validation: not panic with redundant Else instrs (#883)

Signed-off-by: Takeshi Yoneda <takeshi@tetrate.io>

internal/wasm/func_validation.go

@@ -1451,6 +1451,9 @@ func (m *Module) validateFunctionWithMaxStackValues(
 			valueTypeStack.pushStackLimit(len(bt.Params))
 			pc += num
 		} else if op == OpcodeElse {
+			if len(controlBlockStack) == 0 {
+				return fmt.Errorf("redundant Else instruction at %#x", pc)
+			}
 			bl := controlBlockStack[len(controlBlockStack)-1]
 			bl.elseAt = pc
 			// Check the type soundness of the instructions *before* entering this else Op.

internal/wasm/func_validation_test.go

@@ -3553,3 +3553,14 @@ func TestFunctionValidation_redundantEnd(t *testing.T) {
 	err := m.validateFunction(api.CoreFeaturesV2, 0, nil, nil, nil, nil, nil)
 	require.EqualError(t, err, "redundant End instruction at 0x1")
 }
+
+// TestFunctionValidation_redundantEnd is found in th validation fuzzing.
+func TestFunctionValidation_redundantElse(t *testing.T) {
+	m := &Module{
+		TypeSection:     []*FunctionType{{}},
+		FunctionSection: []Index{0},
+		CodeSection:     []*Code{{Body: []byte{OpcodeEnd, OpcodeElse}}},
+	}
+	err := m.validateFunction(api.CoreFeaturesV2, 0, nil, nil, nil, nil, nil)
+	require.EqualError(t, err, "redundant Else instruction at 0x1")
+}