#!perl

# CVE-2026-57077 - CWE-125 (Out-of-bounds Read)
#
# newline_len()/is_newline() (token.c) dereferenced *ptr (and *(ptr+1) for
# \r\n) with no NUL terminator or bounds guarantee. During block-scalar
# lexing at a document boundary the scan pointer ran one byte past the heap
# lexer buffer. This is an incomplete-fix follow-on to CVE-2025-11683, on a
# lexer path that earlier fix did not cover.
#
# Trigger (6 bytes): YAML::Syck::Load("|\n---\n")
#
# A one-byte over-read that does not crash a normal build, so this file cannot
# fail a plain build - it just confirms Load() completes. The defect is PROVEN
# by the ASan CI job (the `asan` job in .github/workflows/testsuite.yml), where
# this same Load aborts the process with:
#   heap-buffer-overflow READ in newline_len
# and the harness reports this file as failed.

use strict;
use warnings;
use Test::More tests => 1;
use YAML::Syck ();

# Under ASan (unpatched) this Load aborts the process; on a normal build it
# returns harmlessly. eval keeps a normal parse error from failing us.
eval { YAML::Syck::Load("|\n---\n") };

pass('CVE-2026-57077: Load("|\\n---\\n") completed without an ASan fault');
