“The untrusted signature is simply copied into this fixed-sized buffer, overwriting adjacent members with arbitrary attacker-controlled data.”
NSS copied an oversized signature into a 2048-byte buffer without checking the length. The bug sat there since 2012. Mozilla ran oss-fuzz, its own fuzzers, nightly ASAN builds and a bug bounty. None of it caught a memcpy any first-year C student could spot. Every tool in the box was pointed somewhere else.