GHSA-2wrx-84qj-4pcg: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

anacrolix/torrent’s bencode decoder (bencode/) applies no limit on the nesting depth of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted .torrent file or from metadata obtained from a peer on a magnet-link/v2 download:

1. Stack-overflow process crash. Decoder.readOneValue recurses once per nesting level with no depth bound. A .torrent whose info value is a list nested a few million levels deep (≈8 MB file) drives the recursion past the 1 GiB goroutine-stack limit and the process dies with an unrecoverable fatal error: stack overflow. 2. Quadratic CPU exhaustion. metainfo.FileTree.UnmarshalBencode (BitTorrent v2) re-parses each subtree at every level, making parse time grow ~O(n²). A v2 info dict with a ~30,000-level file tree (≈0.2 MB) takes ~66 s to decode; 60,000 levels exceeds 90 s of decode time.

Affected: every application embedding github.com/anacrolix/torrent that ingests attacker-supplied metainfo - the CLI tools (cmd/torrent, cmd/torrent2), any server that opens .torrent files, or any client that accepts metadata from a peer for a magnet/v2 download. No depth limit has ever existed in the decoder.