In function "read_yin_leaf", the value "retval->ext[r]" can be NULL. The operation "retval->ext[r]->flags" result in a crash

[zounathan]

<?xml  version="1.0" encoding="UTF-8"?>
<module name="empnt"
xmlns="urn:ietf:params:xml:ns:yang:yin:1"
  ec="urn:libyang:tests:emptycont">
  <yang-version value="1"/>
  <namespace uri="urn:libyag:tests:emptycont"/>
  <prefix value="eh"/>
  <revision date="2016-03-18"> <description>
  <text>initial revision</text>
    </description>
  </revision>
  <leaf name="tZpleaf">
    <type name="string"/>
  </leaf>
  <container name="top">
    <leaf name="a">
      <type name=                 "string"/>
    </leaf>
    <container name="b">
      <when condition="../../topleag"/>
      <leaf name="b1">
        <when condition="../.                                                                                            <                                                                                                                                                                                 /                                  *                                                                                                                                                                              
         /                                                               "
xmlns="urn:ietf:params:xml                                                                                                                    4                                                                                                                                     d                                                                                               |                                                                                    ./a"/> <type name="string"/>
      </leaf>
    </container>
    <container name="R">
      <presence value="test"/>
      <leaf name="c1">
        <when condition="../.*/a"/> <type name="string"/>
      </leaf>
    </container>
  </container>
</module>

[michalvasko]

Should be fixed.

[fredgan]

CVE-2021-28906 was assigned to this issue.