Catastrophic backtracking in regex engine causes infinite hang with some inputs

[RajathJayashankar]

• Some inputs ex: {: [: causes YAML::Load() to hang indefinitely
• The hang occurs in the regex engine during token scanning
• Stack trace shows deep recursion in MatchOpOr and MatchOpSeq
• This is a denial of service vulnerability for any application that processes untrusted YAML

to reproduce:

#include "yaml-cpp/yaml.h"
#include <sstream>

int main() {
    std::string input = "{:";
    std::stringstream ss(input);
    YAML::Node node = YAML::Load(ss);  // Hangs here indefinitely
    return 0;
}