheInfo already guards its loop with
'info.size < CPU_FEATURES_MAX_CACHE_LEVEL' (added for the same class of
corruption in google#190); apply the same bound to ParseLeaf2.

Adds a regression test (Leaf2_TooManyDescriptors_DoesNotOverflow) that
feeds a leaf 2 with 15 descriptors: it triggers an ASan
stack-buffer-overflow before the fix and passes after.