Check for invalid merge

decode.go

@@ -660,7 +660,13 @@ func (d *decoder) mapping(n *node, out reflect.Value) (good bool) {
 	l := len(n.children)
 	for i := 0; i < l; i += 2 {
 		if isMerge(n.children[i]) {
+			if i+1 >= l {
+				failf("line %d, column %d: invalid merge, missing value", n.children[i].line+1, n.children[i].column)
+			}
 			d.merge(n.children[i+1], out)
+			if out.IsNil() {
+				failf("line %d, column %d: invalid null merge", n.children[i+1].line+1, n.children[i+1].column)
+			}
 			continue
 		}
 		k := reflect.New(kt).Elem()
@@ -672,6 +678,9 @@ func (d *decoder) mapping(n *node, out reflect.Value) (good bool) {
 			if kkind == reflect.Map || kkind == reflect.Slice {
 				failf("invalid map key: %#v", k.Interface())
 			}
+			if i+1 >= l {
+				failf("line %d, column %d: invalid mapping, missing value", n.children[i].line+1, n.children[i].column)
+			}
 			e := reflect.New(et).Elem()
 			if d.unmarshal(n.children[i+1], e) {
 				d.setMapIndex(n.children[i+1], out, k, e)

decode_test.go

@@ -1316,6 +1316,39 @@ func (s *S) TestFuzzCrashers(c *C) {
 	}
 }
 
+func (s *S) TestMergeErrors(c *C) {
+	cases := []struct {
+		name string
+		data string
+		err  string
+	}{
+		// Issue #529
+		{
+			name: `nil merge`,
+			data: `
+a: &8
+<<:
+ - *8
+
+8:
+( :
+ &8
+ *8:
+<<:
+ - *8
+`,
+			err: "yaml: line 4, column 1: invalid null merge",
+		},
+	}
+
+	for i, item := range cases {
+		v := map[string]interface{}{}
+		err := yaml.Unmarshal([]byte(item.data), &v)
+		c.Logf("test %d: %s", i, item.name)
+		c.Assert(err, ErrorMatches, item.err)
+	}
+}
+
 //var data []byte
 //func init() {
 //	var err error