To avoid link-time interprocedural anal- ysis,whichwouldbeneededforprecisecallgraphconstruc- tion, our CFI instrumentation uses a very conservative call graph: we use one label both for call sites (i.e., the targets
of returns) and for the first address of every function