GHSA-c99m-6ph2-xqm4: 
Rust vulnerability analysis and mitigation

Summary

None of our back-ends provide implementation of memory64 feature, but one can programmatically enable the feature via API:

let mut features = Features::default();
    features.memory64(true);
    let engine = EngineBuilder::new(Singlepass::default())
        .set_features(Some(features))
        .engine();

And then the compiler emits a code that is invalid. It's unlikely somebody enables the feature (and accepts it in the WebAssembly modules), but we must ensure it.

Details

The summary is selft-explanatory.

Proof of concept

let mut features = Features::default();
    features.memory64(true);
    let engine = EngineBuilder::new(Singlepass::default())
        .set_features(Some(features))
        .engine();

Impact

The impact is rather low given the feature is off by default