#!perl

# CVE-2026-57076 - CWE-416 (Use After Free)
#
# An anchor name string allocated by syck_strndup was freed in
# syck_hdlr_add_anchor (handler.c:43) while still stored as a live KEY in the
# parser's anchors table. On an anchor redefinition, syck_hdlr_remove_anchor
# calls st_delete, whose st_strcmp then compares against that freed key.
#
# Trigger (9 bytes): YAML::Syck::Load("- &a&V\n&a")
#
# This is a NON-crashing use-after-free: on a normal build the freed key is
# still readable and nothing faults, so this file cannot fail a plain build -
# it just confirms Load() completes. The defect is PROVEN by the ASan CI job
# (the `asan` job in .github/workflows/testsuite.yml), where this same Load
# aborts the process with:
#   heap-use-after-free READ in st_strcmp, freed by syck_hdlr_add_anchor
# and the harness reports this file as failed.

use strict;
use warnings;
use Test::More tests => 1;
use YAML::Syck ();

# Under ASan (unpatched) this Load aborts the process; on a normal build it
# returns/croaks harmlessly. eval keeps a normal parse error from failing us.
eval { YAML::Syck::Load("- &a&V\n&a") };

pass('CVE-2026-57076: Load("- &a&V\\n&a") completed without an ASan fault');
