Loading invalid YAML results in "Error in `perl': double free or corruption (fasttop)"

[perlpunk]

I am getting this error when loading invalid YAML:

use YAML::Syck;
my $yaml = <<"EOM";
key1: &a value1
&b *a : value2 # invalid anchor plus alias
EOM
my $data = Load($yaml);

*** Error in `perl': double free or corruption (fasttop): 0x000055b6a82ffbe0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7fe49e907bcb]
/lib/x86_64-linux-gnu/libc.so.6(+0x76f96)[0x7fe49e90df96]
/lib/x86_64-linux-gnu/libc.so.6(+0x777de)[0x7fe49e90e7de]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(syck_free_node+0x2d)[0x7fe49e683d3d]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(syck_st_free_nodes+0x12)[0x7fe49e683e52]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(st_foreach+0x55)[0x7fe49e685035]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(syck_st_free+0x20)[0x7fe49e684020]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(syck_free_parser+0x2a)[0x7fe49e68439a]
.../perlbrew/perls/perl-5.24.1/lib/site_perl/5.24.1/x86_64-linux/auto/YAML/Syck/Syck.so(+0x1361d)[0x7fe49e68a61d]
perl(Perl_pp_goto+0xa62)[0x55b6a6685462]
perl(Perl_runops_standard+0x13)[0x55b6a6644073]
perl(perl_run+0x2b6)[0x55b6a65d5076]
perl(main+0x10f)[0x55b6a65b235f]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7fe49e8b72b1]
perl(_start+0x2a)[0x55b6a65b239a]
======= Memory map: ========
...
zsh: abort      perl

YAML::Syck 1.30
This is perl 5, version 24, subversion 1 (v5.24.1) built for x86_64-linux

[perlpunk]

Same result for:

foo: &a &b 23

[perlpunk]

This seems to be the offending code:
https://github.com/toddr/YAML-Syck/blob/master/handler.c#L59 in syck_hdlr_add_anchor:

st_insert( p->anchors, (st_data_t)a, (st_data_t)n );

The function gets called twice. Maybe it should check for

if (n->anchor != NULL)

and return a proper error message. Not sure though how errors are handled here.

[toddr]

Fixed by #48