While fuzzing my project that depends on goblin, I found another out of bounds access. The PR with the sample and a fix can be found here: https://github.com/m4b/goblin/pull/468