Read the proof, not the promise.

libyang · src/parser_lyb.c · lyb_read_string()  —  CWE-190 -> CWE-122

// libyang · src/parser_lyb.c · lyb_read_string()
// str_len is a 32-bit length read straight from the LYB blob — attacker-controlled.

L288  *str = malloc(str_len + 1);       /* (str_len + 1) wraps to 0 in uint32      */
L293  lyb_read(*str, str_len * 8, in);  /* str_len * 8 also wraps — no 64-bit guard */
L296  (*str)[str_len] = '\0';           /* write at [str_len] — far out of bounds   */

str_len comes straight from the LYB blob, unchecked. With str_len = 0xFFFFFFFF, (str_len + 1) wraps to 0: the parser allocates almost nothing, then writes str_len bytes into it — integer overflow to heap overflow (CWE-190 → CWE-122).