fix(vdm): prevent crash on multi-fragment sentences and modernize CMake test [CVE-2026-56770] (#264)

Guards `VdmStream::AddLine` against malformed multi-fragment AIS messages with missing or out-of-bounds sequence numbers, resolving assertion failures and out-of-bounds array access vulnerabilities. Additionally, modernizes the CMake build system to support automated C++ unit testing and AddressSanitizer (ASan) instrumentation.

**VDM Stream & Vulnerability Fixes (`libais/vdm.cpp`, `test/vdm_test.cpp`)**

- Added boundary validation in `VdmStream::AddLine` to reject sentences with total sentence count exceeding `kMaxSentences` (10).
- Added validation for multi-fragment messages (`tot > 1`) to reject out-of-bounds sequence numbers (`seq >= kNumSequenceChannels` / `kNoSequenceNumber`), preventing buffer overflows when indexing `incoming_sentences_[seq]`.
- Fixed `assert(tot == 1 || seq < kNumSequenceChannels)` so that single-line messages (which default to `kNoSequenceNumber` / 999999) do not trigger assertion failures in Debug and ASan builds.
- Added unit test coverage in `TEST_F(VdmTest, OverRangeSequence)` to verify that multi-fragment NMEA strings with empty sequence IDs (e.g., `!AIVDM,2,1,,A,177KQ@,0*4E`) are rejected cleanly.

**CMake Build & Test Suite Modernization (`CMakeLists.txt`, `src/CMakeLists.txt`, `src/test/CMakeLists.txt`)**

- Added `set(CMAKE_POLICY_VERSION_MINIMUM "3.5")` to ensure compatibility between CMake 4.x and embedded GoogleTest/GoogleMock rules in `third_party/`.
- Corrected C++ standard feature detection flags to check `-std=c++17` and `-std=c++20` properly.
- Added `ENABLE_ASAN` option to compile and link with AddressSanitizer (`-fsanitize=address -g -fno-omit-frame-pointer`).
- Integrated CTest and created `src/test/CMakeLists.txt` to automatically build all 30 C++ unit tests linked against `gmock_main` with `-Wno-deprecated-copy` silenced for third-party headers.

**AIS 7/13 Stream Formatting (`src/libais/ais7_13.cpp`)**

- Added `operator<<` formatting for `Ais7_13` to output message ID and MMSI.

Fixes this existing CI build failure that produced the following assertion abort:

```
[----------] 7 tests from VdmTest
[ RUN      ] VdmTest.IgnoreNonAisMessages
vdm_test: vdm.cpp:325: bool libais::VdmStream::AddLine(const std::string&): Assertion `seq < kNumSequenceChannels' failed.
[       OK ] VdmTest.IgnoreNonAisMessages (0 ms)
[ RUN      ] VdmTest.SingleLineAisMessage
[       OK ] VdmTest.SingleLineAisMessage (0 ms)
[ RUN      ] VdmTest.QueueClean
Aborted (core dumped)
```

Based on the proposed fix by Google Jules in schwehr/libais-jules#20.

* Fixes #263
* Fixes https://nvd.nist.gov/vuln/detail/CVE-2026-56770

Author: schwehr

CMakeLists.txt

@@ -6,6 +6,7 @@
 # make
 
 cmake_minimum_required(VERSION 3.25)
+set(CMAKE_POLICY_VERSION_MINIMUM "3.5")
 project (
   libais
   DESCRIPTION "A library for parsing Automatic Identification System messages."
@@ -15,8 +16,8 @@ project (
 
 include(CheckCXXCompilerFlag)
 CHECK_CXX_COMPILER_FLAG("-std=c++14" COMPILER_SUPPORTS_CXX14)
-CHECK_CXX_COMPILER_FLAG("-std=c++14" COMPILER_SUPPORTS_CXX17)
-CHECK_CXX_COMPILER_FLAG("-std=c++14" COMPILER_SUPPORTS_CXX20)
+CHECK_CXX_COMPILER_FLAG("-std=c++17" COMPILER_SUPPORTS_CXX17)
+CHECK_CXX_COMPILER_FLAG("-std=c++20" COMPILER_SUPPORTS_CXX20)
 if(COMPILER_SUPPORTS_CXX20)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++20")
 elseif(COMPILER_SUPPORTS_CXX17)
@@ -27,6 +28,18 @@ else()
         message(STATUS "The compiler ${CMAKE_CXX_COMPILER} is too old. Please use a different C++ compiler.")
 endif()
 
+option(ENABLE_ASAN "Enable AddressSanitizer (ASan)" OFF)
+if(ENABLE_ASAN)
+    add_compile_options(-fsanitize=address -g -fno-omit-frame-pointer)
+    add_link_options(-fsanitize=address)
+endif()
+
+include(CTest)
+if(BUILD_TESTING)
+    add_compile_options(-Wno-deprecated-copy)
+    add_subdirectory(third_party/gmock)
+endif()
+
 # include_directories("${PROJECT_BINARY_DIR}/src/libais")
 
 add_subdirectory(src)

src/CMakeLists.txt

@@ -1 +1,4 @@
 add_subdirectory(libais)
+if(BUILD_TESTING)
+    add_subdirectory(test)
+endif()

src/libais/ais7_13.cpp

@@ -32,4 +32,8 @@ Ais7_13::Ais7_13(const char *nmea_payload, const size_t pad)
   status = AIS_OK;
 }
 
+std::ostream& operator<< (std::ostream &o, const Ais7_13 &msg) {
+  return o << msg.message_id << ": " << msg.mmsi;
+}
+
 }  // namespace libais

src/libais/vdm.cpp

@@ -321,12 +321,16 @@ bool VdmStream::AddLine(const std::string &line) {
   size_t const seq = sentence->sequence_number();
   size_t const tot = sentence->sentence_total();
 
-  // These are enforced by NmeaSentence, so only check when debugging.
-  assert(seq < kNumSequenceChannels);
-  assert(tot < kMaxSentences);
+  if (tot > kMaxSentences) {
+    return false;  // More sentences than allowed.
+  }
 
   // Convert multi-line message to single line.
   if (tot != 1) {
+    if (tot > 1 && seq > kNumSequenceChannels) {
+      return false;  // Sequence number is too large or empty (kNoSequenceNumber).
+    }
+
     size_t const cnt = sentence->sentence_number();
 
     // Beginning of a message.

src/test/CMakeLists.txt

@@ -0,0 +1,17 @@
+find_package(Threads REQUIRED)
+
+include_directories(
+    SYSTEM
+    ${CMAKE_SOURCE_DIR}/third_party/gmock/include
+    ${CMAKE_SOURCE_DIR}/third_party/gtest/include
+)
+
+file(GLOB TEST_SRCS "*_test.cpp")
+
+foreach(test_src ${TEST_SRCS})
+    get_filename_component(test_name ${test_src} NAME_WE)
+    add_executable(${test_name} ${test_src})
+    target_link_libraries(${test_name} PRIVATE ais gmock_main Threads::Threads)
+    target_compile_options(${test_name} PRIVATE -Wno-deprecated-copy)
+    add_test(NAME ${test_name} COMMAND ${test_name})
+endforeach()

src/test/vdm_test.cpp

@@ -467,9 +467,14 @@ TEST_F(VdmTest, ThreeLineAisMessage) {
 
 TEST_F(VdmTest, OverRangeSequence) {
   // The sequence number should be [0..9].  Reject others.
-  stream_.AddLine("!BSVDM,1,1,10,B,36So=l5000o?uF0K>pnpV0Nf0000,0*56");
+  EXPECT_FALSE(stream_.AddLine("!BSVDM,1,1,10,B,36So=l5000o?uF0K>pnpV0Nf0000,0*56"));
   auto ais_msg = stream_.PopOldestMessage();
   ASSERT_EQ(nullptr, ais_msg);
+
+  // Reject multi-fragment sentences with empty/missing sequence ID.
+  EXPECT_FALSE(stream_.AddLine("!AIVDM,2,1,,A,177KQ@,0*4E"));
+  ais_msg = stream_.PopOldestMessage();
+  ASSERT_EQ(nullptr, ais_msg);
 }
 
 }  // namespace