Code:  static RList *r_bin_wasm_get_element_entries (RBinWasmObj *bin, RBinWasmSection *sec) {
 	RList *ret = NULL;
 	RBinWasmElementEntry *ptr = NULL;
 
	if (!(ret = r_list_newf ((RListFree)free))) {
		return NULL;
 	}
 
 	ut8* buf = bin->buf->buf + (ut32)sec->payload_data;
 	ut32 len =  sec->payload_len;
 	ut32 count = sec->count;
 	ut32 i = 0, r = 0;
 
	while (i < len && r < count) {
 		if (!(ptr = R_NEW0 (RBinWasmElementEntry))) {
 			return ret;
 		}
 		if (!(consume_u32 (buf + i, buf + len, &ptr->index, &i))) {
			free (ptr);
			return ret;
 		}
 		if (!(consume_init_expr (buf + i, buf + len, R_BIN_WASM_END_OF_CODE, NULL, &i))) {
			free (ptr);
			return ret;
 		}
 		if (!(consume_u32 (buf + i, buf + len, &ptr->num_elem, &i))) {
			free (ptr);
			return ret;
 		}
 		ut32 j = 0;
		while (i < len && j < ptr->num_elem	) {
 			ut32 e;
 			if (!(consume_u32 (buf + i, buf + len, &e, &i))) {
 				free (ptr);
 				return ret;
 			}
 		}
 		r_list_append (ret, ptr);
 
 		r += 1;
 	}
 	return ret;
 }

Vulnerability Type: DoS 
CWE ID: CWE-125
Summary: The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.
Commit Message: Fix crash in fuzzed wasm r2_hoobr_consume_init_expr