**Zero-sized allocation for an unknown object type in yr_object_create**
The external variable types stored in a compiled rules file are never validated, so a crafted .yrc reaches yr_object_create with a type that matches no case and leaves object_size at 0, and the field writes right after the allocation land past the end of it. Both switches guarded this with assert only, which is compiled out under NDEBUG the way the projects in windows/ set it.