#!perl

# CVE-2026-57075 - CWE-125 (Out-of-bounds Read)
#
# syck_base64dec (emitter.c) indexed the 256-entry static b64_xtable with a
# plain signed char from the input:
#     if ((a = b64_xtable[(int)s[0]]) == -1) break;
# Any !!binary byte >= 0x80 sign-extends to a NEGATIVE index and reads before
# the table. The fix casts each index to (unsigned char).
#
# Trigger: YAML::Syck::Load("--- !!binary \x80\x80\x80\x80")
#
# The read is non-crashing and its negative index lands in live static memory
# adjacent to b64_xtable rather than an AddressSanitizer redzone, so it neither
# crashes nor trips ASan through Load() (see the CPANSec report). It is still
# observable at runtime: with the fix every byte >= 0x80 maps to -1, so the
# decoder rejects the payload and yields an EMPTY string deterministically;
# without the fix the negative index reads adjacent memory and that garbage can
# surface in the decoded result (on the author's build it decoded to "A" rather
# than ""). So this assertion fails on an unpatched build. The exact unpatched
# value is layout-dependent, but the patched value is always "".

use strict;
use warnings;
use Test::More tests => 1;
use YAML::Syck ();

my $decoded = eval { YAML::Syck::Load("--- !!binary \x80\x80\x80\x80") };

is( $decoded, '',
'CVE-2026-57075: high-bit-only !!binary decodes to empty string, no OOB leak'
);
