By happen-stance I recently came across an old bug report that I responded to, #13651 (circa 2015-09), and reading the commentary for CVE-2018-1058 made me think about it in a different light. While no one added to my responses back then I'm thinking it would be worthwhile if one or more persons with more experience than myself would skim over the thread and make a judgement as to whether there is anything worth addressing.
The thread ends up being a bit more broad than just what the subject line implies.