GHSA-gfxp-f68g-8x78: LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

The analysis of the security advisory and the associated commits reveals that the vulnerability was introduced in version 0.0.4 of the libyml crate. The core of the vulnerability lies in the libyml::string::yaml_string_extend function, which was refactored in commit e9eef0466fd3761bebe8bce1b6d798697a1c7d3a. The revised implementation of this function introduces undefined behavior by using a pointer after it has been potentially deallocated by realloc. Specifically, the code calculates a pointer offset from a buffer that has just been reallocated, which is a classic use-after-free vulnerability. The function libyml::string::yaml_string_join is a primary caller of the vulnerable yaml_string_extend function, making it a key indicator that would appear in a runtime profile or stack trace during exploitation. The project was subsequently archived due to these soundness issues, and no patch is available.