BP graph audit: GatherGraphData lacks visited-set guard against corrupted recursive sub-graphs

[kvirani]

Problem

GatherGraphData recurses for collapsed-node bound graphs and macro graphs without a visited-set guard. UE editor invariants normally prevent recursive composites/macros (the editor refuses to wire them), so this never fires in healthy assets. But a corrupted .uasset that violates the invariant would send the auditor into infinite recursion and crash the editor (or stack-overflow the audit thread).

Severity

Low. Theoretical / defense-in-depth. No known repro on healthy assets.

Suggested fix

Pass a TSet<UEdGraph*>& Visited through GatherGraphData recursive calls; bail early if a graph is re-entered. Same pattern as TraceThroughKnots.

FGraphAuditData GatherGraphData(const UEdGraph* Graph, TSet<const UEdGraph*>& VisitedGraphs)
{
    bool bAlreadyVisited = false;
    VisitedGraphs.Add(Graph, &bAlreadyVisited);
    if (bAlreadyVisited)
    {
        // log + return empty/sentinel data
        return {};
    }
    // ... existing logic ...
}

Public entry points start with an empty set.

Out of scope

• Auditing other recursive paths in non-BP auditors (StateTree state hierarchy, ControlRig sub-graphs). Worth a quick scan as a followup.

Fix lives in

Source/FathomUELink/Private/Audit/BlueprintGraphAuditor.cpp.