Invalid basic_string_view::substr:__pos() number cause DoS about wabt

[keithw]

Thanks for these reports! For this particular one, I don't think it has anything to do with it being a "crafted wasm file" -- this is coming from the use of -o /dev/null on the command line and doesn't have anything to do with the Wasm file. wasm2c will always bomb out if the filename doesn't end in ".[something]"; it's trying to strip off a possible .c file extension to see if it can replace it with .h:

  std::string_view ext = s.substr(s.find_last_of('.'));

The error reporting here could definitely be vastly improved, but that's the reason... So I don't really think this is a DoS unless the threat model includes untrusted user-provided command-line flags (or at least, untrusted user-provided target filenames).

[goldds96]

I understand it

Thank you for your explaining :)