Closed Amanieu closed 1 year ago
@Amanieu I'll take a look at this and think in more detail about it in the next few days; in the meantime, would you be willing to fuzz this for a bit longer? It took oss-fuzz three weeks to find the prior bug. I don't think it's reasonable to ask a contributor to put that much testing into every patch (if you're willing, though, then fantastic!), but maybe at least 3-4 days would be good. Then subsequent to merging let's wait a bit, maybe two weeks or so, until we release (just as we do now for Cranelift).
Fuzzing has been continuously running for the past 24 hours without issues. I doubt anything new will come up though considering how long it took to find the bug in the first place.
This was missed in #155, and previously wasn't an issue since such bundles were never merged.
This PR also un-reverts #160, since the underlying bug is fixed.