xref: /PHP-7.2/ext/pcre/pcrelib/pcre_compile.c (revision 7bf1f9d5)
1 /*************************************************
2 *      Perl-Compatible Regular Expressions       *
3 *************************************************/
4 
5 /* PCRE is a library of functions to support regular expressions whose syntax
6 and semantics are as close as possible to those of the Perl 5 language.
7 
8                        Written by Philip Hazel
9            Copyright (c) 1997-2016 University of Cambridge
10 
11 -----------------------------------------------------------------------------
12 Redistribution and use in source and binary forms, with or without
13 modification, are permitted provided that the following conditions are met:
14 
15     * Redistributions of source code must retain the above copyright notice,
16       this list of conditions and the following disclaimer.
17 
18     * Redistributions in binary form must reproduce the above copyright
19       notice, this list of conditions and the following disclaimer in the
20       documentation and/or other materials provided with the distribution.
21 
22     * Neither the name of the University of Cambridge nor the names of its
23       contributors may be used to endorse or promote products derived from
24       this software without specific prior written permission.
25 
26 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
27 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
30 LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31 CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32 SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33 INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36 POSSIBILITY OF SUCH DAMAGE.
37 -----------------------------------------------------------------------------
38 */
39 
40 
41 /* This module contains the external function pcre_compile(), along with
42 supporting internal functions that are not used by other modules. */
43 
44 
45 #ifdef HAVE_CONFIG_H
46 #include "config.h"
47 #endif
48 
49 #define NLBLOCK cd             /* Block containing newline information */
50 #define PSSTART start_pattern  /* Field containing pattern start */
51 #define PSEND   end_pattern    /* Field containing pattern end */
52 
53 #include "pcre_internal.h"
54 
55 
56 /* When PCRE_DEBUG is defined, we need the pcre(16|32)_printint() function, which
57 is also used by pcretest. PCRE_DEBUG is not defined when building a production
58 library. We do not need to select pcre16_printint.c specially, because the
59 COMPILE_PCREx macro will already be appropriately set. */
60 
61 #ifdef PCRE_DEBUG
62 /* pcre_printint.c should not include any headers */
63 #define PCRE_INCLUDED
64 #include "pcre_printint.c"
65 #undef PCRE_INCLUDED
66 #endif
67 
68 
69 /* Macro for setting individual bits in class bitmaps. */
70 
71 #define SETBIT(a,b) a[(b)/8] |= (1 << ((b)&7))
72 
73 /* Maximum length value to check against when making sure that the integer that
74 holds the compiled pattern length does not overflow. We make it a bit less than
75 INT_MAX to allow for adding in group terminating bytes, so that we don't have
76 to check them every time. */
77 
78 #define OFLOW_MAX (INT_MAX - 20)
79 
80 /* Definitions to allow mutual recursion */
81 
82 static int
83   add_list_to_class(pcre_uint8 *, pcre_uchar **, int, compile_data *,
84     const pcre_uint32 *, unsigned int);
85 
86 static BOOL
87   compile_regex(int, pcre_uchar **, const pcre_uchar **, int *, BOOL, BOOL, int, int,
88     pcre_uint32 *, pcre_int32 *, pcre_uint32 *, pcre_int32 *, branch_chain *,
89     compile_data *, int *);
90 
91 
92 
93 /*************************************************
94 *      Code parameters and static tables         *
95 *************************************************/
96 
97 /* This value specifies the size of stack workspace that is used during the
98 first pre-compile phase that determines how much memory is required. The regex
99 is partly compiled into this space, but the compiled parts are discarded as
100 soon as they can be, so that hopefully there will never be an overrun. The code
101 does, however, check for an overrun. The largest amount I've seen used is 218,
102 so this number is very generous.
103 
104 The same workspace is used during the second, actual compile phase for
105 remembering forward references to groups so that they can be filled in at the
106 end. Each entry in this list occupies LINK_SIZE bytes, so even when LINK_SIZE
107 is 4 there is plenty of room for most patterns. However, the memory can get
108 filled up by repetitions of forward references, for example patterns like
109 /(?1){0,1999}(b)/, and one user did hit the limit. The code has been changed so
110 that the workspace is expanded using malloc() in this situation. The value
111 below is therefore a minimum, and we put a maximum on it for safety. The
112 minimum is now also defined in terms of LINK_SIZE so that the use of malloc()
113 kicks in at the same number of forward references in all cases. */
114 
115 #define COMPILE_WORK_SIZE (2048*LINK_SIZE)
116 #define COMPILE_WORK_SIZE_MAX (100*COMPILE_WORK_SIZE)
117 
118 /* This value determines the size of the initial vector that is used for
119 remembering named groups during the pre-compile. It is allocated on the stack,
120 but if it is too small, it is expanded using malloc(), in a similar way to the
121 workspace. The value is the number of slots in the list. */
122 
123 #define NAMED_GROUP_LIST_SIZE  20
124 
125 /* The overrun tests check for a slightly smaller size so that they detect the
126 overrun before it actually does run off the end of the data block. */
127 
128 #define WORK_SIZE_SAFETY_MARGIN (100)
129 
130 /* Private flags added to firstchar and reqchar. */
131 
132 #define REQ_CASELESS    (1 << 0)        /* Indicates caselessness */
133 #define REQ_VARY        (1 << 1)        /* Reqchar followed non-literal item */
134 /* Negative values for the firstchar and reqchar flags */
135 #define REQ_UNSET       (-2)
136 #define REQ_NONE        (-1)
137 
138 /* Repeated character flags. */
139 
140 #define UTF_LENGTH     0x10000000l      /* The char contains its length. */
141 
142 /* Table for handling escaped characters in the range '0'-'z'. Positive returns
143 are simple data values; negative values are for special things like \d and so
144 on. Zero means further processing is needed (for things like \x), or the escape
145 is invalid. */
146 
147 #ifndef EBCDIC
148 
149 /* This is the "normal" table for ASCII systems or for EBCDIC systems running
150 in UTF-8 mode. */
151 
152 static const short int escapes[] = {
153      0,                       0,
154      0,                       0,
155      0,                       0,
156      0,                       0,
157      0,                       0,
158      CHAR_COLON,              CHAR_SEMICOLON,
159      CHAR_LESS_THAN_SIGN,     CHAR_EQUALS_SIGN,
160      CHAR_GREATER_THAN_SIGN,  CHAR_QUESTION_MARK,
161      CHAR_COMMERCIAL_AT,      -ESC_A,
162      -ESC_B,                  -ESC_C,
163      -ESC_D,                  -ESC_E,
164      0,                       -ESC_G,
165      -ESC_H,                  0,
166      0,                       -ESC_K,
167      0,                       0,
168      -ESC_N,                  0,
169      -ESC_P,                  -ESC_Q,
170      -ESC_R,                  -ESC_S,
171      0,                       0,
172      -ESC_V,                  -ESC_W,
173      -ESC_X,                  0,
174      -ESC_Z,                  CHAR_LEFT_SQUARE_BRACKET,
175      CHAR_BACKSLASH,          CHAR_RIGHT_SQUARE_BRACKET,
176      CHAR_CIRCUMFLEX_ACCENT,  CHAR_UNDERSCORE,
177      CHAR_GRAVE_ACCENT,       ESC_a,
178      -ESC_b,                  0,
179      -ESC_d,                  ESC_e,
180      ESC_f,                   0,
181      -ESC_h,                  0,
182      0,                       -ESC_k,
183      0,                       0,
184      ESC_n,                   0,
185      -ESC_p,                  0,
186      ESC_r,                   -ESC_s,
187      ESC_tee,                 0,
188      -ESC_v,                  -ESC_w,
189      0,                       0,
190      -ESC_z
191 };
192 
193 #else
194 
195 /* This is the "abnormal" table for EBCDIC systems without UTF-8 support. */
196 
197 static const short int escapes[] = {
198 /*  48 */     0,     0,      0,     '.',    '<',   '(',    '+',    '|',
199 /*  50 */   '&',     0,      0,       0,      0,     0,      0,      0,
200 /*  58 */     0,     0,    '!',     '$',    '*',   ')',    ';',    '~',
201 /*  60 */   '-',   '/',      0,       0,      0,     0,      0,      0,
202 /*  68 */     0,     0,    '|',     ',',    '%',   '_',    '>',    '?',
203 /*  70 */     0,     0,      0,       0,      0,     0,      0,      0,
204 /*  78 */     0,   '`',    ':',     '#',    '@',  '\'',    '=',    '"',
205 /*  80 */     0, ESC_a, -ESC_b,       0, -ESC_d, ESC_e,  ESC_f,      0,
206 /*  88 */-ESC_h,     0,      0,     '{',      0,     0,      0,      0,
207 /*  90 */     0,     0, -ESC_k,       0,      0, ESC_n,      0, -ESC_p,
208 /*  98 */     0, ESC_r,      0,     '}',      0,     0,      0,      0,
209 /*  A0 */     0,   '~', -ESC_s, ESC_tee,      0,-ESC_v, -ESC_w,      0,
210 /*  A8 */     0,-ESC_z,      0,       0,      0,   '[',      0,      0,
211 /*  B0 */     0,     0,      0,       0,      0,     0,      0,      0,
212 /*  B8 */     0,     0,      0,       0,      0,   ']',    '=',    '-',
213 /*  C0 */   '{',-ESC_A, -ESC_B,  -ESC_C, -ESC_D,-ESC_E,      0, -ESC_G,
214 /*  C8 */-ESC_H,     0,      0,       0,      0,     0,      0,      0,
215 /*  D0 */   '}',     0, -ESC_K,       0,      0,-ESC_N,      0, -ESC_P,
216 /*  D8 */-ESC_Q,-ESC_R,      0,       0,      0,     0,      0,      0,
217 /*  E0 */  '\\',     0, -ESC_S,       0,      0,-ESC_V, -ESC_W, -ESC_X,
218 /*  E8 */     0,-ESC_Z,      0,       0,      0,     0,      0,      0,
219 /*  F0 */     0,     0,      0,       0,      0,     0,      0,      0,
220 /*  F8 */     0,     0,      0,       0,      0,     0,      0,      0
221 };
222 
223 /* We also need a table of characters that may follow \c in an EBCDIC
224 environment for characters 0-31. */
225 
226 static unsigned char ebcdic_escape_c[] = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_";
227 
228 #endif
229 
230 
231 /* Table of special "verbs" like (*PRUNE). This is a short table, so it is
232 searched linearly. Put all the names into a single string, in order to reduce
233 the number of relocations when a shared library is dynamically linked. The
234 string is built from string macros so that it works in UTF-8 mode on EBCDIC
235 platforms. */
236 
237 typedef struct verbitem {
238   int   len;                 /* Length of verb name */
239   int   op;                  /* Op when no arg, or -1 if arg mandatory */
240   int   op_arg;              /* Op when arg present, or -1 if not allowed */
241 } verbitem;
242 
243 static const char verbnames[] =
244   "\0"                       /* Empty name is a shorthand for MARK */
245   STRING_MARK0
246   STRING_ACCEPT0
247   STRING_COMMIT0
248   STRING_F0
249   STRING_FAIL0
250   STRING_PRUNE0
251   STRING_SKIP0
252   STRING_THEN;
253 
254 static const verbitem verbs[] = {
255   { 0, -1,        OP_MARK },
256   { 4, -1,        OP_MARK },
257   { 6, OP_ACCEPT, -1 },
258   { 6, OP_COMMIT, -1 },
259   { 1, OP_FAIL,   -1 },
260   { 4, OP_FAIL,   -1 },
261   { 5, OP_PRUNE,  OP_PRUNE_ARG },
262   { 4, OP_SKIP,   OP_SKIP_ARG  },
263   { 4, OP_THEN,   OP_THEN_ARG  }
264 };
265 
266 static const int verbcount = sizeof(verbs)/sizeof(verbitem);
267 
268 
269 /* Substitutes for [[:<:]] and [[:>:]], which mean start and end of word in
270 another regex library. */
271 
272 static const pcre_uchar sub_start_of_word[] = {
273   CHAR_BACKSLASH, CHAR_b, CHAR_LEFT_PARENTHESIS, CHAR_QUESTION_MARK,
274   CHAR_EQUALS_SIGN, CHAR_BACKSLASH, CHAR_w, CHAR_RIGHT_PARENTHESIS, '\0' };
275 
276 static const pcre_uchar sub_end_of_word[] = {
277   CHAR_BACKSLASH, CHAR_b, CHAR_LEFT_PARENTHESIS, CHAR_QUESTION_MARK,
278   CHAR_LESS_THAN_SIGN, CHAR_EQUALS_SIGN, CHAR_BACKSLASH, CHAR_w,
279   CHAR_RIGHT_PARENTHESIS, '\0' };
280 
281 
282 /* Tables of names of POSIX character classes and their lengths. The names are
283 now all in a single string, to reduce the number of relocations when a shared
284 library is dynamically loaded. The list of lengths is terminated by a zero
285 length entry. The first three must be alpha, lower, upper, as this is assumed
286 for handling case independence. The indices for graph, print, and punct are
287 needed, so identify them. */
288 
289 static const char posix_names[] =
290   STRING_alpha0 STRING_lower0 STRING_upper0 STRING_alnum0
291   STRING_ascii0 STRING_blank0 STRING_cntrl0 STRING_digit0
292   STRING_graph0 STRING_print0 STRING_punct0 STRING_space0
293   STRING_word0  STRING_xdigit;
294 
295 static const pcre_uint8 posix_name_lengths[] = {
296   5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
297 
298 #define PC_GRAPH  8
299 #define PC_PRINT  9
300 #define PC_PUNCT 10
301 
302 
303 /* Table of class bit maps for each POSIX class. Each class is formed from a
304 base map, with an optional addition or removal of another map. Then, for some
305 classes, there is some additional tweaking: for [:blank:] the vertical space
306 characters are removed, and for [:alpha:] and [:alnum:] the underscore
307 character is removed. The triples in the table consist of the base map offset,
308 second map offset or -1 if no second map, and a non-negative value for map
309 addition or a negative value for map subtraction (if there are two maps). The
310 absolute value of the third field has these meanings: 0 => no tweaking, 1 =>
311 remove vertical space characters, 2 => remove underscore. */
312 
313 static const int posix_class_maps[] = {
314   cbit_word,  cbit_digit, -2,             /* alpha */
315   cbit_lower, -1,          0,             /* lower */
316   cbit_upper, -1,          0,             /* upper */
317   cbit_word,  -1,          2,             /* alnum - word without underscore */
318   cbit_print, cbit_cntrl,  0,             /* ascii */
319   cbit_space, -1,          1,             /* blank - a GNU extension */
320   cbit_cntrl, -1,          0,             /* cntrl */
321   cbit_digit, -1,          0,             /* digit */
322   cbit_graph, -1,          0,             /* graph */
323   cbit_print, -1,          0,             /* print */
324   cbit_punct, -1,          0,             /* punct */
325   cbit_space, -1,          0,             /* space */
326   cbit_word,  -1,          0,             /* word - a Perl extension */
327   cbit_xdigit,-1,          0              /* xdigit */
328 };
329 
330 /* Table of substitutes for \d etc when PCRE_UCP is set. They are replaced by
331 Unicode property escapes. */
332 
333 #ifdef SUPPORT_UCP
334 static const pcre_uchar string_PNd[]  = {
335   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
336   CHAR_N, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
337 static const pcre_uchar string_pNd[]  = {
338   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
339   CHAR_N, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
340 static const pcre_uchar string_PXsp[] = {
341   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
342   CHAR_X, CHAR_s, CHAR_p, CHAR_RIGHT_CURLY_BRACKET, '\0' };
343 static const pcre_uchar string_pXsp[] = {
344   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
345   CHAR_X, CHAR_s, CHAR_p, CHAR_RIGHT_CURLY_BRACKET, '\0' };
346 static const pcre_uchar string_PXwd[] = {
347   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
348   CHAR_X, CHAR_w, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
349 static const pcre_uchar string_pXwd[] = {
350   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
351   CHAR_X, CHAR_w, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
352 
353 static const pcre_uchar *substitutes[] = {
354   string_PNd,           /* \D */
355   string_pNd,           /* \d */
356   string_PXsp,          /* \S */   /* Xsp is Perl space, but from 8.34, Perl */
357   string_pXsp,          /* \s */   /* space and POSIX space are the same. */
358   string_PXwd,          /* \W */
359   string_pXwd           /* \w */
360 };
361 
362 /* The POSIX class substitutes must be in the order of the POSIX class names,
363 defined above, and there are both positive and negative cases. NULL means no
364 general substitute of a Unicode property escape (\p or \P). However, for some
365 POSIX classes (e.g. graph, print, punct) a special property code is compiled
366 directly. */
367 
368 static const pcre_uchar string_pL[] =   {
369   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
370   CHAR_L, CHAR_RIGHT_CURLY_BRACKET, '\0' };
371 static const pcre_uchar string_pLl[] =  {
372   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
373   CHAR_L, CHAR_l, CHAR_RIGHT_CURLY_BRACKET, '\0' };
374 static const pcre_uchar string_pLu[] =  {
375   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
376   CHAR_L, CHAR_u, CHAR_RIGHT_CURLY_BRACKET, '\0' };
377 static const pcre_uchar string_pXan[] = {
378   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
379   CHAR_X, CHAR_a, CHAR_n, CHAR_RIGHT_CURLY_BRACKET, '\0' };
380 static const pcre_uchar string_h[] =    {
381   CHAR_BACKSLASH, CHAR_h, '\0' };
382 static const pcre_uchar string_pXps[] = {
383   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
384   CHAR_X, CHAR_p, CHAR_s, CHAR_RIGHT_CURLY_BRACKET, '\0' };
385 static const pcre_uchar string_PL[] =   {
386   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
387   CHAR_L, CHAR_RIGHT_CURLY_BRACKET, '\0' };
388 static const pcre_uchar string_PLl[] =  {
389   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
390   CHAR_L, CHAR_l, CHAR_RIGHT_CURLY_BRACKET, '\0' };
391 static const pcre_uchar string_PLu[] =  {
392   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
393   CHAR_L, CHAR_u, CHAR_RIGHT_CURLY_BRACKET, '\0' };
394 static const pcre_uchar string_PXan[] = {
395   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
396   CHAR_X, CHAR_a, CHAR_n, CHAR_RIGHT_CURLY_BRACKET, '\0' };
397 static const pcre_uchar string_H[] =    {
398   CHAR_BACKSLASH, CHAR_H, '\0' };
399 static const pcre_uchar string_PXps[] = {
400   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
401   CHAR_X, CHAR_p, CHAR_s, CHAR_RIGHT_CURLY_BRACKET, '\0' };
402 
403 static const pcre_uchar *posix_substitutes[] = {
404   string_pL,            /* alpha */
405   string_pLl,           /* lower */
406   string_pLu,           /* upper */
407   string_pXan,          /* alnum */
408   NULL,                 /* ascii */
409   string_h,             /* blank */
410   NULL,                 /* cntrl */
411   string_pNd,           /* digit */
412   NULL,                 /* graph */
413   NULL,                 /* print */
414   NULL,                 /* punct */
415   string_pXps,          /* space */   /* Xps is POSIX space, but from 8.34 */
416   string_pXwd,          /* word  */   /* Perl and POSIX space are the same */
417   NULL,                 /* xdigit */
418   /* Negated cases */
419   string_PL,            /* ^alpha */
420   string_PLl,           /* ^lower */
421   string_PLu,           /* ^upper */
422   string_PXan,          /* ^alnum */
423   NULL,                 /* ^ascii */
424   string_H,             /* ^blank */
425   NULL,                 /* ^cntrl */
426   string_PNd,           /* ^digit */
427   NULL,                 /* ^graph */
428   NULL,                 /* ^print */
429   NULL,                 /* ^punct */
430   string_PXps,          /* ^space */  /* Xps is POSIX space, but from 8.34 */
431   string_PXwd,          /* ^word */   /* Perl and POSIX space are the same */
432   NULL                  /* ^xdigit */
433 };
434 #define POSIX_SUBSIZE (sizeof(posix_substitutes) / sizeof(pcre_uchar *))
435 #endif
436 
437 #define STRING(a)  # a
438 #define XSTRING(s) STRING(s)
439 
440 /* The texts of compile-time error messages. These are "char *" because they
441 are passed to the outside world. Do not ever re-use any error number, because
442 they are documented. Always add a new error instead. Messages marked DEAD below
443 are no longer used. This used to be a table of strings, but in order to reduce
444 the number of relocations needed when a shared library is loaded dynamically,
445 it is now one long string. We cannot use a table of offsets, because the
446 lengths of inserts such as XSTRING(MAX_NAME_SIZE) are not known. Instead, we
447 simply count through to the one we want - this isn't a performance issue
448 because these strings are used only when there is a compilation error.
449 
450 Each substring ends with \0 to insert a null character. This includes the final
451 substring, so that the whole string ends with \0\0, which can be detected when
452 counting through. */
453 
454 static const char error_texts[] =
455   "no error\0"
456   "\\ at end of pattern\0"
457   "\\c at end of pattern\0"
458   "unrecognized character follows \\\0"
459   "numbers out of order in {} quantifier\0"
460   /* 5 */
461   "number too big in {} quantifier\0"
462   "missing terminating ] for character class\0"
463   "invalid escape sequence in character class\0"
464   "range out of order in character class\0"
465   "nothing to repeat\0"
466   /* 10 */
467   "internal error: invalid forward reference offset\0"
468   "internal error: unexpected repeat\0"
469   "unrecognized character after (? or (?-\0"
470   "POSIX named classes are supported only within a class\0"
471   "missing )\0"
472   /* 15 */
473   "reference to non-existent subpattern\0"
474   "erroffset passed as NULL\0"
475   "unknown option bit(s) set\0"
476   "missing ) after comment\0"
477   "parentheses nested too deeply\0"  /** DEAD **/
478   /* 20 */
479   "regular expression is too large\0"
480   "failed to get memory\0"
481   "unmatched parentheses\0"
482   "internal error: code overflow\0"
483   "unrecognized character after (?<\0"
484   /* 25 */
485   "lookbehind assertion is not fixed length\0"
486   "malformed number or name after (?(\0"
487   "conditional group contains more than two branches\0"
488   "assertion expected after (?( or (?(?C)\0"
489   "(?R or (?[+-]digits must be followed by )\0"
490   /* 30 */
491   "unknown POSIX class name\0"
492   "POSIX collating elements are not supported\0"
493   "this version of PCRE is compiled without UTF support\0"
494   "spare error\0"  /** DEAD **/
495   "character value in \\x{} or \\o{} is too large\0"
496   /* 35 */
497   "invalid condition (?(0)\0"
498   "\\C not allowed in lookbehind assertion\0"
499   "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u\0"
500   "number after (?C is > 255\0"
501   "closing ) for (?C expected\0"
502   /* 40 */
503   "recursive call could loop indefinitely\0"
504   "unrecognized character after (?P\0"
505   "syntax error in subpattern name (missing terminator)\0"
506   "two named subpatterns have the same name\0"
507   "invalid UTF-8 string\0"
508   /* 45 */
509   "support for \\P, \\p, and \\X has not been compiled\0"
510   "malformed \\P or \\p sequence\0"
511   "unknown property name after \\P or \\p\0"
512   "subpattern name is too long (maximum " XSTRING(MAX_NAME_SIZE) " characters)\0"
513   "too many named subpatterns (maximum " XSTRING(MAX_NAME_COUNT) ")\0"
514   /* 50 */
515   "repeated subpattern is too long\0"    /** DEAD **/
516   "octal value is greater than \\377 in 8-bit non-UTF-8 mode\0"
517   "internal error: overran compiling workspace\0"
518   "internal error: previously-checked referenced subpattern not found\0"
519   "DEFINE group contains more than one branch\0"
520   /* 55 */
521   "repeating a DEFINE group is not allowed\0"  /** DEAD **/
522   "inconsistent NEWLINE options\0"
523   "\\g is not followed by a braced, angle-bracketed, or quoted name/number or by a plain number\0"
524   "a numbered reference must not be zero\0"
525   "an argument is not allowed for (*ACCEPT), (*FAIL), or (*COMMIT)\0"
526   /* 60 */
527   "(*VERB) not recognized or malformed\0"
528   "number is too big\0"
529   "subpattern name expected\0"
530   "digit expected after (?+\0"
531   "] is an invalid data character in JavaScript compatibility mode\0"
532   /* 65 */
533   "different names for subpatterns of the same number are not allowed\0"
534   "(*MARK) must have an argument\0"
535   "this version of PCRE is not compiled with Unicode property support\0"
536 #ifndef EBCDIC
537   "\\c must be followed by an ASCII character\0"
538 #else
539   "\\c must be followed by a letter or one of [\\]^_?\0"
540 #endif
541   "\\k is not followed by a braced, angle-bracketed, or quoted name\0"
542   /* 70 */
543   "internal error: unknown opcode in find_fixedlength()\0"
544   "\\N is not supported in a class\0"
545   "too many forward references\0"
546   "disallowed Unicode code point (>= 0xd800 && <= 0xdfff)\0"
547   "invalid UTF-16 string\0"
548   /* 75 */
549   "name is too long in (*MARK), (*PRUNE), (*SKIP), or (*THEN)\0"
550   "character value in \\u.... sequence is too large\0"
551   "invalid UTF-32 string\0"
552   "setting UTF is disabled by the application\0"
553   "non-hex character in \\x{} (closing brace missing?)\0"
554   /* 80 */
555   "non-octal character in \\o{} (closing brace missing?)\0"
556   "missing opening brace after \\o\0"
557   "parentheses are too deeply nested\0"
558   "invalid range in character class\0"
559   "group name must start with a non-digit\0"
560   /* 85 */
561   "parentheses are too deeply nested (stack check)\0"
562   "digits missing in \\x{} or \\o{}\0"
563   "regular expression is too complicated\0"
564   ;
565 
566 /* Table to identify digits and hex digits. This is used when compiling
567 patterns. Note that the tables in chartables are dependent on the locale, and
568 may mark arbitrary characters as digits - but the PCRE compiling code expects
569 to handle only 0-9, a-z, and A-Z as digits when compiling. That is why we have
570 a private table here. It costs 256 bytes, but it is a lot faster than doing
571 character value tests (at least in some simple cases I timed), and in some
572 applications one wants PCRE to compile efficiently as well as match
573 efficiently.
574 
575 For convenience, we use the same bit definitions as in chartables:
576 
577   0x04   decimal digit
578   0x08   hexadecimal digit
579 
580 Then we can use ctype_digit and ctype_xdigit in the code. */
581 
582 /* Using a simple comparison for decimal numbers rather than a memory read
583 is much faster, and the resulting code is simpler (the compiler turns it
584 into a subtraction and unsigned comparison). */
585 
586 #define IS_DIGIT(x) ((x) >= CHAR_0 && (x) <= CHAR_9)
587 
588 #ifndef EBCDIC
589 
590 /* This is the "normal" case, for ASCII systems, and EBCDIC systems running in
591 UTF-8 mode. */
592 
593 static const pcre_uint8 digitab[] =
594   {
595   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   0-  7 */
596   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   8- 15 */
597   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  16- 23 */
598   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  24- 31 */
599   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*    - '  */
600   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  ( - /  */
601   0x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c, /*  0 - 7  */
602   0x0c,0x0c,0x00,0x00,0x00,0x00,0x00,0x00, /*  8 - ?  */
603   0x00,0x08,0x08,0x08,0x08,0x08,0x08,0x00, /*  @ - G  */
604   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  H - O  */
605   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  P - W  */
606   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  X - _  */
607   0x00,0x08,0x08,0x08,0x08,0x08,0x08,0x00, /*  ` - g  */
608   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  h - o  */
609   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  p - w  */
610   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  x -127 */
611   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 128-135 */
612   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 136-143 */
613   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 144-151 */
614   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 152-159 */
615   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 160-167 */
616   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 168-175 */
617   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 176-183 */
618   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 184-191 */
619   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 192-199 */
620   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 200-207 */
621   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 208-215 */
622   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 216-223 */
623   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 224-231 */
624   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 232-239 */
625   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 240-247 */
626   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};/* 248-255 */
627 
628 #else
629 
630 /* This is the "abnormal" case, for EBCDIC systems not running in UTF-8 mode. */
631 
632 static const pcre_uint8 digitab[] =
633   {
634   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   0-  7  0 */
635   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   8- 15    */
636   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  16- 23 10 */
637   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  24- 31    */
638   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  32- 39 20 */
639   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  40- 47    */
640   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  48- 55 30 */
641   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  56- 63    */
642   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*    - 71 40 */
643   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  72- |     */
644   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  & - 87 50 */
645   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  88- 95    */
646   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  - -103 60 */
647   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 104- ?     */
648   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 112-119 70 */
649   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 120- "     */
650   0x00,0x08,0x08,0x08,0x08,0x08,0x08,0x00, /* 128- g  80 */
651   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  h -143    */
652   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 144- p  90 */
653   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  q -159    */
654   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 160- x  A0 */
655   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  y -175    */
656   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  ^ -183 B0 */
657   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 184-191    */
658   0x00,0x08,0x08,0x08,0x08,0x08,0x08,0x00, /*  { - G  C0 */
659   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  H -207    */
660   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  } - P  D0 */
661   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  Q -223    */
662   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  \ - X  E0 */
663   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  Y -239    */
664   0x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c, /*  0 - 7  F0 */
665   0x0c,0x0c,0x00,0x00,0x00,0x00,0x00,0x00};/*  8 -255    */
666 
667 static const pcre_uint8 ebcdic_chartab[] = { /* chartable partial dup */
668   0x80,0x00,0x00,0x00,0x00,0x01,0x00,0x00, /*   0-  7 */
669   0x00,0x00,0x00,0x00,0x01,0x01,0x00,0x00, /*   8- 15 */
670   0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00, /*  16- 23 */
671   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  24- 31 */
672   0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00, /*  32- 39 */
673   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  40- 47 */
674   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  48- 55 */
675   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  56- 63 */
676   0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*    - 71 */
677   0x00,0x00,0x00,0x80,0x00,0x80,0x80,0x80, /*  72- |  */
678   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  & - 87 */
679   0x00,0x00,0x00,0x80,0x80,0x80,0x00,0x00, /*  88- 95 */
680   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  - -103 */
681   0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x80, /* 104- ?  */
682   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 112-119 */
683   0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* 120- "  */
684   0x00,0x1a,0x1a,0x1a,0x1a,0x1a,0x1a,0x12, /* 128- g  */
685   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  h -143 */
686   0x00,0x12,0x12,0x12,0x12,0x12,0x12,0x12, /* 144- p  */
687   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  q -159 */
688   0x00,0x00,0x12,0x12,0x12,0x12,0x12,0x12, /* 160- x  */
689   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  y -175 */
690   0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  ^ -183 */
691   0x00,0x00,0x80,0x00,0x00,0x00,0x00,0x00, /* 184-191 */
692   0x80,0x1a,0x1a,0x1a,0x1a,0x1a,0x1a,0x12, /*  { - G  */
693   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  H -207 */
694   0x00,0x12,0x12,0x12,0x12,0x12,0x12,0x12, /*  } - P  */
695   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  Q -223 */
696   0x00,0x00,0x12,0x12,0x12,0x12,0x12,0x12, /*  \ - X  */
697   0x12,0x12,0x00,0x00,0x00,0x00,0x00,0x00, /*  Y -239 */
698   0x1c,0x1c,0x1c,0x1c,0x1c,0x1c,0x1c,0x1c, /*  0 - 7  */
699   0x1c,0x1c,0x00,0x00,0x00,0x00,0x00,0x00};/*  8 -255 */
700 #endif
701 
702 
703 /* This table is used to check whether auto-possessification is possible
704 between adjacent character-type opcodes. The left-hand (repeated) opcode is
705 used to select the row, and the right-hand opcode is use to select the column.
706 A value of 1 means that auto-possessification is OK. For example, the second
707 value in the first row means that \D+\d can be turned into \D++\d.
708 
709 The Unicode property types (\P and \p) have to be present to fill out the table
710 because of what their opcode values are, but the table values should always be
711 zero because property types are handled separately in the code. The last four
712 columns apply to items that cannot be repeated, so there is no need to have
713 rows for them. Note that OP_DIGIT etc. are generated only when PCRE_UCP is
714 *not* set. When it is set, \d etc. are converted into OP_(NOT_)PROP codes. */
715 
716 #define APTROWS (LAST_AUTOTAB_LEFT_OP - FIRST_AUTOTAB_OP + 1)
717 #define APTCOLS (LAST_AUTOTAB_RIGHT_OP - FIRST_AUTOTAB_OP + 1)
718 
719 static const pcre_uint8 autoposstab[APTROWS][APTCOLS] = {
720 /* \D \d \S \s \W \w  . .+ \C \P \p \R \H \h \V \v \X \Z \z  $ $M */
721   { 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \D */
722   { 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \d */
723   { 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \S */
724   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \s */
725   { 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \W */
726   { 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \w */
727   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* .  */
728   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* .+ */
729   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \C */
730   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },  /* \P */
731   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },  /* \p */
732   { 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0 },  /* \R */
733   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0 },  /* \H */
734   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0 },  /* \h */
735   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0 },  /* \V */
736   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0 },  /* \v */
737   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 }   /* \X */
738 };
739 
740 
741 /* This table is used to check whether auto-possessification is possible
742 between adjacent Unicode property opcodes (OP_PROP and OP_NOTPROP). The
743 left-hand (repeated) opcode is used to select the row, and the right-hand
744 opcode is used to select the column. The values are as follows:
745 
746   0   Always return FALSE (never auto-possessify)
747   1   Character groups are distinct (possessify if both are OP_PROP)
748   2   Check character categories in the same group (general or particular)
749   3   TRUE if the two opcodes are not the same (PROP vs NOTPROP)
750 
751   4   Check left general category vs right particular category
752   5   Check right general category vs left particular category
753 
754   6   Left alphanum vs right general category
755   7   Left space vs right general category
756   8   Left word vs right general category
757 
758   9   Right alphanum vs left general category
759  10   Right space vs left general category
760  11   Right word vs left general category
761 
762  12   Left alphanum vs right particular category
763  13   Left space vs right particular category
764  14   Left word vs right particular category
765 
766  15   Right alphanum vs left particular category
767  16   Right space vs left particular category
768  17   Right word vs left particular category
769 */
770 
771 static const pcre_uint8 propposstab[PT_TABSIZE][PT_TABSIZE] = {
772 /* ANY LAMP GC  PC  SC ALNUM SPACE PXSPACE WORD CLIST UCNC */
773   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   0 },  /* PT_ANY */
774   { 0,  3,  0,  0,  0,    3,    1,      1,   0,    0,   0 },  /* PT_LAMP */
775   { 0,  0,  2,  4,  0,    9,   10,     10,  11,    0,   0 },  /* PT_GC */
776   { 0,  0,  5,  2,  0,   15,   16,     16,  17,    0,   0 },  /* PT_PC */
777   { 0,  0,  0,  0,  2,    0,    0,      0,   0,    0,   0 },  /* PT_SC */
778   { 0,  3,  6, 12,  0,    3,    1,      1,   0,    0,   0 },  /* PT_ALNUM */
779   { 0,  1,  7, 13,  0,    1,    3,      3,   1,    0,   0 },  /* PT_SPACE */
780   { 0,  1,  7, 13,  0,    1,    3,      3,   1,    0,   0 },  /* PT_PXSPACE */
781   { 0,  0,  8, 14,  0,    0,    1,      1,   3,    0,   0 },  /* PT_WORD */
782   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   0 },  /* PT_CLIST */
783   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   3 }   /* PT_UCNC */
784 };
785 
786 /* This table is used to check whether auto-possessification is possible
787 between adjacent Unicode property opcodes (OP_PROP and OP_NOTPROP) when one
788 specifies a general category and the other specifies a particular category. The
789 row is selected by the general category and the column by the particular
790 category. The value is 1 if the particular category is not part of the general
791 category. */
792 
793 static const pcre_uint8 catposstab[7][30] = {
794 /* Cc Cf Cn Co Cs Ll Lm Lo Lt Lu Mc Me Mn Nd Nl No Pc Pd Pe Pf Pi Po Ps Sc Sk Sm So Zl Zp Zs */
795   { 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* C */
796   { 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* L */
797   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* M */
798   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* N */
799   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1 },  /* P */
800   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1 },  /* S */
801   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0 }   /* Z */
802 };
803 
804 /* This table is used when checking ALNUM, (PX)SPACE, SPACE, and WORD against
805 a general or particular category. The properties in each row are those
806 that apply to the character set in question. Duplication means that a little
807 unnecessary work is done when checking, but this keeps things much simpler
808 because they can all use the same code. For more details see the comment where
809 this table is used.
810 
811 Note: SPACE and PXSPACE used to be different because Perl excluded VT from
812 "space", but from Perl 5.18 it's included, so both categories are treated the
813 same here. */
814 
815 static const pcre_uint8 posspropstab[3][4] = {
816   { ucp_L, ucp_N, ucp_N, ucp_Nl },  /* ALNUM, 3rd and 4th values redundant */
817   { ucp_Z, ucp_Z, ucp_C, ucp_Cc },  /* SPACE and PXSPACE, 2nd value redundant */
818   { ucp_L, ucp_N, ucp_P, ucp_Po }   /* WORD */
819 };
820 
821 /* This table is used when converting repeating opcodes into possessified
822 versions as a result of an explicit possessive quantifier such as ++. A zero
823 value means there is no possessified version - in those cases the item in
824 question must be wrapped in ONCE brackets. The table is truncated at OP_CALLOUT
825 because all relevant opcodes are less than that. */
826 
827 static const pcre_uint8 opcode_possessify[] = {
828   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,   /* 0 - 15  */
829   0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,   /* 16 - 31 */
830 
831   0,                       /* NOTI */
832   OP_POSSTAR, 0,           /* STAR, MINSTAR */
833   OP_POSPLUS, 0,           /* PLUS, MINPLUS */
834   OP_POSQUERY, 0,          /* QUERY, MINQUERY */
835   OP_POSUPTO, 0,           /* UPTO, MINUPTO */
836   0,                       /* EXACT */
837   0, 0, 0, 0,              /* POS{STAR,PLUS,QUERY,UPTO} */
838 
839   OP_POSSTARI, 0,          /* STARI, MINSTARI */
840   OP_POSPLUSI, 0,          /* PLUSI, MINPLUSI */
841   OP_POSQUERYI, 0,         /* QUERYI, MINQUERYI */
842   OP_POSUPTOI, 0,          /* UPTOI, MINUPTOI */
843   0,                       /* EXACTI */
844   0, 0, 0, 0,              /* POS{STARI,PLUSI,QUERYI,UPTOI} */
845 
846   OP_NOTPOSSTAR, 0,        /* NOTSTAR, NOTMINSTAR */
847   OP_NOTPOSPLUS, 0,        /* NOTPLUS, NOTMINPLUS */
848   OP_NOTPOSQUERY, 0,       /* NOTQUERY, NOTMINQUERY */
849   OP_NOTPOSUPTO, 0,        /* NOTUPTO, NOTMINUPTO */
850   0,                       /* NOTEXACT */
851   0, 0, 0, 0,              /* NOTPOS{STAR,PLUS,QUERY,UPTO} */
852 
853   OP_NOTPOSSTARI, 0,       /* NOTSTARI, NOTMINSTARI */
854   OP_NOTPOSPLUSI, 0,       /* NOTPLUSI, NOTMINPLUSI */
855   OP_NOTPOSQUERYI, 0,      /* NOTQUERYI, NOTMINQUERYI */
856   OP_NOTPOSUPTOI, 0,       /* NOTUPTOI, NOTMINUPTOI */
857   0,                       /* NOTEXACTI */
858   0, 0, 0, 0,              /* NOTPOS{STARI,PLUSI,QUERYI,UPTOI} */
859 
860   OP_TYPEPOSSTAR, 0,       /* TYPESTAR, TYPEMINSTAR */
861   OP_TYPEPOSPLUS, 0,       /* TYPEPLUS, TYPEMINPLUS */
862   OP_TYPEPOSQUERY, 0,      /* TYPEQUERY, TYPEMINQUERY */
863   OP_TYPEPOSUPTO, 0,       /* TYPEUPTO, TYPEMINUPTO */
864   0,                       /* TYPEEXACT */
865   0, 0, 0, 0,              /* TYPEPOS{STAR,PLUS,QUERY,UPTO} */
866 
867   OP_CRPOSSTAR, 0,         /* CRSTAR, CRMINSTAR */
868   OP_CRPOSPLUS, 0,         /* CRPLUS, CRMINPLUS */
869   OP_CRPOSQUERY, 0,        /* CRQUERY, CRMINQUERY */
870   OP_CRPOSRANGE, 0,        /* CRRANGE, CRMINRANGE */
871   0, 0, 0, 0,              /* CRPOS{STAR,PLUS,QUERY,RANGE} */
872 
873   0, 0, 0,                 /* CLASS, NCLASS, XCLASS */
874   0, 0,                    /* REF, REFI */
875   0, 0,                    /* DNREF, DNREFI */
876   0, 0                     /* RECURSE, CALLOUT */
877 };
878 
879 
880 
881 /*************************************************
882 *            Find an error text                  *
883 *************************************************/
884 
885 /* The error texts are now all in one long string, to save on relocations. As
886 some of the text is of unknown length, we can't use a table of offsets.
887 Instead, just count through the strings. This is not a performance issue
888 because it happens only when there has been a compilation error.
889 
890 Argument:   the error number
891 Returns:    pointer to the error string
892 */
893 
894 static const char *
find_error_text(int n)895 find_error_text(int n)
896 {
897 const char *s = error_texts;
898 for (; n > 0; n--)
899   {
900   while (*s++ != CHAR_NULL) {};
901   if (*s == CHAR_NULL) return "Error text not found (please report)";
902   }
903 return s;
904 }
905 
906 
907 
908 /*************************************************
909 *           Expand the workspace                 *
910 *************************************************/
911 
912 /* This function is called during the second compiling phase, if the number of
913 forward references fills the existing workspace, which is originally a block on
914 the stack. A larger block is obtained from malloc() unless the ultimate limit
915 has been reached or the increase will be rather small.
916 
917 Argument: pointer to the compile data block
918 Returns:  0 if all went well, else an error number
919 */
920 
921 static int
expand_workspace(compile_data * cd)922 expand_workspace(compile_data *cd)
923 {
924 pcre_uchar *newspace;
925 int newsize = cd->workspace_size * 2;
926 
927 if (newsize > COMPILE_WORK_SIZE_MAX) newsize = COMPILE_WORK_SIZE_MAX;
928 if (cd->workspace_size >= COMPILE_WORK_SIZE_MAX ||
929     newsize - cd->workspace_size < WORK_SIZE_SAFETY_MARGIN)
930  return ERR72;
931 
932 newspace = (PUBL(malloc))(IN_UCHARS(newsize));
933 if (newspace == NULL) return ERR21;
934 memcpy(newspace, cd->start_workspace, cd->workspace_size * sizeof(pcre_uchar));
935 cd->hwm = (pcre_uchar *)newspace + (cd->hwm - cd->start_workspace);
936 if (cd->workspace_size > COMPILE_WORK_SIZE)
937   (PUBL(free))((void *)cd->start_workspace);
938 cd->start_workspace = newspace;
939 cd->workspace_size = newsize;
940 return 0;
941 }
942 
943 
944 
945 /*************************************************
946 *            Check for counted repeat            *
947 *************************************************/
948 
949 /* This function is called when a '{' is encountered in a place where it might
950 start a quantifier. It looks ahead to see if it really is a quantifier or not.
951 It is only a quantifier if it is one of the forms {ddd} {ddd,} or {ddd,ddd}
952 where the ddds are digits.
953 
954 Arguments:
955   p         pointer to the first char after '{'
956 
957 Returns:    TRUE or FALSE
958 */
959 
960 static BOOL
is_counted_repeat(const pcre_uchar * p)961 is_counted_repeat(const pcre_uchar *p)
962 {
963 if (!IS_DIGIT(*p)) return FALSE;
964 p++;
965 while (IS_DIGIT(*p)) p++;
966 if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
967 
968 if (*p++ != CHAR_COMMA) return FALSE;
969 if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
970 
971 if (!IS_DIGIT(*p)) return FALSE;
972 p++;
973 while (IS_DIGIT(*p)) p++;
974 
975 return (*p == CHAR_RIGHT_CURLY_BRACKET);
976 }
977 
978 
979 
980 /*************************************************
981 *            Handle escapes                      *
982 *************************************************/
983 
984 /* This function is called when a \ has been encountered. It either returns a
985 positive value for a simple escape such as \n, or 0 for a data character which
986 will be placed in chptr. A backreference to group n is returned as negative n.
987 When UTF-8 is enabled, a positive value greater than 255 may be returned in
988 chptr. On entry, ptr is pointing at the \. On exit, it is on the final
989 character of the escape sequence.
990 
991 Arguments:
992   ptrptr         points to the pattern position pointer
993   chptr          points to a returned data character
994   errorcodeptr   points to the errorcode variable
995   bracount       number of previous extracting brackets
996   options        the options bits
997   isclass        TRUE if inside a character class
998 
999 Returns:         zero => a data character
1000                  positive => a special escape sequence
1001                  negative => a back reference
1002                  on error, errorcodeptr is set
1003 */
1004 
1005 static int
check_escape(const pcre_uchar ** ptrptr,pcre_uint32 * chptr,int * errorcodeptr,int bracount,int options,BOOL isclass)1006 check_escape(const pcre_uchar **ptrptr, pcre_uint32 *chptr, int *errorcodeptr,
1007   int bracount, int options, BOOL isclass)
1008 {
1009 /* PCRE_UTF16 has the same value as PCRE_UTF8. */
1010 BOOL utf = (options & PCRE_UTF8) != 0;
1011 const pcre_uchar *ptr = *ptrptr + 1;
1012 pcre_uint32 c;
1013 int escape = 0;
1014 int i;
1015 
1016 GETCHARINCTEST(c, ptr);           /* Get character value, increment pointer */
1017 ptr--;                            /* Set pointer back to the last byte */
1018 
1019 /* If backslash is at the end of the pattern, it's an error. */
1020 
1021 if (c == CHAR_NULL) *errorcodeptr = ERR1;
1022 
1023 /* Non-alphanumerics are literals. For digits or letters, do an initial lookup
1024 in a table. A non-zero result is something that can be returned immediately.
1025 Otherwise further processing may be required. */
1026 
1027 #ifndef EBCDIC  /* ASCII/UTF-8 coding */
1028 /* Not alphanumeric */
1029 else if (c < CHAR_0 || c > CHAR_z) {}
1030 else if ((i = escapes[c - CHAR_0]) != 0)
1031   { if (i > 0) c = (pcre_uint32)i; else escape = -i; }
1032 
1033 #else           /* EBCDIC coding */
1034 /* Not alphanumeric */
1035 else if (c < CHAR_a || (!MAX_255(c) || (ebcdic_chartab[c] & 0x0E) == 0)) {}
1036 else if ((i = escapes[c - 0x48]) != 0)  { if (i > 0) c = (pcre_uint32)i; else escape = -i; }
1037 #endif
1038 
1039 /* Escapes that need further processing, or are illegal. */
1040 
1041 else
1042   {
1043   const pcre_uchar *oldptr;
1044   BOOL braced, negated, overflow;
1045   int s;
1046 
1047   switch (c)
1048     {
1049     /* A number of Perl escapes are not handled by PCRE. We give an explicit
1050     error. */
1051 
1052     case CHAR_l:
1053     case CHAR_L:
1054     *errorcodeptr = ERR37;
1055     break;
1056 
1057     case CHAR_u:
1058     if ((options & PCRE_JAVASCRIPT_COMPAT) != 0)
1059       {
1060       /* In JavaScript, \u must be followed by four hexadecimal numbers.
1061       Otherwise it is a lowercase u letter. */
1062       if (MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0
1063         && MAX_255(ptr[2]) && (digitab[ptr[2]] & ctype_xdigit) != 0
1064         && MAX_255(ptr[3]) && (digitab[ptr[3]] & ctype_xdigit) != 0
1065         && MAX_255(ptr[4]) && (digitab[ptr[4]] & ctype_xdigit) != 0)
1066         {
1067         c = 0;
1068         for (i = 0; i < 4; ++i)
1069           {
1070           register pcre_uint32 cc = *(++ptr);
1071 #ifndef EBCDIC  /* ASCII/UTF-8 coding */
1072           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
1073           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
1074 #else           /* EBCDIC coding */
1075           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
1076           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
1077 #endif
1078           }
1079 
1080 #if defined COMPILE_PCRE8
1081         if (c > (utf ? 0x10ffffU : 0xffU))
1082 #elif defined COMPILE_PCRE16
1083         if (c > (utf ? 0x10ffffU : 0xffffU))
1084 #elif defined COMPILE_PCRE32
1085         if (utf && c > 0x10ffffU)
1086 #endif
1087           {
1088           *errorcodeptr = ERR76;
1089           }
1090         else if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
1091         }
1092       }
1093     else
1094       *errorcodeptr = ERR37;
1095     break;
1096 
1097     case CHAR_U:
1098     /* In JavaScript, \U is an uppercase U letter. */
1099     if ((options & PCRE_JAVASCRIPT_COMPAT) == 0) *errorcodeptr = ERR37;
1100     break;
1101 
1102     /* In a character class, \g is just a literal "g". Outside a character
1103     class, \g must be followed by one of a number of specific things:
1104 
1105     (1) A number, either plain or braced. If positive, it is an absolute
1106     backreference. If negative, it is a relative backreference. This is a Perl
1107     5.10 feature.
1108 
1109     (2) Perl 5.10 also supports \g{name} as a reference to a named group. This
1110     is part of Perl's movement towards a unified syntax for back references. As
1111     this is synonymous with \k{name}, we fudge it up by pretending it really
1112     was \k.
1113 
1114     (3) For Oniguruma compatibility we also support \g followed by a name or a
1115     number either in angle brackets or in single quotes. However, these are
1116     (possibly recursive) subroutine calls, _not_ backreferences. Just return
1117     the ESC_g code (cf \k). */
1118 
1119     case CHAR_g:
1120     if (isclass) break;
1121     if (ptr[1] == CHAR_LESS_THAN_SIGN || ptr[1] == CHAR_APOSTROPHE)
1122       {
1123       escape = ESC_g;
1124       break;
1125       }
1126 
1127     /* Handle the Perl-compatible cases */
1128 
1129     if (ptr[1] == CHAR_LEFT_CURLY_BRACKET)
1130       {
1131       const pcre_uchar *p;
1132       for (p = ptr+2; *p != CHAR_NULL && *p != CHAR_RIGHT_CURLY_BRACKET; p++)
1133         if (*p != CHAR_MINUS && !IS_DIGIT(*p)) break;
1134       if (*p != CHAR_NULL && *p != CHAR_RIGHT_CURLY_BRACKET)
1135         {
1136         escape = ESC_k;
1137         break;
1138         }
1139       braced = TRUE;
1140       ptr++;
1141       }
1142     else braced = FALSE;
1143 
1144     if (ptr[1] == CHAR_MINUS)
1145       {
1146       negated = TRUE;
1147       ptr++;
1148       }
1149     else negated = FALSE;
1150 
1151     /* The integer range is limited by the machine's int representation. */
1152     s = 0;
1153     overflow = FALSE;
1154     while (IS_DIGIT(ptr[1]))
1155       {
1156       if (s > INT_MAX / 10 - 1) /* Integer overflow */
1157         {
1158         overflow = TRUE;
1159         break;
1160         }
1161       s = s * 10 + (int)(*(++ptr) - CHAR_0);
1162       }
1163     if (overflow) /* Integer overflow */
1164       {
1165       while (IS_DIGIT(ptr[1]))
1166         ptr++;
1167       *errorcodeptr = ERR61;
1168       break;
1169       }
1170 
1171     if (braced && *(++ptr) != CHAR_RIGHT_CURLY_BRACKET)
1172       {
1173       *errorcodeptr = ERR57;
1174       break;
1175       }
1176 
1177     if (s == 0)
1178       {
1179       *errorcodeptr = ERR58;
1180       break;
1181       }
1182 
1183     if (negated)
1184       {
1185       if (s > bracount)
1186         {
1187         *errorcodeptr = ERR15;
1188         break;
1189         }
1190       s = bracount - (s - 1);
1191       }
1192 
1193     escape = -s;
1194     break;
1195 
1196     /* The handling of escape sequences consisting of a string of digits
1197     starting with one that is not zero is not straightforward. Perl has changed
1198     over the years. Nowadays \g{} for backreferences and \o{} for octal are
1199     recommended to avoid the ambiguities in the old syntax.
1200 
1201     Outside a character class, the digits are read as a decimal number. If the
1202     number is less than 8 (used to be 10), or if there are that many previous
1203     extracting left brackets, then it is a back reference. Otherwise, up to
1204     three octal digits are read to form an escaped byte. Thus \123 is likely to
1205     be octal 123 (cf \0123, which is octal 012 followed by the literal 3). If
1206     the octal value is greater than 377, the least significant 8 bits are
1207     taken. \8 and \9 are treated as the literal characters 8 and 9.
1208 
1209     Inside a character class, \ followed by a digit is always either a literal
1210     8 or 9 or an octal number. */
1211 
1212     case CHAR_1: case CHAR_2: case CHAR_3: case CHAR_4: case CHAR_5:
1213     case CHAR_6: case CHAR_7: case CHAR_8: case CHAR_9:
1214 
1215     if (!isclass)
1216       {
1217       oldptr = ptr;
1218       /* The integer range is limited by the machine's int representation. */
1219       s = (int)(c -CHAR_0);
1220       overflow = FALSE;
1221       while (IS_DIGIT(ptr[1]))
1222         {
1223         if (s > INT_MAX / 10 - 1) /* Integer overflow */
1224           {
1225           overflow = TRUE;
1226           break;
1227           }
1228         s = s * 10 + (int)(*(++ptr) - CHAR_0);
1229         }
1230       if (overflow) /* Integer overflow */
1231         {
1232         while (IS_DIGIT(ptr[1]))
1233           ptr++;
1234         *errorcodeptr = ERR61;
1235         break;
1236         }
1237       if (s < 8 || s <= bracount)  /* Check for back reference */
1238         {
1239         escape = -s;
1240         break;
1241         }
1242       ptr = oldptr;      /* Put the pointer back and fall through */
1243       }
1244 
1245     /* Handle a digit following \ when the number is not a back reference. If
1246     the first digit is 8 or 9, Perl used to generate a binary zero byte and
1247     then treat the digit as a following literal. At least by Perl 5.18 this
1248     changed so as not to insert the binary zero. */
1249 
1250     if ((c = *ptr) >= CHAR_8) break;
1251 
1252     /* Fall through with a digit less than 8 */
1253 
1254     /* \0 always starts an octal number, but we may drop through to here with a
1255     larger first octal digit. The original code used just to take the least
1256     significant 8 bits of octal numbers (I think this is what early Perls used
1257     to do). Nowadays we allow for larger numbers in UTF-8 mode and 16-bit mode,
1258     but no more than 3 octal digits. */
1259 
1260     case CHAR_0:
1261     c -= CHAR_0;
1262     while(i++ < 2 && ptr[1] >= CHAR_0 && ptr[1] <= CHAR_7)
1263         c = c * 8 + *(++ptr) - CHAR_0;
1264 #ifdef COMPILE_PCRE8
1265     if (!utf && c > 0xff) *errorcodeptr = ERR51;
1266 #endif
1267     break;
1268 
1269     /* \o is a relatively new Perl feature, supporting a more general way of
1270     specifying character codes in octal. The only supported form is \o{ddd}. */
1271 
1272     case CHAR_o:
1273     if (ptr[1] != CHAR_LEFT_CURLY_BRACKET) *errorcodeptr = ERR81; else
1274     if (ptr[2] == CHAR_RIGHT_CURLY_BRACKET) *errorcodeptr = ERR86; else
1275       {
1276       ptr += 2;
1277       c = 0;
1278       overflow = FALSE;
1279       while (*ptr >= CHAR_0 && *ptr <= CHAR_7)
1280         {
1281         register pcre_uint32 cc = *ptr++;
1282         if (c == 0 && cc == CHAR_0) continue;     /* Leading zeroes */
1283 #ifdef COMPILE_PCRE32
1284         if (c >= 0x20000000l) { overflow = TRUE; break; }
1285 #endif
1286         c = (c << 3) + cc - CHAR_0 ;
1287 #if defined COMPILE_PCRE8
1288         if (c > (utf ? 0x10ffffU : 0xffU)) { overflow = TRUE; break; }
1289 #elif defined COMPILE_PCRE16
1290         if (c > (utf ? 0x10ffffU : 0xffffU)) { overflow = TRUE; break; }
1291 #elif defined COMPILE_PCRE32
1292         if (utf && c > 0x10ffffU) { overflow = TRUE; break; }
1293 #endif
1294         }
1295       if (overflow)
1296         {
1297         while (*ptr >= CHAR_0 && *ptr <= CHAR_7) ptr++;
1298         *errorcodeptr = ERR34;
1299         }
1300       else if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
1301         {
1302         if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
1303         }
1304       else *errorcodeptr = ERR80;
1305       }
1306     break;
1307 
1308     /* \x is complicated. In JavaScript, \x must be followed by two hexadecimal
1309     numbers. Otherwise it is a lowercase x letter. */
1310 
1311     case CHAR_x:
1312     if ((options & PCRE_JAVASCRIPT_COMPAT) != 0)
1313       {
1314       if (MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0
1315         && MAX_255(ptr[2]) && (digitab[ptr[2]] & ctype_xdigit) != 0)
1316         {
1317         c = 0;
1318         for (i = 0; i < 2; ++i)
1319           {
1320           register pcre_uint32 cc = *(++ptr);
1321 #ifndef EBCDIC  /* ASCII/UTF-8 coding */
1322           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
1323           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
1324 #else           /* EBCDIC coding */
1325           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
1326           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
1327 #endif
1328           }
1329         }
1330       }    /* End JavaScript handling */
1331 
1332     /* Handle \x in Perl's style. \x{ddd} is a character number which can be
1333     greater than 0xff in utf or non-8bit mode, but only if the ddd are hex
1334     digits. If not, { used to be treated as a data character. However, Perl
1335     seems to read hex digits up to the first non-such, and ignore the rest, so
1336     that, for example \x{zz} matches a binary zero. This seems crazy, so PCRE
1337     now gives an error. */
1338 
1339     else
1340       {
1341       if (ptr[1] == CHAR_LEFT_CURLY_BRACKET)
1342         {
1343         ptr += 2;
1344         if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
1345           {
1346           *errorcodeptr = ERR86;
1347           break;
1348           }
1349         c = 0;
1350         overflow = FALSE;
1351         while (MAX_255(*ptr) && (digitab[*ptr] & ctype_xdigit) != 0)
1352           {
1353           register pcre_uint32 cc = *ptr++;
1354           if (c == 0 && cc == CHAR_0) continue;     /* Leading zeroes */
1355 
1356 #ifdef COMPILE_PCRE32
1357           if (c >= 0x10000000l) { overflow = TRUE; break; }
1358 #endif
1359 
1360 #ifndef EBCDIC  /* ASCII/UTF-8 coding */
1361           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
1362           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
1363 #else           /* EBCDIC coding */
1364           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
1365           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
1366 #endif
1367 
1368 #if defined COMPILE_PCRE8
1369           if (c > (utf ? 0x10ffffU : 0xffU)) { overflow = TRUE; break; }
1370 #elif defined COMPILE_PCRE16
1371           if (c > (utf ? 0x10ffffU : 0xffffU)) { overflow = TRUE; break; }
1372 #elif defined COMPILE_PCRE32
1373           if (utf && c > 0x10ffffU) { overflow = TRUE; break; }
1374 #endif
1375           }
1376 
1377         if (overflow)
1378           {
1379           while (MAX_255(*ptr) && (digitab[*ptr] & ctype_xdigit) != 0) ptr++;
1380           *errorcodeptr = ERR34;
1381           }
1382 
1383         else if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
1384           {
1385           if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
1386           }
1387 
1388         /* If the sequence of hex digits does not end with '}', give an error.
1389         We used just to recognize this construct and fall through to the normal
1390         \x handling, but nowadays Perl gives an error, which seems much more
1391         sensible, so we do too. */
1392 
1393         else *errorcodeptr = ERR79;
1394         }   /* End of \x{} processing */
1395 
1396       /* Read a single-byte hex-defined char (up to two hex digits after \x) */
1397 
1398       else
1399         {
1400         c = 0;
1401         while (i++ < 2 && MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0)
1402           {
1403           pcre_uint32 cc;                          /* Some compilers don't like */
1404           cc = *(++ptr);                           /* ++ in initializers */
1405 #ifndef EBCDIC  /* ASCII/UTF-8 coding */
1406           if (cc >= CHAR_a) cc -= 32;              /* Convert to upper case */
1407           c = c * 16 + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
1408 #else           /* EBCDIC coding */
1409           if (cc <= CHAR_z) cc += 64;              /* Convert to upper case */
1410           c = c * 16 + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
1411 #endif
1412           }
1413         }     /* End of \xdd handling */
1414       }       /* End of Perl-style \x handling */
1415     break;
1416 
1417     /* For \c, a following letter is upper-cased; then the 0x40 bit is flipped.
1418     An error is given if the byte following \c is not an ASCII character. This
1419     coding is ASCII-specific, but then the whole concept of \cx is
1420     ASCII-specific. (However, an EBCDIC equivalent has now been added.) */
1421 
1422     case CHAR_c:
1423     c = *(++ptr);
1424     if (c == CHAR_NULL)
1425       {
1426       *errorcodeptr = ERR2;
1427       break;
1428       }
1429 #ifndef EBCDIC    /* ASCII/UTF-8 coding */
1430     if (c > 127)  /* Excludes all non-ASCII in either mode */
1431       {
1432       *errorcodeptr = ERR68;
1433       break;
1434       }
1435     if (c >= CHAR_a && c <= CHAR_z) c -= 32;
1436     c ^= 0x40;
1437 #else             /* EBCDIC coding */
1438     if (c >= CHAR_a && c <= CHAR_z) c += 64;
1439     if (c == CHAR_QUESTION_MARK)
1440       c = ('\\' == 188 && '`' == 74)? 0x5f : 0xff;
1441     else
1442       {
1443       for (i = 0; i < 32; i++)
1444         {
1445         if (c == ebcdic_escape_c[i]) break;
1446         }
1447       if (i < 32) c = i; else *errorcodeptr = ERR68;
1448       }
1449 #endif
1450     break;
1451 
1452     /* PCRE_EXTRA enables extensions to Perl in the matter of escapes. Any
1453     other alphanumeric following \ is an error if PCRE_EXTRA was set;
1454     otherwise, for Perl compatibility, it is a literal. This code looks a bit
1455     odd, but there used to be some cases other than the default, and there may
1456     be again in future, so I haven't "optimized" it. */
1457 
1458     default:
1459     if ((options & PCRE_EXTRA) != 0) switch(c)
1460       {
1461       default:
1462       *errorcodeptr = ERR3;
1463       break;
1464       }
1465     break;
1466     }
1467   }
1468 
1469 /* Perl supports \N{name} for character names, as well as plain \N for "not
1470 newline". PCRE does not support \N{name}. However, it does support
1471 quantification such as \N{2,3}. */
1472 
1473 if (escape == ESC_N && ptr[1] == CHAR_LEFT_CURLY_BRACKET &&
1474      !is_counted_repeat(ptr+2))
1475   *errorcodeptr = ERR37;
1476 
1477 /* If PCRE_UCP is set, we change the values for \d etc. */
1478 
1479 if ((options & PCRE_UCP) != 0 && escape >= ESC_D && escape <= ESC_w)
1480   escape += (ESC_DU - ESC_D);
1481 
1482 /* Set the pointer to the final character before returning. */
1483 
1484 *ptrptr = ptr;
1485 *chptr = c;
1486 return escape;
1487 }
1488 
1489 
1490 
1491 #ifdef SUPPORT_UCP
1492 /*************************************************
1493 *               Handle \P and \p                 *
1494 *************************************************/
1495 
1496 /* This function is called after \P or \p has been encountered, provided that
1497 PCRE is compiled with support for Unicode properties. On entry, ptrptr is
1498 pointing at the P or p. On exit, it is pointing at the final character of the
1499 escape sequence.
1500 
1501 Argument:
1502   ptrptr         points to the pattern position pointer
1503   negptr         points to a boolean that is set TRUE for negation else FALSE
1504   ptypeptr       points to an unsigned int that is set to the type value
1505   pdataptr       points to an unsigned int that is set to the detailed property value
1506   errorcodeptr   points to the error code variable
1507 
1508 Returns:         TRUE if the type value was found, or FALSE for an invalid type
1509 */
1510 
1511 static BOOL
get_ucp(const pcre_uchar ** ptrptr,BOOL * negptr,unsigned int * ptypeptr,unsigned int * pdataptr,int * errorcodeptr)1512 get_ucp(const pcre_uchar **ptrptr, BOOL *negptr, unsigned int *ptypeptr,
1513   unsigned int *pdataptr, int *errorcodeptr)
1514 {
1515 pcre_uchar c;
1516 int i, bot, top;
1517 const pcre_uchar *ptr = *ptrptr;
1518 pcre_uchar name[32];
1519 
1520 c = *(++ptr);
1521 if (c == CHAR_NULL) goto ERROR_RETURN;
1522 
1523 *negptr = FALSE;
1524 
1525 /* \P or \p can be followed by a name in {}, optionally preceded by ^ for
1526 negation. */
1527 
1528 if (c == CHAR_LEFT_CURLY_BRACKET)
1529   {
1530   if (ptr[1] == CHAR_CIRCUMFLEX_ACCENT)
1531     {
1532     *negptr = TRUE;
1533     ptr++;
1534     }
1535   for (i = 0; i < (int)(sizeof(name) / sizeof(pcre_uchar)) - 1; i++)
1536     {
1537     c = *(++ptr);
1538     if (c == CHAR_NULL) goto ERROR_RETURN;
1539     if (c == CHAR_RIGHT_CURLY_BRACKET) break;
1540     name[i] = c;
1541     }
1542   if (c != CHAR_RIGHT_CURLY_BRACKET) goto ERROR_RETURN;
1543   name[i] = 0;
1544   }
1545 
1546 /* Otherwise there is just one following character */
1547 
1548 else
1549   {
1550   name[0] = c;
1551   name[1] = 0;
1552   }
1553 
1554 *ptrptr = ptr;
1555 
1556 /* Search for a recognized property name using binary chop */
1557 
1558 bot = 0;
1559 top = PRIV(utt_size);
1560 
1561 while (bot < top)
1562   {
1563   int r;
1564   i = (bot + top) >> 1;
1565   r = STRCMP_UC_C8(name, PRIV(utt_names) + PRIV(utt)[i].name_offset);
1566   if (r == 0)
1567     {
1568     *ptypeptr = PRIV(utt)[i].type;
1569     *pdataptr = PRIV(utt)[i].value;
1570     return TRUE;
1571     }
1572   if (r > 0) bot = i + 1; else top = i;
1573   }
1574 
1575 *errorcodeptr = ERR47;
1576 *ptrptr = ptr;
1577 return FALSE;
1578 
1579 ERROR_RETURN:
1580 *errorcodeptr = ERR46;
1581 *ptrptr = ptr;
1582 return FALSE;
1583 }
1584 #endif
1585 
1586 
1587 
1588 /*************************************************
1589 *         Read repeat counts                     *
1590 *************************************************/
1591 
1592 /* Read an item of the form {n,m} and return the values. This is called only
1593 after is_counted_repeat() has confirmed that a repeat-count quantifier exists,
1594 so the syntax is guaranteed to be correct, but we need to check the values.
1595 
1596 Arguments:
1597   p              pointer to first char after '{'
1598   minp           pointer to int for min
1599   maxp           pointer to int for max
1600                  returned as -1 if no max
1601   errorcodeptr   points to error code variable
1602 
1603 Returns:         pointer to '}' on success;
1604                  current ptr on error, with errorcodeptr set non-zero
1605 */
1606 
1607 static const pcre_uchar *
read_repeat_counts(const pcre_uchar * p,int * minp,int * maxp,int * errorcodeptr)1608 read_repeat_counts(const pcre_uchar *p, int *minp, int *maxp, int *errorcodeptr)
1609 {
1610 int min = 0;
1611 int max = -1;
1612 
1613 while (IS_DIGIT(*p))
1614   {
1615   min = min * 10 + (int)(*p++ - CHAR_0);
1616   if (min > 65535)
1617     {
1618     *errorcodeptr = ERR5;
1619     return p;
1620     }
1621   }
1622 
1623 if (*p == CHAR_RIGHT_CURLY_BRACKET) max = min; else
1624   {
1625   if (*(++p) != CHAR_RIGHT_CURLY_BRACKET)
1626     {
1627     max = 0;
1628     while(IS_DIGIT(*p))
1629       {
1630       max = max * 10 + (int)(*p++ - CHAR_0);
1631       if (max > 65535)
1632         {
1633         *errorcodeptr = ERR5;
1634         return p;
1635         }
1636       }
1637     if (max < min)
1638       {
1639       *errorcodeptr = ERR4;
1640       return p;
1641       }
1642     }
1643   }
1644 
1645 *minp = min;
1646 *maxp = max;
1647 return p;
1648 }
1649 
1650 
1651 
1652 /*************************************************
1653 *      Find first significant op code            *
1654 *************************************************/
1655 
1656 /* This is called by several functions that scan a compiled expression looking
1657 for a fixed first character, or an anchoring op code etc. It skips over things
1658 that do not influence this. For some calls, it makes sense to skip negative
1659 forward and all backward assertions, and also the \b assertion; for others it
1660 does not.
1661 
1662 Arguments:
1663   code         pointer to the start of the group
1664   skipassert   TRUE if certain assertions are to be skipped
1665 
1666 Returns:       pointer to the first significant opcode
1667 */
1668 
1669 static const pcre_uchar*
first_significant_code(const pcre_uchar * code,BOOL skipassert)1670 first_significant_code(const pcre_uchar *code, BOOL skipassert)
1671 {
1672 for (;;)
1673   {
1674   switch ((int)*code)
1675     {
1676     case OP_ASSERT_NOT:
1677     case OP_ASSERTBACK:
1678     case OP_ASSERTBACK_NOT:
1679     if (!skipassert) return code;
1680     do code += GET(code, 1); while (*code == OP_ALT);
1681     code += PRIV(OP_lengths)[*code];
1682     break;
1683 
1684     case OP_WORD_BOUNDARY:
1685     case OP_NOT_WORD_BOUNDARY:
1686     if (!skipassert) return code;
1687     /* Fall through */
1688 
1689     case OP_CALLOUT:
1690     case OP_CREF:
1691     case OP_DNCREF:
1692     case OP_RREF:
1693     case OP_DNRREF:
1694     case OP_DEF:
1695     code += PRIV(OP_lengths)[*code];
1696     break;
1697 
1698     default:
1699     return code;
1700     }
1701   }
1702 /* Control never reaches here */
1703 }
1704 
1705 
1706 
1707 /*************************************************
1708 *        Find the fixed length of a branch       *
1709 *************************************************/
1710 
1711 /* Scan a branch and compute the fixed length of subject that will match it,
1712 if the length is fixed. This is needed for dealing with backward assertions.
1713 In UTF8 mode, the result is in characters rather than bytes. The branch is
1714 temporarily terminated with OP_END when this function is called.
1715 
1716 This function is called when a backward assertion is encountered, so that if it
1717 fails, the error message can point to the correct place in the pattern.
1718 However, we cannot do this when the assertion contains subroutine calls,
1719 because they can be forward references. We solve this by remembering this case
1720 and doing the check at the end; a flag specifies which mode we are running in.
1721 
1722 Arguments:
1723   code     points to the start of the pattern (the bracket)
1724   utf      TRUE in UTF-8 / UTF-16 / UTF-32 mode
1725   atend    TRUE if called when the pattern is complete
1726   cd       the "compile data" structure
1727   recurses    chain of recurse_check to catch mutual recursion
1728 
1729 Returns:   the fixed length,
1730              or -1 if there is no fixed length,
1731              or -2 if \C was encountered (in UTF-8 mode only)
1732              or -3 if an OP_RECURSE item was encountered and atend is FALSE
1733              or -4 if an unknown opcode was encountered (internal error)
1734 */
1735 
1736 static int
find_fixedlength(pcre_uchar * code,BOOL utf,BOOL atend,compile_data * cd,recurse_check * recurses)1737 find_fixedlength(pcre_uchar *code, BOOL utf, BOOL atend, compile_data *cd,
1738   recurse_check *recurses)
1739 {
1740 int length = -1;
1741 recurse_check this_recurse;
1742 register int branchlength = 0;
1743 register pcre_uchar *cc = code + 1 + LINK_SIZE;
1744 
1745 /* Scan along the opcodes for this branch. If we get to the end of the
1746 branch, check the length against that of the other branches. */
1747 
1748 for (;;)
1749   {
1750   int d;
1751   pcre_uchar *ce, *cs;
1752   register pcre_uchar op = *cc;
1753 
1754   switch (op)
1755     {
1756     /* We only need to continue for OP_CBRA (normal capturing bracket) and
1757     OP_BRA (normal non-capturing bracket) because the other variants of these
1758     opcodes are all concerned with unlimited repeated groups, which of course
1759     are not of fixed length. */
1760 
1761     case OP_CBRA:
1762     case OP_BRA:
1763     case OP_ONCE:
1764     case OP_ONCE_NC:
1765     case OP_COND:
1766     d = find_fixedlength(cc + ((op == OP_CBRA)? IMM2_SIZE : 0), utf, atend, cd,
1767       recurses);
1768     if (d < 0) return d;
1769     branchlength += d;
1770     do cc += GET(cc, 1); while (*cc == OP_ALT);
1771     cc += 1 + LINK_SIZE;
1772     break;
1773 
1774     /* Reached end of a branch; if it's a ket it is the end of a nested call.
1775     If it's ALT it is an alternation in a nested call. An ACCEPT is effectively
1776     an ALT. If it is END it's the end of the outer call. All can be handled by
1777     the same code. Note that we must not include the OP_KETRxxx opcodes here,
1778     because they all imply an unlimited repeat. */
1779 
1780     case OP_ALT:
1781     case OP_KET:
1782     case OP_END:
1783     case OP_ACCEPT:
1784     case OP_ASSERT_ACCEPT:
1785     if (length < 0) length = branchlength;
1786       else if (length != branchlength) return -1;
1787     if (*cc != OP_ALT) return length;
1788     cc += 1 + LINK_SIZE;
1789     branchlength = 0;
1790     break;
1791 
1792     /* A true recursion implies not fixed length, but a subroutine call may
1793     be OK. If the subroutine is a forward reference, we can't deal with
1794     it until the end of the pattern, so return -3. */
1795 
1796     case OP_RECURSE:
1797     if (!atend) return -3;
1798     cs = ce = (pcre_uchar *)cd->start_code + GET(cc, 1);  /* Start subpattern */
1799     do ce += GET(ce, 1); while (*ce == OP_ALT);           /* End subpattern */
1800     if (cc > cs && cc < ce) return -1;                    /* Recursion */
1801     else   /* Check for mutual recursion */
1802       {
1803       recurse_check *r = recurses;
1804       for (r = recurses; r != NULL; r = r->prev) if (r->group == cs) break;
1805       if (r != NULL) return -1;   /* Mutual recursion */
1806       }
1807     this_recurse.prev = recurses;
1808     this_recurse.group = cs;
1809     d = find_fixedlength(cs + IMM2_SIZE, utf, atend, cd, &this_recurse);
1810     if (d < 0) return d;
1811     branchlength += d;
1812     cc += 1 + LINK_SIZE;
1813     break;
1814 
1815     /* Skip over assertive subpatterns */
1816 
1817     case OP_ASSERT:
1818     case OP_ASSERT_NOT:
1819     case OP_ASSERTBACK:
1820     case OP_ASSERTBACK_NOT:
1821     do cc += GET(cc, 1); while (*cc == OP_ALT);
1822     cc += 1 + LINK_SIZE;
1823     break;
1824 
1825     /* Skip over things that don't match chars */
1826 
1827     case OP_MARK:
1828     case OP_PRUNE_ARG:
1829     case OP_SKIP_ARG:
1830     case OP_THEN_ARG:
1831     cc += cc[1] + PRIV(OP_lengths)[*cc];
1832     break;
1833 
1834     case OP_CALLOUT:
1835     case OP_CIRC:
1836     case OP_CIRCM:
1837     case OP_CLOSE:
1838     case OP_COMMIT:
1839     case OP_CREF:
1840     case OP_DEF:
1841     case OP_DNCREF:
1842     case OP_DNRREF:
1843     case OP_DOLL:
1844     case OP_DOLLM:
1845     case OP_EOD:
1846     case OP_EODN:
1847     case OP_FAIL:
1848     case OP_NOT_WORD_BOUNDARY:
1849     case OP_PRUNE:
1850     case OP_REVERSE:
1851     case OP_RREF:
1852     case OP_SET_SOM:
1853     case OP_SKIP:
1854     case OP_SOD:
1855     case OP_SOM:
1856     case OP_THEN:
1857     case OP_WORD_BOUNDARY:
1858     cc += PRIV(OP_lengths)[*cc];
1859     break;
1860 
1861     /* Handle literal characters */
1862 
1863     case OP_CHAR:
1864     case OP_CHARI:
1865     case OP_NOT:
1866     case OP_NOTI:
1867     branchlength++;
1868     cc += 2;
1869 #ifdef SUPPORT_UTF
1870     if (utf && HAS_EXTRALEN(cc[-1])) cc += GET_EXTRALEN(cc[-1]);
1871 #endif
1872     break;
1873 
1874     /* Handle exact repetitions. The count is already in characters, but we
1875     need to skip over a multibyte character in UTF8 mode.  */
1876 
1877     case OP_EXACT:
1878     case OP_EXACTI:
1879     case OP_NOTEXACT:
1880     case OP_NOTEXACTI:
1881     branchlength += (int)GET2(cc,1);
1882     cc += 2 + IMM2_SIZE;
1883 #ifdef SUPPORT_UTF
1884     if (utf && HAS_EXTRALEN(cc[-1])) cc += GET_EXTRALEN(cc[-1]);
1885 #endif
1886     break;
1887 
1888     case OP_TYPEEXACT:
1889     branchlength += GET2(cc,1);
1890     if (cc[1 + IMM2_SIZE] == OP_PROP || cc[1 + IMM2_SIZE] == OP_NOTPROP)
1891       cc += 2;
1892     cc += 1 + IMM2_SIZE + 1;
1893     break;
1894 
1895     /* Handle single-char matchers */
1896 
1897     case OP_PROP:
1898     case OP_NOTPROP:
1899     cc += 2;
1900     /* Fall through */
1901 
1902     case OP_HSPACE:
1903     case OP_VSPACE:
1904     case OP_NOT_HSPACE:
1905     case OP_NOT_VSPACE:
1906     case OP_NOT_DIGIT:
1907     case OP_DIGIT:
1908     case OP_NOT_WHITESPACE:
1909     case OP_WHITESPACE:
1910     case OP_NOT_WORDCHAR:
1911     case OP_WORDCHAR:
1912     case OP_ANY:
1913     case OP_ALLANY:
1914     branchlength++;
1915     cc++;
1916     break;
1917 
1918     /* The single-byte matcher isn't allowed. This only happens in UTF-8 mode;
1919     otherwise \C is coded as OP_ALLANY. */
1920 
1921     case OP_ANYBYTE:
1922     return -2;
1923 
1924     /* Check a class for variable quantification */
1925 
1926     case OP_CLASS:
1927     case OP_NCLASS:
1928 #if defined SUPPORT_UTF || defined COMPILE_PCRE16 || defined COMPILE_PCRE32
1929     case OP_XCLASS:
1930     /* The original code caused an unsigned overflow in 64 bit systems,
1931     so now we use a conditional statement. */
1932     if (op == OP_XCLASS)
1933       cc += GET(cc, 1);
1934     else
1935       cc += PRIV(OP_lengths)[OP_CLASS];
1936 #else
1937     cc += PRIV(OP_lengths)[OP_CLASS];
1938 #endif
1939 
1940     switch (*cc)
1941       {
1942       case OP_CRSTAR:
1943       case OP_CRMINSTAR:
1944       case OP_CRPLUS:
1945       case OP_CRMINPLUS:
1946       case OP_CRQUERY:
1947       case OP_CRMINQUERY:
1948       case OP_CRPOSSTAR:
1949       case OP_CRPOSPLUS:
1950       case OP_CRPOSQUERY:
1951       return -1;
1952 
1953       case OP_CRRANGE:
1954       case OP_CRMINRANGE:
1955       case OP_CRPOSRANGE:
1956       if (GET2(cc,1) != GET2(cc,1+IMM2_SIZE)) return -1;
1957       branchlength += (int)GET2(cc,1);
1958       cc += 1 + 2 * IMM2_SIZE;
1959       break;
1960 
1961       default:
1962       branchlength++;
1963       }
1964     break;
1965 
1966     /* Anything else is variable length */
1967 
1968     case OP_ANYNL:
1969     case OP_BRAMINZERO:
1970     case OP_BRAPOS:
1971     case OP_BRAPOSZERO:
1972     case OP_BRAZERO:
1973     case OP_CBRAPOS:
1974     case OP_EXTUNI:
1975     case OP_KETRMAX:
1976     case OP_KETRMIN:
1977     case OP_KETRPOS:
1978     case OP_MINPLUS:
1979     case OP_MINPLUSI:
1980     case OP_MINQUERY:
1981     case OP_MINQUERYI:
1982     case OP_MINSTAR:
1983     case OP_MINSTARI:
1984     case OP_MINUPTO:
1985     case OP_MINUPTOI:
1986     case OP_NOTMINPLUS:
1987     case OP_NOTMINPLUSI:
1988     case OP_NOTMINQUERY:
1989     case OP_NOTMINQUERYI:
1990     case OP_NOTMINSTAR:
1991     case OP_NOTMINSTARI:
1992     case OP_NOTMINUPTO:
1993     case OP_NOTMINUPTOI:
1994     case OP_NOTPLUS:
1995     case OP_NOTPLUSI:
1996     case OP_NOTPOSPLUS:
1997     case OP_NOTPOSPLUSI:
1998     case OP_NOTPOSQUERY:
1999     case OP_NOTPOSQUERYI:
2000     case OP_NOTPOSSTAR:
2001     case OP_NOTPOSSTARI:
2002     case OP_NOTPOSUPTO:
2003     case OP_NOTPOSUPTOI:
2004     case OP_NOTQUERY:
2005     case OP_NOTQUERYI:
2006     case OP_NOTSTAR:
2007     case OP_NOTSTARI:
2008     case OP_NOTUPTO:
2009     case OP_NOTUPTOI:
2010     case OP_PLUS:
2011     case OP_PLUSI:
2012     case OP_POSPLUS:
2013     case OP_POSPLUSI:
2014     case OP_POSQUERY:
2015     case OP_POSQUERYI:
2016     case OP_POSSTAR:
2017     case OP_POSSTARI:
2018     case OP_POSUPTO:
2019     case OP_POSUPTOI:
2020     case OP_QUERY:
2021     case OP_QUERYI:
2022     case OP_REF:
2023     case OP_REFI:
2024     case OP_DNREF:
2025     case OP_DNREFI:
2026     case OP_SBRA:
2027     case OP_SBRAPOS:
2028     case OP_SCBRA:
2029     case OP_SCBRAPOS:
2030     case OP_SCOND:
2031     case OP_SKIPZERO:
2032     case OP_STAR:
2033     case OP_STARI:
2034     case OP_TYPEMINPLUS:
2035     case OP_TYPEMINQUERY:
2036     case OP_TYPEMINSTAR:
2037     case OP_TYPEMINUPTO:
2038     case OP_TYPEPLUS:
2039     case OP_TYPEPOSPLUS:
2040     case OP_TYPEPOSQUERY:
2041     case OP_TYPEPOSSTAR:
2042     case OP_TYPEPOSUPTO:
2043     case OP_TYPEQUERY:
2044     case OP_TYPESTAR:
2045     case OP_TYPEUPTO:
2046     case OP_UPTO:
2047     case OP_UPTOI:
2048     return -1;
2049 
2050     /* Catch unrecognized opcodes so that when new ones are added they
2051     are not forgotten, as has happened in the past. */
2052 
2053     default:
2054     return -4;
2055     }
2056   }
2057 /* Control never gets here */
2058 }
2059 
2060 
2061 
2062 /*************************************************
2063 *    Scan compiled regex for specific bracket    *
2064 *************************************************/
2065 
2066 /* This little function scans through a compiled pattern until it finds a
2067 capturing bracket with the given number, or, if the number is negative, an
2068 instance of OP_REVERSE for a lookbehind. The function is global in the C sense
2069 so that it can be called from pcre_study() when finding the minimum matching
2070 length.
2071 
2072 Arguments:
2073   code        points to start of expression
2074   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
2075   number      the required bracket number or negative to find a lookbehind
2076 
2077 Returns:      pointer to the opcode for the bracket, or NULL if not found
2078 */
2079 
2080 const pcre_uchar *
PRIV(find_bracket)2081 PRIV(find_bracket)(const pcre_uchar *code, BOOL utf, int number)
2082 {
2083 for (;;)
2084   {
2085   register pcre_uchar c = *code;
2086 
2087   if (c == OP_END) return NULL;
2088 
2089   /* XCLASS is used for classes that cannot be represented just by a bit
2090   map. This includes negated single high-valued characters. The length in
2091   the table is zero; the actual length is stored in the compiled code. */
2092 
2093   if (c == OP_XCLASS) code += GET(code, 1);
2094 
2095   /* Handle recursion */
2096 
2097   else if (c == OP_REVERSE)
2098     {
2099     if (number < 0) return (pcre_uchar *)code;
2100     code += PRIV(OP_lengths)[c];
2101     }
2102 
2103   /* Handle capturing bracket */
2104 
2105   else if (c == OP_CBRA || c == OP_SCBRA ||
2106            c == OP_CBRAPOS || c == OP_SCBRAPOS)
2107     {
2108     int n = (int)GET2(code, 1+LINK_SIZE);
2109     if (n == number) return (pcre_uchar *)code;
2110     code += PRIV(OP_lengths)[c];
2111     }
2112 
2113   /* Otherwise, we can get the item's length from the table, except that for
2114   repeated character types, we have to test for \p and \P, which have an extra
2115   two bytes of parameters, and for MARK/PRUNE/SKIP/THEN with an argument, we
2116   must add in its length. */
2117 
2118   else
2119     {
2120     switch(c)
2121       {
2122       case OP_TYPESTAR:
2123       case OP_TYPEMINSTAR:
2124       case OP_TYPEPLUS:
2125       case OP_TYPEMINPLUS:
2126       case OP_TYPEQUERY:
2127       case OP_TYPEMINQUERY:
2128       case OP_TYPEPOSSTAR:
2129       case OP_TYPEPOSPLUS:
2130       case OP_TYPEPOSQUERY:
2131       if (code[1] == OP_PROP || code[1] == OP_NOTPROP) code += 2;
2132       break;
2133 
2134       case OP_TYPEUPTO:
2135       case OP_TYPEMINUPTO:
2136       case OP_TYPEEXACT:
2137       case OP_TYPEPOSUPTO:
2138       if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
2139         code += 2;
2140       break;
2141 
2142       case OP_MARK:
2143       case OP_PRUNE_ARG:
2144       case OP_SKIP_ARG:
2145       case OP_THEN_ARG:
2146       code += code[1];
2147       break;
2148       }
2149 
2150     /* Add in the fixed length from the table */
2151 
2152     code += PRIV(OP_lengths)[c];
2153 
2154   /* In UTF-8 mode, opcodes that are followed by a character may be followed by
2155   a multi-byte character. The length in the table is a minimum, so we have to
2156   arrange to skip the extra bytes. */
2157 
2158 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
2159     if (utf) switch(c)
2160       {
2161       case OP_CHAR:
2162       case OP_CHARI:
2163       case OP_NOT:
2164       case OP_NOTI:
2165       case OP_EXACT:
2166       case OP_EXACTI:
2167       case OP_NOTEXACT:
2168       case OP_NOTEXACTI:
2169       case OP_UPTO:
2170       case OP_UPTOI:
2171       case OP_NOTUPTO:
2172       case OP_NOTUPTOI:
2173       case OP_MINUPTO:
2174       case OP_MINUPTOI:
2175       case OP_NOTMINUPTO:
2176       case OP_NOTMINUPTOI:
2177       case OP_POSUPTO:
2178       case OP_POSUPTOI:
2179       case OP_NOTPOSUPTO:
2180       case OP_NOTPOSUPTOI:
2181       case OP_STAR:
2182       case OP_STARI:
2183       case OP_NOTSTAR:
2184       case OP_NOTSTARI:
2185       case OP_MINSTAR:
2186       case OP_MINSTARI:
2187       case OP_NOTMINSTAR:
2188       case OP_NOTMINSTARI:
2189       case OP_POSSTAR:
2190       case OP_POSSTARI:
2191       case OP_NOTPOSSTAR:
2192       case OP_NOTPOSSTARI:
2193       case OP_PLUS:
2194       case OP_PLUSI:
2195       case OP_NOTPLUS:
2196       case OP_NOTPLUSI:
2197       case OP_MINPLUS:
2198       case OP_MINPLUSI:
2199       case OP_NOTMINPLUS:
2200       case OP_NOTMINPLUSI:
2201       case OP_POSPLUS:
2202       case OP_POSPLUSI:
2203       case OP_NOTPOSPLUS:
2204       case OP_NOTPOSPLUSI:
2205       case OP_QUERY:
2206       case OP_QUERYI:
2207       case OP_NOTQUERY:
2208       case OP_NOTQUERYI:
2209       case OP_MINQUERY:
2210       case OP_MINQUERYI:
2211       case OP_NOTMINQUERY:
2212       case OP_NOTMINQUERYI:
2213       case OP_POSQUERY:
2214       case OP_POSQUERYI:
2215       case OP_NOTPOSQUERY:
2216       case OP_NOTPOSQUERYI:
2217       if (HAS_EXTRALEN(code[-1])) code += GET_EXTRALEN(code[-1]);
2218       break;
2219       }
2220 #else
2221     (void)(utf);  /* Keep compiler happy by referencing function argument */
2222 #endif
2223     }
2224   }
2225 }
2226 
2227 
2228 
2229 /*************************************************
2230 *   Scan compiled regex for recursion reference  *
2231 *************************************************/
2232 
2233 /* This little function scans through a compiled pattern until it finds an
2234 instance of OP_RECURSE.
2235 
2236 Arguments:
2237   code        points to start of expression
2238   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
2239 
2240 Returns:      pointer to the opcode for OP_RECURSE, or NULL if not found
2241 */
2242 
2243 static const pcre_uchar *
find_recurse(const pcre_uchar * code,BOOL utf)2244 find_recurse(const pcre_uchar *code, BOOL utf)
2245 {
2246 for (;;)
2247   {
2248   register pcre_uchar c = *code;
2249   if (c == OP_END) return NULL;
2250   if (c == OP_RECURSE) return code;
2251 
2252   /* XCLASS is used for classes that cannot be represented just by a bit
2253   map. This includes negated single high-valued characters. The length in
2254   the table is zero; the actual length is stored in the compiled code. */
2255 
2256   if (c == OP_XCLASS) code += GET(code, 1);
2257 
2258   /* Otherwise, we can get the item's length from the table, except that for
2259   repeated character types, we have to test for \p and \P, which have an extra
2260   two bytes of parameters, and for MARK/PRUNE/SKIP/THEN with an argument, we
2261   must add in its length. */
2262 
2263   else
2264     {
2265     switch(c)
2266       {
2267       case OP_TYPESTAR:
2268       case OP_TYPEMINSTAR:
2269       case OP_TYPEPLUS:
2270       case OP_TYPEMINPLUS:
2271       case OP_TYPEQUERY:
2272       case OP_TYPEMINQUERY:
2273       case OP_TYPEPOSSTAR:
2274       case OP_TYPEPOSPLUS:
2275       case OP_TYPEPOSQUERY:
2276       if (code[1] == OP_PROP || code[1] == OP_NOTPROP) code += 2;
2277       break;
2278 
2279       case OP_TYPEPOSUPTO:
2280       case OP_TYPEUPTO:
2281       case OP_TYPEMINUPTO:
2282       case OP_TYPEEXACT:
2283       if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
2284         code += 2;
2285       break;
2286 
2287       case OP_MARK:
2288       case OP_PRUNE_ARG:
2289       case OP_SKIP_ARG:
2290       case OP_THEN_ARG:
2291       code += code[1];
2292       break;
2293       }
2294 
2295     /* Add in the fixed length from the table */
2296 
2297     code += PRIV(OP_lengths)[c];
2298 
2299     /* In UTF-8 mode, opcodes that are followed by a character may be followed
2300     by a multi-byte character. The length in the table is a minimum, so we have
2301     to arrange to skip the extra bytes. */
2302 
2303 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
2304     if (utf) switch(c)
2305       {
2306       case OP_CHAR:
2307       case OP_CHARI:
2308       case OP_NOT:
2309       case OP_NOTI:
2310       case OP_EXACT:
2311       case OP_EXACTI:
2312       case OP_NOTEXACT:
2313       case OP_NOTEXACTI:
2314       case OP_UPTO:
2315       case OP_UPTOI:
2316       case OP_NOTUPTO:
2317       case OP_NOTUPTOI:
2318       case OP_MINUPTO:
2319       case OP_MINUPTOI:
2320       case OP_NOTMINUPTO:
2321       case OP_NOTMINUPTOI:
2322       case OP_POSUPTO:
2323       case OP_POSUPTOI:
2324       case OP_NOTPOSUPTO:
2325       case OP_NOTPOSUPTOI:
2326       case OP_STAR:
2327       case OP_STARI:
2328       case OP_NOTSTAR:
2329       case OP_NOTSTARI:
2330       case OP_MINSTAR:
2331       case OP_MINSTARI:
2332       case OP_NOTMINSTAR:
2333       case OP_NOTMINSTARI:
2334       case OP_POSSTAR:
2335       case OP_POSSTARI:
2336       case OP_NOTPOSSTAR:
2337       case OP_NOTPOSSTARI:
2338       case OP_PLUS:
2339       case OP_PLUSI:
2340       case OP_NOTPLUS:
2341       case OP_NOTPLUSI:
2342       case OP_MINPLUS:
2343       case OP_MINPLUSI:
2344       case OP_NOTMINPLUS:
2345       case OP_NOTMINPLUSI:
2346       case OP_POSPLUS:
2347       case OP_POSPLUSI:
2348       case OP_NOTPOSPLUS:
2349       case OP_NOTPOSPLUSI:
2350       case OP_QUERY:
2351       case OP_QUERYI:
2352       case OP_NOTQUERY:
2353       case OP_NOTQUERYI:
2354       case OP_MINQUERY:
2355       case OP_MINQUERYI:
2356       case OP_NOTMINQUERY:
2357       case OP_NOTMINQUERYI:
2358       case OP_POSQUERY:
2359       case OP_POSQUERYI:
2360       case OP_NOTPOSQUERY:
2361       case OP_NOTPOSQUERYI:
2362       if (HAS_EXTRALEN(code[-1])) code += GET_EXTRALEN(code[-1]);
2363       break;
2364       }
2365 #else
2366     (void)(utf);  /* Keep compiler happy by referencing function argument */
2367 #endif
2368     }
2369   }
2370 }
2371 
2372 
2373 
2374 /*************************************************
2375 *    Scan compiled branch for non-emptiness      *
2376 *************************************************/
2377 
2378 /* This function scans through a branch of a compiled pattern to see whether it
2379 can match the empty string or not. It is called from could_be_empty()
2380 below and from compile_branch() when checking for an unlimited repeat of a
2381 group that can match nothing. Note that first_significant_code() skips over
2382 backward and negative forward assertions when its final argument is TRUE. If we
2383 hit an unclosed bracket, we return "empty" - this means we've struck an inner
2384 bracket whose current branch will already have been scanned.
2385 
2386 Arguments:
2387   code        points to start of search
2388   endcode     points to where to stop
2389   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
2390   cd          contains pointers to tables etc.
2391   recurses    chain of recurse_check to catch mutual recursion
2392 
2393 Returns:      TRUE if what is matched could be empty
2394 */
2395 
2396 static BOOL
could_be_empty_branch(const pcre_uchar * code,const pcre_uchar * endcode,BOOL utf,compile_data * cd,recurse_check * recurses)2397 could_be_empty_branch(const pcre_uchar *code, const pcre_uchar *endcode,
2398   BOOL utf, compile_data *cd, recurse_check *recurses)
2399 {
2400 register pcre_uchar c;
2401 recurse_check this_recurse;
2402 
2403 for (code = first_significant_code(code + PRIV(OP_lengths)[*code], TRUE);
2404      code < endcode;
2405      code = first_significant_code(code + PRIV(OP_lengths)[c], TRUE))
2406   {
2407   const pcre_uchar *ccode;
2408 
2409   c = *code;
2410 
2411   /* Skip over forward assertions; the other assertions are skipped by
2412   first_significant_code() with a TRUE final argument. */
2413 
2414   if (c == OP_ASSERT)
2415     {
2416     do code += GET(code, 1); while (*code == OP_ALT);
2417     c = *code;
2418     continue;
2419     }
2420 
2421   /* For a recursion/subroutine call, if its end has been reached, which
2422   implies a backward reference subroutine call, we can scan it. If it's a
2423   forward reference subroutine call, we can't. To detect forward reference
2424   we have to scan up the list that is kept in the workspace. This function is
2425   called only when doing the real compile, not during the pre-compile that
2426   measures the size of the compiled pattern. */
2427 
2428   if (c == OP_RECURSE)
2429     {
2430     const pcre_uchar *scode = cd->start_code + GET(code, 1);
2431     const pcre_uchar *endgroup = scode;
2432     BOOL empty_branch;
2433 
2434     /* Test for forward reference or uncompleted reference. This is disabled
2435     when called to scan a completed pattern by setting cd->start_workspace to
2436     NULL. */
2437 
2438     if (cd->start_workspace != NULL)
2439       {
2440       const pcre_uchar *tcode;
2441       for (tcode = cd->start_workspace; tcode < cd->hwm; tcode += LINK_SIZE)
2442         if ((int)GET(tcode, 0) == (int)(code + 1 - cd->start_code)) return TRUE;
2443       if (GET(scode, 1) == 0) return TRUE;    /* Unclosed */
2444       }
2445 
2446     /* If the reference is to a completed group, we need to detect whether this
2447     is a recursive call, as otherwise there will be an infinite loop. If it is
2448     a recursion, just skip over it. Simple recursions are easily detected. For
2449     mutual recursions we keep a chain on the stack. */
2450 
2451     do endgroup += GET(endgroup, 1); while (*endgroup == OP_ALT);
2452     if (code >= scode && code <= endgroup) continue;  /* Simple recursion */
2453     else
2454       {
2455       recurse_check *r = recurses;
2456       for (r = recurses; r != NULL; r = r->prev)
2457         if (r->group == scode) break;
2458       if (r != NULL) continue;   /* Mutual recursion */
2459       }
2460 
2461     /* Completed reference; scan the referenced group, remembering it on the
2462     stack chain to detect mutual recursions. */
2463 
2464     empty_branch = FALSE;
2465     this_recurse.prev = recurses;
2466     this_recurse.group = scode;
2467 
2468     do
2469       {
2470       if (could_be_empty_branch(scode, endcode, utf, cd, &this_recurse))
2471         {
2472         empty_branch = TRUE;
2473         break;
2474         }
2475       scode += GET(scode, 1);
2476       }
2477     while (*scode == OP_ALT);
2478 
2479     if (!empty_branch) return FALSE;  /* All branches are non-empty */
2480     continue;
2481     }
2482 
2483   /* Groups with zero repeats can of course be empty; skip them. */
2484 
2485   if (c == OP_BRAZERO || c == OP_BRAMINZERO || c == OP_SKIPZERO ||
2486       c == OP_BRAPOSZERO)
2487     {
2488     code += PRIV(OP_lengths)[c];
2489     do code += GET(code, 1); while (*code == OP_ALT);
2490     c = *code;
2491     continue;
2492     }
2493 
2494   /* A nested group that is already marked as "could be empty" can just be
2495   skipped. */
2496 
2497   if (c == OP_SBRA  || c == OP_SBRAPOS ||
2498       c == OP_SCBRA || c == OP_SCBRAPOS)
2499     {
2500     do code += GET(code, 1); while (*code == OP_ALT);
2501     c = *code;
2502     continue;
2503     }
2504 
2505   /* For other groups, scan the branches. */
2506 
2507   if (c == OP_BRA  || c == OP_BRAPOS ||
2508       c == OP_CBRA || c == OP_CBRAPOS ||
2509       c == OP_ONCE || c == OP_ONCE_NC ||
2510       c == OP_COND || c == OP_SCOND)
2511     {
2512     BOOL empty_branch;
2513     if (GET(code, 1) == 0) return TRUE;    /* Hit unclosed bracket */
2514 
2515     /* If a conditional group has only one branch, there is a second, implied,
2516     empty branch, so just skip over the conditional, because it could be empty.
2517     Otherwise, scan the individual branches of the group. */
2518 
2519     if (c == OP_COND && code[GET(code, 1)] != OP_ALT)
2520       code += GET(code, 1);
2521     else
2522       {
2523       empty_branch = FALSE;
2524       do
2525         {
2526         if (!empty_branch && could_be_empty_branch(code, endcode, utf, cd,
2527           recurses)) empty_branch = TRUE;
2528         code += GET(code, 1);
2529         }
2530       while (*code == OP_ALT);
2531       if (!empty_branch) return FALSE;   /* All branches are non-empty */
2532       }
2533 
2534     c = *code;
2535     continue;
2536     }
2537 
2538   /* Handle the other opcodes */
2539 
2540   switch (c)
2541     {
2542     /* Check for quantifiers after a class. XCLASS is used for classes that
2543     cannot be represented just by a bit map. This includes negated single
2544     high-valued characters. The length in PRIV(OP_lengths)[] is zero; the
2545     actual length is stored in the compiled code, so we must update "code"
2546     here. */
2547 
2548 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
2549     case OP_XCLASS:
2550     ccode = code += GET(code, 1);
2551     goto CHECK_CLASS_REPEAT;
2552 #endif
2553 
2554     case OP_CLASS:
2555     case OP_NCLASS:
2556     ccode = code + PRIV(OP_lengths)[OP_CLASS];
2557 
2558 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
2559     CHECK_CLASS_REPEAT:
2560 #endif
2561 
2562     switch (*ccode)
2563       {
2564       case OP_CRSTAR:            /* These could be empty; continue */
2565       case OP_CRMINSTAR:
2566       case OP_CRQUERY:
2567       case OP_CRMINQUERY:
2568       case OP_CRPOSSTAR:
2569       case OP_CRPOSQUERY:
2570       break;
2571 
2572       default:                   /* Non-repeat => class must match */
2573       case OP_CRPLUS:            /* These repeats aren't empty */
2574       case OP_CRMINPLUS:
2575       case OP_CRPOSPLUS:
2576       return FALSE;
2577 
2578       case OP_CRRANGE:
2579       case OP_CRMINRANGE:
2580       case OP_CRPOSRANGE:
2581       if (GET2(ccode, 1) > 0) return FALSE;  /* Minimum > 0 */
2582       break;
2583       }
2584     break;
2585 
2586     /* Opcodes that must match a character */
2587 
2588     case OP_ANY:
2589     case OP_ALLANY:
2590     case OP_ANYBYTE:
2591 
2592     case OP_PROP:
2593     case OP_NOTPROP:
2594     case OP_ANYNL:
2595 
2596     case OP_NOT_HSPACE:
2597     case OP_HSPACE:
2598     case OP_NOT_VSPACE:
2599     case OP_VSPACE:
2600     case OP_EXTUNI:
2601 
2602     case OP_NOT_DIGIT:
2603     case OP_DIGIT:
2604     case OP_NOT_WHITESPACE:
2605     case OP_WHITESPACE:
2606     case OP_NOT_WORDCHAR:
2607     case OP_WORDCHAR:
2608 
2609     case OP_CHAR:
2610     case OP_CHARI:
2611     case OP_NOT:
2612     case OP_NOTI:
2613 
2614     case OP_PLUS:
2615     case OP_PLUSI:
2616     case OP_MINPLUS:
2617     case OP_MINPLUSI:
2618 
2619     case OP_NOTPLUS:
2620     case OP_NOTPLUSI:
2621     case OP_NOTMINPLUS:
2622     case OP_NOTMINPLUSI:
2623 
2624     case OP_POSPLUS:
2625     case OP_POSPLUSI:
2626     case OP_NOTPOSPLUS:
2627     case OP_NOTPOSPLUSI:
2628 
2629     case OP_EXACT:
2630     case OP_EXACTI:
2631     case OP_NOTEXACT:
2632     case OP_NOTEXACTI:
2633 
2634     case OP_TYPEPLUS:
2635     case OP_TYPEMINPLUS:
2636     case OP_TYPEPOSPLUS:
2637     case OP_TYPEEXACT:
2638 
2639     return FALSE;
2640 
2641     /* These are going to continue, as they may be empty, but we have to
2642     fudge the length for the \p and \P cases. */
2643 
2644     case OP_TYPESTAR:
2645     case OP_TYPEMINSTAR:
2646     case OP_TYPEPOSSTAR:
2647     case OP_TYPEQUERY:
2648     case OP_TYPEMINQUERY:
2649     case OP_TYPEPOSQUERY:
2650     if (code[1] == OP_PROP || code[1] == OP_NOTPROP) code += 2;
2651     break;
2652 
2653     /* Same for these */
2654 
2655     case OP_TYPEUPTO:
2656     case OP_TYPEMINUPTO:
2657     case OP_TYPEPOSUPTO:
2658     if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
2659       code += 2;
2660     break;
2661 
2662     /* End of branch */
2663 
2664     case OP_KET:
2665     case OP_KETRMAX:
2666     case OP_KETRMIN:
2667     case OP_KETRPOS:
2668     case OP_ALT:
2669     return TRUE;
2670 
2671     /* In UTF-8 mode, STAR, MINSTAR, POSSTAR, QUERY, MINQUERY, POSQUERY, UPTO,
2672     MINUPTO, and POSUPTO and their caseless and negative versions may be
2673     followed by a multibyte character. */
2674 
2675 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
2676     case OP_STAR:
2677     case OP_STARI:
2678     case OP_NOTSTAR:
2679     case OP_NOTSTARI:
2680 
2681     case OP_MINSTAR:
2682     case OP_MINSTARI:
2683     case OP_NOTMINSTAR:
2684     case OP_NOTMINSTARI:
2685 
2686     case OP_POSSTAR:
2687     case OP_POSSTARI:
2688     case OP_NOTPOSSTAR:
2689     case OP_NOTPOSSTARI:
2690 
2691     case OP_QUERY:
2692     case OP_QUERYI:
2693     case OP_NOTQUERY:
2694     case OP_NOTQUERYI:
2695 
2696     case OP_MINQUERY:
2697     case OP_MINQUERYI:
2698     case OP_NOTMINQUERY:
2699     case OP_NOTMINQUERYI:
2700 
2701     case OP_POSQUERY:
2702     case OP_POSQUERYI:
2703     case OP_NOTPOSQUERY:
2704     case OP_NOTPOSQUERYI:
2705 
2706     if (utf && HAS_EXTRALEN(code[1])) code += GET_EXTRALEN(code[1]);
2707     break;
2708 
2709     case OP_UPTO:
2710     case OP_UPTOI:
2711     case OP_NOTUPTO:
2712     case OP_NOTUPTOI:
2713 
2714     case OP_MINUPTO:
2715     case OP_MINUPTOI:
2716     case OP_NOTMINUPTO:
2717     case OP_NOTMINUPTOI:
2718 
2719     case OP_POSUPTO:
2720     case OP_POSUPTOI:
2721     case OP_NOTPOSUPTO:
2722     case OP_NOTPOSUPTOI:
2723 
2724     if (utf && HAS_EXTRALEN(code[1 + IMM2_SIZE])) code += GET_EXTRALEN(code[1 + IMM2_SIZE]);
2725     break;
2726 #endif
2727 
2728     /* MARK, and PRUNE/SKIP/THEN with an argument must skip over the argument
2729     string. */
2730 
2731     case OP_MARK:
2732     case OP_PRUNE_ARG:
2733     case OP_SKIP_ARG:
2734     case OP_THEN_ARG:
2735     code += code[1];
2736     break;
2737 
2738     /* None of the remaining opcodes are required to match a character. */
2739 
2740     default:
2741     break;
2742     }
2743   }
2744 
2745 return TRUE;
2746 }
2747 
2748 
2749 
2750 /*************************************************
2751 *    Scan compiled regex for non-emptiness       *
2752 *************************************************/
2753 
2754 /* This function is called to check for left recursive calls. We want to check
2755 the current branch of the current pattern to see if it could match the empty
2756 string. If it could, we must look outwards for branches at other levels,
2757 stopping when we pass beyond the bracket which is the subject of the recursion.
2758 This function is called only during the real compile, not during the
2759 pre-compile.
2760 
2761 Arguments:
2762   code        points to start of the recursion
2763   endcode     points to where to stop (current RECURSE item)
2764   bcptr       points to the chain of current (unclosed) branch starts
2765   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
2766   cd          pointers to tables etc
2767 
2768 Returns:      TRUE if what is matched could be empty
2769 */
2770 
2771 static BOOL
could_be_empty(const pcre_uchar * code,const pcre_uchar * endcode,branch_chain * bcptr,BOOL utf,compile_data * cd)2772 could_be_empty(const pcre_uchar *code, const pcre_uchar *endcode,
2773   branch_chain *bcptr, BOOL utf, compile_data *cd)
2774 {
2775 while (bcptr != NULL && bcptr->current_branch >= code)
2776   {
2777   if (!could_be_empty_branch(bcptr->current_branch, endcode, utf, cd, NULL))
2778     return FALSE;
2779   bcptr = bcptr->outer;
2780   }
2781 return TRUE;
2782 }
2783 
2784 
2785 
2786 /*************************************************
2787 *        Base opcode of repeated opcodes         *
2788 *************************************************/
2789 
2790 /* Returns the base opcode for repeated single character type opcodes. If the
2791 opcode is not a repeated character type, it returns with the original value.
2792 
2793 Arguments:  c opcode
2794 Returns:    base opcode for the type
2795 */
2796 
2797 static pcre_uchar
get_repeat_base(pcre_uchar c)2798 get_repeat_base(pcre_uchar c)
2799 {
2800 return (c > OP_TYPEPOSUPTO)? c :
2801        (c >= OP_TYPESTAR)?   OP_TYPESTAR :
2802        (c >= OP_NOTSTARI)?   OP_NOTSTARI :
2803        (c >= OP_NOTSTAR)?    OP_NOTSTAR :
2804        (c >= OP_STARI)?      OP_STARI :
2805                              OP_STAR;
2806 }
2807 
2808 
2809 
2810 #ifdef SUPPORT_UCP
2811 /*************************************************
2812 *        Check a character and a property        *
2813 *************************************************/
2814 
2815 /* This function is called by check_auto_possessive() when a property item
2816 is adjacent to a fixed character.
2817 
2818 Arguments:
2819   c            the character
2820   ptype        the property type
2821   pdata        the data for the type
2822   negated      TRUE if it's a negated property (\P or \p{^)
2823 
2824 Returns:       TRUE if auto-possessifying is OK
2825 */
2826 
2827 static BOOL
check_char_prop(pcre_uint32 c,unsigned int ptype,unsigned int pdata,BOOL negated)2828 check_char_prop(pcre_uint32 c, unsigned int ptype, unsigned int pdata,
2829   BOOL negated)
2830 {
2831 const pcre_uint32 *p;
2832 const ucd_record *prop = GET_UCD(c);
2833 
2834 switch(ptype)
2835   {
2836   case PT_LAMP:
2837   return (prop->chartype == ucp_Lu ||
2838           prop->chartype == ucp_Ll ||
2839           prop->chartype == ucp_Lt) == negated;
2840 
2841   case PT_GC:
2842   return (pdata == PRIV(ucp_gentype)[prop->chartype]) == negated;
2843 
2844   case PT_PC:
2845   return (pdata == prop->chartype) == negated;
2846 
2847   case PT_SC:
2848   return (pdata == prop->script) == negated;
2849 
2850   /* These are specials */
2851 
2852   case PT_ALNUM:
2853   return (PRIV(ucp_gentype)[prop->chartype] == ucp_L ||
2854           PRIV(ucp_gentype)[prop->chartype] == ucp_N) == negated;
2855 
2856   /* Perl space used to exclude VT, but from Perl 5.18 it is included, which
2857   means that Perl space and POSIX space are now identical. PCRE was changed
2858   at release 8.34. */
2859 
2860   case PT_SPACE:    /* Perl space */
2861   case PT_PXSPACE:  /* POSIX space */
2862   switch(c)
2863     {
2864     HSPACE_CASES:
2865     VSPACE_CASES:
2866     return negated;
2867 
2868     default:
2869     return (PRIV(ucp_gentype)[prop->chartype] == ucp_Z) == negated;
2870     }
2871   break;  /* Control never reaches here */
2872 
2873   case PT_WORD:
2874   return (PRIV(ucp_gentype)[prop->chartype] == ucp_L ||
2875           PRIV(ucp_gentype)[prop->chartype] == ucp_N ||
2876           c == CHAR_UNDERSCORE) == negated;
2877 
2878   case PT_CLIST:
2879   p = PRIV(ucd_caseless_sets) + prop->caseset;
2880   for (;;)
2881     {
2882     if (c < *p) return !negated;
2883     if (c == *p++) return negated;
2884     }
2885   break;  /* Control never reaches here */
2886   }
2887 
2888 return FALSE;
2889 }
2890 #endif  /* SUPPORT_UCP */
2891 
2892 
2893 
2894 /*************************************************
2895 *        Fill the character property list        *
2896 *************************************************/
2897 
2898 /* Checks whether the code points to an opcode that can take part in auto-
2899 possessification, and if so, fills a list with its properties.
2900 
2901 Arguments:
2902   code        points to start of expression
2903   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
2904   fcc         points to case-flipping table
2905   list        points to output list
2906               list[0] will be filled with the opcode
2907               list[1] will be non-zero if this opcode
2908                 can match an empty character string
2909               list[2..7] depends on the opcode
2910 
2911 Returns:      points to the start of the next opcode if *code is accepted
2912               NULL if *code is not accepted
2913 */
2914 
2915 static const pcre_uchar *
get_chr_property_list(const pcre_uchar * code,BOOL utf,const pcre_uint8 * fcc,pcre_uint32 * list)2916 get_chr_property_list(const pcre_uchar *code, BOOL utf,
2917   const pcre_uint8 *fcc, pcre_uint32 *list)
2918 {
2919 pcre_uchar c = *code;
2920 pcre_uchar base;
2921 const pcre_uchar *end;
2922 pcre_uint32 chr;
2923 
2924 #ifdef SUPPORT_UCP
2925 pcre_uint32 *clist_dest;
2926 const pcre_uint32 *clist_src;
2927 #else
2928 utf = utf;  /* Suppress "unused parameter" compiler warning */
2929 #endif
2930 
2931 list[0] = c;
2932 list[1] = FALSE;
2933 code++;
2934 
2935 if (c >= OP_STAR && c <= OP_TYPEPOSUPTO)
2936   {
2937   base = get_repeat_base(c);
2938   c -= (base - OP_STAR);
2939 
2940   if (c == OP_UPTO || c == OP_MINUPTO || c == OP_EXACT || c == OP_POSUPTO)
2941     code += IMM2_SIZE;
2942 
2943   list[1] = (c != OP_PLUS && c != OP_MINPLUS && c != OP_EXACT && c != OP_POSPLUS);
2944 
2945   switch(base)
2946     {
2947     case OP_STAR:
2948     list[0] = OP_CHAR;
2949     break;
2950 
2951     case OP_STARI:
2952     list[0] = OP_CHARI;
2953     break;
2954 
2955     case OP_NOTSTAR:
2956     list[0] = OP_NOT;
2957     break;
2958 
2959     case OP_NOTSTARI:
2960     list[0] = OP_NOTI;
2961     break;
2962 
2963     case OP_TYPESTAR:
2964     list[0] = *code;
2965     code++;
2966     break;
2967     }
2968   c = list[0];
2969   }
2970 
2971 switch(c)
2972   {
2973   case OP_NOT_DIGIT:
2974   case OP_DIGIT:
2975   case OP_NOT_WHITESPACE:
2976   case OP_WHITESPACE:
2977   case OP_NOT_WORDCHAR:
2978   case OP_WORDCHAR:
2979   case OP_ANY:
2980   case OP_ALLANY:
2981   case OP_ANYNL:
2982   case OP_NOT_HSPACE:
2983   case OP_HSPACE:
2984   case OP_NOT_VSPACE:
2985   case OP_VSPACE:
2986   case OP_EXTUNI:
2987   case OP_EODN:
2988   case OP_EOD:
2989   case OP_DOLL:
2990   case OP_DOLLM:
2991   return code;
2992 
2993   case OP_CHAR:
2994   case OP_NOT:
2995   GETCHARINCTEST(chr, code);
2996   list[2] = chr;
2997   list[3] = NOTACHAR;
2998   return code;
2999 
3000   case OP_CHARI:
3001   case OP_NOTI:
3002   list[0] = (c == OP_CHARI) ? OP_CHAR : OP_NOT;
3003   GETCHARINCTEST(chr, code);
3004   list[2] = chr;
3005 
3006 #ifdef SUPPORT_UCP
3007   if (chr < 128 || (chr < 256 && !utf))
3008     list[3] = fcc[chr];
3009   else
3010     list[3] = UCD_OTHERCASE(chr);
3011 #elif defined SUPPORT_UTF || !defined COMPILE_PCRE8
3012   list[3] = (chr < 256) ? fcc[chr] : chr;
3013 #else
3014   list[3] = fcc[chr];
3015 #endif
3016 
3017   /* The othercase might be the same value. */
3018 
3019   if (chr == list[3])
3020     list[3] = NOTACHAR;
3021   else
3022     list[4] = NOTACHAR;
3023   return code;
3024 
3025 #ifdef SUPPORT_UCP
3026   case OP_PROP:
3027   case OP_NOTPROP:
3028   if (code[0] != PT_CLIST)
3029     {
3030     list[2] = code[0];
3031     list[3] = code[1];
3032     return code + 2;
3033     }
3034 
3035   /* Convert only if we have enough space. */
3036 
3037   clist_src = PRIV(ucd_caseless_sets) + code[1];
3038   clist_dest = list + 2;
3039   code += 2;
3040 
3041   do {
3042      if (clist_dest >= list + 8)
3043        {
3044        /* Early return if there is not enough space. This should never
3045        happen, since all clists are shorter than 5 character now. */
3046        list[2] = code[0];
3047        list[3] = code[1];
3048        return code;
3049        }
3050      *clist_dest++ = *clist_src;
3051      }
3052   while(*clist_src++ != NOTACHAR);
3053 
3054   /* All characters are stored. The terminating NOTACHAR
3055   is copied form the clist itself. */
3056 
3057   list[0] = (c == OP_PROP) ? OP_CHAR : OP_NOT;
3058   return code;
3059 #endif
3060 
3061   case OP_NCLASS:
3062   case OP_CLASS:
3063 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3064   case OP_XCLASS:
3065   if (c == OP_XCLASS)
3066     end = code + GET(code, 0) - 1;
3067   else
3068 #endif
3069     end = code + 32 / sizeof(pcre_uchar);
3070 
3071   switch(*end)
3072     {
3073     case OP_CRSTAR:
3074     case OP_CRMINSTAR:
3075     case OP_CRQUERY:
3076     case OP_CRMINQUERY:
3077     case OP_CRPOSSTAR:
3078     case OP_CRPOSQUERY:
3079     list[1] = TRUE;
3080     end++;
3081     break;
3082 
3083     case OP_CRPLUS:
3084     case OP_CRMINPLUS:
3085     case OP_CRPOSPLUS:
3086     end++;
3087     break;
3088 
3089     case OP_CRRANGE:
3090     case OP_CRMINRANGE:
3091     case OP_CRPOSRANGE:
3092     list[1] = (GET2(end, 1) == 0);
3093     end += 1 + 2 * IMM2_SIZE;
3094     break;
3095     }
3096   list[2] = (pcre_uint32)(end - code);
3097   return end;
3098   }
3099 return NULL;    /* Opcode not accepted */
3100 }
3101 
3102 
3103 
3104 /*************************************************
3105 *    Scan further character sets for match       *
3106 *************************************************/
3107 
3108 /* Checks whether the base and the current opcode have a common character, in
3109 which case the base cannot be possessified.
3110 
3111 Arguments:
3112   code        points to the byte code
3113   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
3114   cd          static compile data
3115   base_list   the data list of the base opcode
3116 
3117 Returns:      TRUE if the auto-possessification is possible
3118 */
3119 
3120 static BOOL
compare_opcodes(const pcre_uchar * code,BOOL utf,const compile_data * cd,const pcre_uint32 * base_list,const pcre_uchar * base_end,int * rec_limit)3121 compare_opcodes(const pcre_uchar *code, BOOL utf, const compile_data *cd,
3122   const pcre_uint32 *base_list, const pcre_uchar *base_end, int *rec_limit)
3123 {
3124 pcre_uchar c;
3125 pcre_uint32 list[8];
3126 const pcre_uint32 *chr_ptr;
3127 const pcre_uint32 *ochr_ptr;
3128 const pcre_uint32 *list_ptr;
3129 const pcre_uchar *next_code;
3130 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3131 const pcre_uchar *xclass_flags;
3132 #endif
3133 const pcre_uint8 *class_bitset;
3134 const pcre_uint8 *set1, *set2, *set_end;
3135 pcre_uint32 chr;
3136 BOOL accepted, invert_bits;
3137 BOOL entered_a_group = FALSE;
3138 
3139 if (*rec_limit == 0) return FALSE;
3140 --(*rec_limit);
3141 
3142 /* Note: the base_list[1] contains whether the current opcode has greedy
3143 (represented by a non-zero value) quantifier. This is a different from
3144 other character type lists, which stores here that the character iterator
3145 matches to an empty string (also represented by a non-zero value). */
3146 
3147 for(;;)
3148   {
3149   /* All operations move the code pointer forward.
3150   Therefore infinite recursions are not possible. */
3151 
3152   c = *code;
3153 
3154   /* Skip over callouts */
3155 
3156   if (c == OP_CALLOUT)
3157     {
3158     code += PRIV(OP_lengths)[c];
3159     continue;
3160     }
3161 
3162   if (c == OP_ALT)
3163     {
3164     do code += GET(code, 1); while (*code == OP_ALT);
3165     c = *code;
3166     }
3167 
3168   switch(c)
3169     {
3170     case OP_END:
3171     case OP_KETRPOS:
3172     /* TRUE only in greedy case. The non-greedy case could be replaced by
3173     an OP_EXACT, but it is probably not worth it. (And note that OP_EXACT
3174     uses more memory, which we cannot get at this stage.) */
3175 
3176     return base_list[1] != 0;
3177 
3178     case OP_KET:
3179     /* If the bracket is capturing, and referenced by an OP_RECURSE, or
3180     it is an atomic sub-pattern (assert, once, etc.) the non-greedy case
3181     cannot be converted to a possessive form. */
3182 
3183     if (base_list[1] == 0) return FALSE;
3184 
3185     switch(*(code - GET(code, 1)))
3186       {
3187       case OP_ASSERT:
3188       case OP_ASSERT_NOT:
3189       case OP_ASSERTBACK:
3190       case OP_ASSERTBACK_NOT:
3191       case OP_ONCE:
3192       case OP_ONCE_NC:
3193       /* Atomic sub-patterns and assertions can always auto-possessify their
3194       last iterator. However, if the group was entered as a result of checking
3195       a previous iterator, this is not possible. */
3196 
3197       return !entered_a_group;
3198       }
3199 
3200     code += PRIV(OP_lengths)[c];
3201     continue;
3202 
3203     case OP_ONCE:
3204     case OP_ONCE_NC:
3205     case OP_BRA:
3206     case OP_CBRA:
3207     next_code = code + GET(code, 1);
3208     code += PRIV(OP_lengths)[c];
3209 
3210     while (*next_code == OP_ALT)
3211       {
3212       if (!compare_opcodes(code, utf, cd, base_list, base_end, rec_limit))
3213         return FALSE;
3214       code = next_code + 1 + LINK_SIZE;
3215       next_code += GET(next_code, 1);
3216       }
3217 
3218     entered_a_group = TRUE;
3219     continue;
3220 
3221     case OP_BRAZERO:
3222     case OP_BRAMINZERO:
3223 
3224     next_code = code + 1;
3225     if (*next_code != OP_BRA && *next_code != OP_CBRA
3226         && *next_code != OP_ONCE && *next_code != OP_ONCE_NC) return FALSE;
3227 
3228     do next_code += GET(next_code, 1); while (*next_code == OP_ALT);
3229 
3230     /* The bracket content will be checked by the
3231     OP_BRA/OP_CBRA case above. */
3232     next_code += 1 + LINK_SIZE;
3233     if (!compare_opcodes(next_code, utf, cd, base_list, base_end, rec_limit))
3234       return FALSE;
3235 
3236     code += PRIV(OP_lengths)[c];
3237     continue;
3238 
3239     default:
3240     break;
3241     }
3242 
3243   /* Check for a supported opcode, and load its properties. */
3244 
3245   code = get_chr_property_list(code, utf, cd->fcc, list);
3246   if (code == NULL) return FALSE;    /* Unsupported */
3247 
3248   /* If either opcode is a small character list, set pointers for comparing
3249   characters from that list with another list, or with a property. */
3250 
3251   if (base_list[0] == OP_CHAR)
3252     {
3253     chr_ptr = base_list + 2;
3254     list_ptr = list;
3255     }
3256   else if (list[0] == OP_CHAR)
3257     {
3258     chr_ptr = list + 2;
3259     list_ptr = base_list;
3260     }
3261 
3262   /* Character bitsets can also be compared to certain opcodes. */
3263 
3264   else if (base_list[0] == OP_CLASS || list[0] == OP_CLASS
3265 #ifdef COMPILE_PCRE8
3266       /* In 8 bit, non-UTF mode, OP_CLASS and OP_NCLASS are the same. */
3267       || (!utf && (base_list[0] == OP_NCLASS || list[0] == OP_NCLASS))
3268 #endif
3269       )
3270     {
3271 #ifdef COMPILE_PCRE8
3272     if (base_list[0] == OP_CLASS || (!utf && base_list[0] == OP_NCLASS))
3273 #else
3274     if (base_list[0] == OP_CLASS)
3275 #endif
3276       {
3277       set1 = (pcre_uint8 *)(base_end - base_list[2]);
3278       list_ptr = list;
3279       }
3280     else
3281       {
3282       set1 = (pcre_uint8 *)(code - list[2]);
3283       list_ptr = base_list;
3284       }
3285 
3286     invert_bits = FALSE;
3287     switch(list_ptr[0])
3288       {
3289       case OP_CLASS:
3290       case OP_NCLASS:
3291       set2 = (pcre_uint8 *)
3292         ((list_ptr == list ? code : base_end) - list_ptr[2]);
3293       break;
3294 
3295 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3296       case OP_XCLASS:
3297       xclass_flags = (list_ptr == list ? code : base_end) - list_ptr[2] + LINK_SIZE;
3298       if ((*xclass_flags & XCL_HASPROP) != 0) return FALSE;
3299       if ((*xclass_flags & XCL_MAP) == 0)
3300         {
3301         /* No bits are set for characters < 256. */
3302         if (list[1] == 0) return TRUE;
3303         /* Might be an empty repeat. */
3304         continue;
3305         }
3306       set2 = (pcre_uint8 *)(xclass_flags + 1);
3307       break;
3308 #endif
3309 
3310       case OP_NOT_DIGIT:
3311       invert_bits = TRUE;
3312       /* Fall through */
3313       case OP_DIGIT:
3314       set2 = (pcre_uint8 *)(cd->cbits + cbit_digit);
3315       break;
3316 
3317       case OP_NOT_WHITESPACE:
3318       invert_bits = TRUE;
3319       /* Fall through */
3320       case OP_WHITESPACE:
3321       set2 = (pcre_uint8 *)(cd->cbits + cbit_space);
3322       break;
3323 
3324       case OP_NOT_WORDCHAR:
3325       invert_bits = TRUE;
3326       /* Fall through */
3327       case OP_WORDCHAR:
3328       set2 = (pcre_uint8 *)(cd->cbits + cbit_word);
3329       break;
3330 
3331       default:
3332       return FALSE;
3333       }
3334 
3335     /* Because the sets are unaligned, we need
3336     to perform byte comparison here. */
3337     set_end = set1 + 32;
3338     if (invert_bits)
3339       {
3340       do
3341         {
3342         if ((*set1++ & ~(*set2++)) != 0) return FALSE;
3343         }
3344       while (set1 < set_end);
3345       }
3346     else
3347       {
3348       do
3349         {
3350         if ((*set1++ & *set2++) != 0) return FALSE;
3351         }
3352       while (set1 < set_end);
3353       }
3354 
3355     if (list[1] == 0) return TRUE;
3356     /* Might be an empty repeat. */
3357     continue;
3358     }
3359 
3360   /* Some property combinations also acceptable. Unicode property opcodes are
3361   processed specially; the rest can be handled with a lookup table. */
3362 
3363   else
3364     {
3365     pcre_uint32 leftop, rightop;
3366 
3367     leftop = base_list[0];
3368     rightop = list[0];
3369 
3370 #ifdef SUPPORT_UCP
3371     accepted = FALSE; /* Always set in non-unicode case. */
3372     if (leftop == OP_PROP || leftop == OP_NOTPROP)
3373       {
3374       if (rightop == OP_EOD)
3375         accepted = TRUE;
3376       else if (rightop == OP_PROP || rightop == OP_NOTPROP)
3377         {
3378         int n;
3379         const pcre_uint8 *p;
3380         BOOL same = leftop == rightop;
3381         BOOL lisprop = leftop == OP_PROP;
3382         BOOL risprop = rightop == OP_PROP;
3383         BOOL bothprop = lisprop && risprop;
3384 
3385         /* There's a table that specifies how each combination is to be
3386         processed:
3387           0   Always return FALSE (never auto-possessify)
3388           1   Character groups are distinct (possessify if both are OP_PROP)
3389           2   Check character categories in the same group (general or particular)
3390           3   Return TRUE if the two opcodes are not the same
3391           ... see comments below
3392         */
3393 
3394         n = propposstab[base_list[2]][list[2]];
3395         switch(n)
3396           {
3397           case 0: break;
3398           case 1: accepted = bothprop; break;
3399           case 2: accepted = (base_list[3] == list[3]) != same; break;
3400           case 3: accepted = !same; break;
3401 
3402           case 4:  /* Left general category, right particular category */
3403           accepted = risprop && catposstab[base_list[3]][list[3]] == same;
3404           break;
3405 
3406           case 5:  /* Right general category, left particular category */
3407           accepted = lisprop && catposstab[list[3]][base_list[3]] == same;
3408           break;
3409 
3410           /* This code is logically tricky. Think hard before fiddling with it.
3411           The posspropstab table has four entries per row. Each row relates to
3412           one of PCRE's special properties such as ALNUM or SPACE or WORD.
3413           Only WORD actually needs all four entries, but using repeats for the
3414           others means they can all use the same code below.
3415 
3416           The first two entries in each row are Unicode general categories, and
3417           apply always, because all the characters they include are part of the
3418           PCRE character set. The third and fourth entries are a general and a
3419           particular category, respectively, that include one or more relevant
3420           characters. One or the other is used, depending on whether the check
3421           is for a general or a particular category. However, in both cases the
3422           category contains more characters than the specials that are defined
3423           for the property being tested against. Therefore, it cannot be used
3424           in a NOTPROP case.
3425 
3426           Example: the row for WORD contains ucp_L, ucp_N, ucp_P, ucp_Po.
3427           Underscore is covered by ucp_P or ucp_Po. */
3428 
3429           case 6:  /* Left alphanum vs right general category */
3430           case 7:  /* Left space vs right general category */
3431           case 8:  /* Left word vs right general category */
3432           p = posspropstab[n-6];
3433           accepted = risprop && lisprop ==
3434             (list[3] != p[0] &&
3435              list[3] != p[1] &&
3436             (list[3] != p[2] || !lisprop));
3437           break;
3438 
3439           case 9:   /* Right alphanum vs left general category */
3440           case 10:  /* Right space vs left general category */
3441           case 11:  /* Right word vs left general category */
3442           p = posspropstab[n-9];
3443           accepted = lisprop && risprop ==
3444             (base_list[3] != p[0] &&
3445              base_list[3] != p[1] &&
3446             (base_list[3] != p[2] || !risprop));
3447           break;
3448 
3449           case 12:  /* Left alphanum vs right particular category */
3450           case 13:  /* Left space vs right particular category */
3451           case 14:  /* Left word vs right particular category */
3452           p = posspropstab[n-12];
3453           accepted = risprop && lisprop ==
3454             (catposstab[p[0]][list[3]] &&
3455              catposstab[p[1]][list[3]] &&
3456             (list[3] != p[3] || !lisprop));
3457           break;
3458 
3459           case 15:  /* Right alphanum vs left particular category */
3460           case 16:  /* Right space vs left particular category */
3461           case 17:  /* Right word vs left particular category */
3462           p = posspropstab[n-15];
3463           accepted = lisprop && risprop ==
3464             (catposstab[p[0]][base_list[3]] &&
3465              catposstab[p[1]][base_list[3]] &&
3466             (base_list[3] != p[3] || !risprop));
3467           break;
3468           }
3469         }
3470       }
3471 
3472     else
3473 #endif  /* SUPPORT_UCP */
3474 
3475     accepted = leftop >= FIRST_AUTOTAB_OP && leftop <= LAST_AUTOTAB_LEFT_OP &&
3476            rightop >= FIRST_AUTOTAB_OP && rightop <= LAST_AUTOTAB_RIGHT_OP &&
3477            autoposstab[leftop - FIRST_AUTOTAB_OP][rightop - FIRST_AUTOTAB_OP];
3478 
3479     if (!accepted) return FALSE;
3480 
3481     if (list[1] == 0) return TRUE;
3482     /* Might be an empty repeat. */
3483     continue;
3484     }
3485 
3486   /* Control reaches here only if one of the items is a small character list.
3487   All characters are checked against the other side. */
3488 
3489   do
3490     {
3491     chr = *chr_ptr;
3492 
3493     switch(list_ptr[0])
3494       {
3495       case OP_CHAR:
3496       ochr_ptr = list_ptr + 2;
3497       do
3498         {
3499         if (chr == *ochr_ptr) return FALSE;
3500         ochr_ptr++;
3501         }
3502       while(*ochr_ptr != NOTACHAR);
3503       break;
3504 
3505       case OP_NOT:
3506       ochr_ptr = list_ptr + 2;
3507       do
3508         {
3509         if (chr == *ochr_ptr)
3510           break;
3511         ochr_ptr++;
3512         }
3513       while(*ochr_ptr != NOTACHAR);
3514       if (*ochr_ptr == NOTACHAR) return FALSE;   /* Not found */
3515       break;
3516 
3517       /* Note that OP_DIGIT etc. are generated only when PCRE_UCP is *not*
3518       set. When it is set, \d etc. are converted into OP_(NOT_)PROP codes. */
3519 
3520       case OP_DIGIT:
3521       if (chr < 256 && (cd->ctypes[chr] & ctype_digit) != 0) return FALSE;
3522       break;
3523 
3524       case OP_NOT_DIGIT:
3525       if (chr > 255 || (cd->ctypes[chr] & ctype_digit) == 0) return FALSE;
3526       break;
3527 
3528       case OP_WHITESPACE:
3529       if (chr < 256 && (cd->ctypes[chr] & ctype_space) != 0) return FALSE;
3530       break;
3531 
3532       case OP_NOT_WHITESPACE:
3533       if (chr > 255 || (cd->ctypes[chr] & ctype_space) == 0) return FALSE;
3534       break;
3535 
3536       case OP_WORDCHAR:
3537       if (chr < 255 && (cd->ctypes[chr] & ctype_word) != 0) return FALSE;
3538       break;
3539 
3540       case OP_NOT_WORDCHAR:
3541       if (chr > 255 || (cd->ctypes[chr] & ctype_word) == 0) return FALSE;
3542       break;
3543 
3544       case OP_HSPACE:
3545       switch(chr)
3546         {
3547         HSPACE_CASES: return FALSE;
3548         default: break;
3549         }
3550       break;
3551 
3552       case OP_NOT_HSPACE:
3553       switch(chr)
3554         {
3555         HSPACE_CASES: break;
3556         default: return FALSE;
3557         }
3558       break;
3559 
3560       case OP_ANYNL:
3561       case OP_VSPACE:
3562       switch(chr)
3563         {
3564         VSPACE_CASES: return FALSE;
3565         default: break;
3566         }
3567       break;
3568 
3569       case OP_NOT_VSPACE:
3570       switch(chr)
3571         {
3572         VSPACE_CASES: break;
3573         default: return FALSE;
3574         }
3575       break;
3576 
3577       case OP_DOLL:
3578       case OP_EODN:
3579       switch (chr)
3580         {
3581         case CHAR_CR:
3582         case CHAR_LF:
3583         case CHAR_VT:
3584         case CHAR_FF:
3585         case CHAR_NEL:
3586 #ifndef EBCDIC
3587         case 0x2028:
3588         case 0x2029:
3589 #endif  /* Not EBCDIC */
3590         return FALSE;
3591         }
3592       break;
3593 
3594       case OP_EOD:    /* Can always possessify before \z */
3595       break;
3596 
3597 #ifdef SUPPORT_UCP
3598       case OP_PROP:
3599       case OP_NOTPROP:
3600       if (!check_char_prop(chr, list_ptr[2], list_ptr[3],
3601             list_ptr[0] == OP_NOTPROP))
3602         return FALSE;
3603       break;
3604 #endif
3605 
3606       case OP_NCLASS:
3607       if (chr > 255) return FALSE;
3608       /* Fall through */
3609 
3610       case OP_CLASS:
3611       if (chr > 255) break;
3612       class_bitset = (pcre_uint8 *)
3613         ((list_ptr == list ? code : base_end) - list_ptr[2]);
3614       if ((class_bitset[chr >> 3] & (1 << (chr & 7))) != 0) return FALSE;
3615       break;
3616 
3617 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3618       case OP_XCLASS:
3619       if (PRIV(xclass)(chr, (list_ptr == list ? code : base_end) -
3620           list_ptr[2] + LINK_SIZE, utf)) return FALSE;
3621       break;
3622 #endif
3623 
3624       default:
3625       return FALSE;
3626       }
3627 
3628     chr_ptr++;
3629     }
3630   while(*chr_ptr != NOTACHAR);
3631 
3632   /* At least one character must be matched from this opcode. */
3633 
3634   if (list[1] == 0) return TRUE;
3635   }
3636 
3637 /* Control never reaches here. There used to be a fail-save return FALSE; here,
3638 but some compilers complain about an unreachable statement. */
3639 
3640 }
3641 
3642 
3643 
3644 /*************************************************
3645 *    Scan compiled regex for auto-possession     *
3646 *************************************************/
3647 
3648 /* Replaces single character iterations with their possessive alternatives
3649 if appropriate. This function modifies the compiled opcode!
3650 
3651 Arguments:
3652   code        points to start of the byte code
3653   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
3654   cd          static compile data
3655 
3656 Returns:      nothing
3657 */
3658 
3659 static void
auto_possessify(pcre_uchar * code,BOOL utf,const compile_data * cd)3660 auto_possessify(pcre_uchar *code, BOOL utf, const compile_data *cd)
3661 {
3662 register pcre_uchar c;
3663 const pcre_uchar *end;
3664 pcre_uchar *repeat_opcode;
3665 pcre_uint32 list[8];
3666 int rec_limit;
3667 
3668 for (;;)
3669   {
3670   c = *code;
3671 
3672   /* When a pattern with bad UTF-8 encoding is compiled with NO_UTF_CHECK,
3673   it may compile without complaining, but may get into a loop here if the code
3674   pointer points to a bad value. This is, of course a documentated possibility,
3675   when NO_UTF_CHECK is set, so it isn't a bug, but we can detect this case and
3676   just give up on this optimization. */
3677 
3678   if (c >= OP_TABLE_LENGTH) return;
3679 
3680   if (c >= OP_STAR && c <= OP_TYPEPOSUPTO)
3681     {
3682     c -= get_repeat_base(c) - OP_STAR;
3683     end = (c <= OP_MINUPTO) ?
3684       get_chr_property_list(code, utf, cd->fcc, list) : NULL;
3685     list[1] = c == OP_STAR || c == OP_PLUS || c == OP_QUERY || c == OP_UPTO;
3686 
3687     rec_limit = 1000;
3688     if (end != NULL && compare_opcodes(end, utf, cd, list, end, &rec_limit))
3689       {
3690       switch(c)
3691         {
3692         case OP_STAR:
3693         *code += OP_POSSTAR - OP_STAR;
3694         break;
3695 
3696         case OP_MINSTAR:
3697         *code += OP_POSSTAR - OP_MINSTAR;
3698         break;
3699 
3700         case OP_PLUS:
3701         *code += OP_POSPLUS - OP_PLUS;
3702         break;
3703 
3704         case OP_MINPLUS:
3705         *code += OP_POSPLUS - OP_MINPLUS;
3706         break;
3707 
3708         case OP_QUERY:
3709         *code += OP_POSQUERY - OP_QUERY;
3710         break;
3711 
3712         case OP_MINQUERY:
3713         *code += OP_POSQUERY - OP_MINQUERY;
3714         break;
3715 
3716         case OP_UPTO:
3717         *code += OP_POSUPTO - OP_UPTO;
3718         break;
3719 
3720         case OP_MINUPTO:
3721         *code += OP_POSUPTO - OP_MINUPTO;
3722         break;
3723         }
3724       }
3725     c = *code;
3726     }
3727   else if (c == OP_CLASS || c == OP_NCLASS || c == OP_XCLASS)
3728     {
3729 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3730     if (c == OP_XCLASS)
3731       repeat_opcode = code + GET(code, 1);
3732     else
3733 #endif
3734       repeat_opcode = code + 1 + (32 / sizeof(pcre_uchar));
3735 
3736     c = *repeat_opcode;
3737     if (c >= OP_CRSTAR && c <= OP_CRMINRANGE)
3738       {
3739       /* end must not be NULL. */
3740       end = get_chr_property_list(code, utf, cd->fcc, list);
3741 
3742       list[1] = (c & 1) == 0;
3743 
3744       rec_limit = 1000;
3745       if (compare_opcodes(end, utf, cd, list, end, &rec_limit))
3746         {
3747         switch (c)
3748           {
3749           case OP_CRSTAR:
3750           case OP_CRMINSTAR:
3751           *repeat_opcode = OP_CRPOSSTAR;
3752           break;
3753 
3754           case OP_CRPLUS:
3755           case OP_CRMINPLUS:
3756           *repeat_opcode = OP_CRPOSPLUS;
3757           break;
3758 
3759           case OP_CRQUERY:
3760           case OP_CRMINQUERY:
3761           *repeat_opcode = OP_CRPOSQUERY;
3762           break;
3763 
3764           case OP_CRRANGE:
3765           case OP_CRMINRANGE:
3766           *repeat_opcode = OP_CRPOSRANGE;
3767           break;
3768           }
3769         }
3770       }
3771     c = *code;
3772     }
3773 
3774   switch(c)
3775     {
3776     case OP_END:
3777     return;
3778 
3779     case OP_TYPESTAR:
3780     case OP_TYPEMINSTAR:
3781     case OP_TYPEPLUS:
3782     case OP_TYPEMINPLUS:
3783     case OP_TYPEQUERY:
3784     case OP_TYPEMINQUERY:
3785     case OP_TYPEPOSSTAR:
3786     case OP_TYPEPOSPLUS:
3787     case OP_TYPEPOSQUERY:
3788     if (code[1] == OP_PROP || code[1] == OP_NOTPROP) code += 2;
3789     break;
3790 
3791     case OP_TYPEUPTO:
3792     case OP_TYPEMINUPTO:
3793     case OP_TYPEEXACT:
3794     case OP_TYPEPOSUPTO:
3795     if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
3796       code += 2;
3797     break;
3798 
3799 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
3800     case OP_XCLASS:
3801     code += GET(code, 1);
3802     break;
3803 #endif
3804 
3805     case OP_MARK:
3806     case OP_PRUNE_ARG:
3807     case OP_SKIP_ARG:
3808     case OP_THEN_ARG:
3809     code += code[1];
3810     break;
3811     }
3812 
3813   /* Add in the fixed length from the table */
3814 
3815   code += PRIV(OP_lengths)[c];
3816 
3817   /* In UTF-8 mode, opcodes that are followed by a character may be followed by
3818   a multi-byte character. The length in the table is a minimum, so we have to
3819   arrange to skip the extra bytes. */
3820 
3821 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
3822   if (utf) switch(c)
3823     {
3824     case OP_CHAR:
3825     case OP_CHARI:
3826     case OP_NOT:
3827     case OP_NOTI:
3828     case OP_STAR:
3829     case OP_MINSTAR:
3830     case OP_PLUS:
3831     case OP_MINPLUS:
3832     case OP_QUERY:
3833     case OP_MINQUERY:
3834     case OP_UPTO:
3835     case OP_MINUPTO:
3836     case OP_EXACT:
3837     case OP_POSSTAR:
3838     case OP_POSPLUS:
3839     case OP_POSQUERY:
3840     case OP_POSUPTO:
3841     case OP_STARI:
3842     case OP_MINSTARI:
3843     case OP_PLUSI:
3844     case OP_MINPLUSI:
3845     case OP_QUERYI:
3846     case OP_MINQUERYI:
3847     case OP_UPTOI:
3848     case OP_MINUPTOI:
3849     case OP_EXACTI:
3850     case OP_POSSTARI:
3851     case OP_POSPLUSI:
3852     case OP_POSQUERYI:
3853     case OP_POSUPTOI:
3854     case OP_NOTSTAR:
3855     case OP_NOTMINSTAR:
3856     case OP_NOTPLUS:
3857     case OP_NOTMINPLUS:
3858     case OP_NOTQUERY:
3859     case OP_NOTMINQUERY:
3860     case OP_NOTUPTO:
3861     case OP_NOTMINUPTO:
3862     case OP_NOTEXACT:
3863     case OP_NOTPOSSTAR:
3864     case OP_NOTPOSPLUS:
3865     case OP_NOTPOSQUERY:
3866     case OP_NOTPOSUPTO:
3867     case OP_NOTSTARI:
3868     case OP_NOTMINSTARI:
3869     case OP_NOTPLUSI:
3870     case OP_NOTMINPLUSI:
3871     case OP_NOTQUERYI:
3872     case OP_NOTMINQUERYI:
3873     case OP_NOTUPTOI:
3874     case OP_NOTMINUPTOI:
3875     case OP_NOTEXACTI:
3876     case OP_NOTPOSSTARI:
3877     case OP_NOTPOSPLUSI:
3878     case OP_NOTPOSQUERYI:
3879     case OP_NOTPOSUPTOI:
3880     if (HAS_EXTRALEN(code[-1])) code += GET_EXTRALEN(code[-1]);
3881     break;
3882     }
3883 #else
3884   (void)(utf);  /* Keep compiler happy by referencing function argument */
3885 #endif
3886   }
3887 }
3888 
3889 
3890 
3891 /*************************************************
3892 *           Check for POSIX class syntax         *
3893 *************************************************/
3894 
3895 /* This function is called when the sequence "[:" or "[." or "[=" is
3896 encountered in a character class. It checks whether this is followed by a
3897 sequence of characters terminated by a matching ":]" or ".]" or "=]". If we
3898 reach an unescaped ']' without the special preceding character, return FALSE.
3899 
3900 Originally, this function only recognized a sequence of letters between the
3901 terminators, but it seems that Perl recognizes any sequence of characters,
3902 though of course unknown POSIX names are subsequently rejected. Perl gives an
3903 "Unknown POSIX class" error for [:f\oo:] for example, where previously PCRE
3904 didn't consider this to be a POSIX class. Likewise for [:1234:].
3905 
3906 The problem in trying to be exactly like Perl is in the handling of escapes. We
3907 have to be sure that [abc[:x\]pqr] is *not* treated as containing a POSIX
3908 class, but [abc[:x\]pqr:]] is (so that an error can be generated). The code
3909 below handles the special cases \\ and \], but does not try to do any other
3910 escape processing. This makes it different from Perl for cases such as
3911 [:l\ower:] where Perl recognizes it as the POSIX class "lower" but PCRE does
3912 not recognize "l\ower". This is a lesser evil than not diagnosing bad classes
3913 when Perl does, I think.
3914 
3915 A user pointed out that PCRE was rejecting [:a[:digit:]] whereas Perl was not.
3916 It seems that the appearance of a nested POSIX class supersedes an apparent
3917 external class. For example, [:a[:digit:]b:] matches "a", "b", ":", or
3918 a digit.
3919 
3920 In Perl, unescaped square brackets may also appear as part of class names. For
3921 example, [:a[:abc]b:] gives unknown POSIX class "[:abc]b:]". However, for
3922 [:a[:abc]b][b:] it gives unknown POSIX class "[:abc]b][b:]", which does not
3923 seem right at all. PCRE does not allow closing square brackets in POSIX class
3924 names.
3925 
3926 Arguments:
3927   ptr      pointer to the initial [
3928   endptr   where to return the end pointer
3929 
3930 Returns:   TRUE or FALSE
3931 */
3932 
3933 static BOOL
check_posix_syntax(const pcre_uchar * ptr,const pcre_uchar ** endptr)3934 check_posix_syntax(const pcre_uchar *ptr, const pcre_uchar **endptr)
3935 {
3936 pcre_uchar terminator;          /* Don't combine these lines; the Solaris cc */
3937 terminator = *(++ptr);   /* compiler warns about "non-constant" initializer. */
3938 for (++ptr; *ptr != CHAR_NULL; ptr++)
3939   {
3940   if (*ptr == CHAR_BACKSLASH &&
3941       (ptr[1] == CHAR_RIGHT_SQUARE_BRACKET ||
3942        ptr[1] == CHAR_BACKSLASH))
3943     ptr++;
3944   else if ((*ptr == CHAR_LEFT_SQUARE_BRACKET && ptr[1] == terminator) ||
3945             *ptr == CHAR_RIGHT_SQUARE_BRACKET) return FALSE;
3946   else if (*ptr == terminator && ptr[1] == CHAR_RIGHT_SQUARE_BRACKET)
3947     {
3948     *endptr = ptr;
3949     return TRUE;
3950     }
3951   }
3952 return FALSE;
3953 }
3954 
3955 
3956 
3957 
3958 /*************************************************
3959 *          Check POSIX class name                *
3960 *************************************************/
3961 
3962 /* This function is called to check the name given in a POSIX-style class entry
3963 such as [:alnum:].
3964 
3965 Arguments:
3966   ptr        points to the first letter
3967   len        the length of the name
3968 
3969 Returns:     a value representing the name, or -1 if unknown
3970 */
3971 
3972 static int
check_posix_name(const pcre_uchar * ptr,int len)3973 check_posix_name(const pcre_uchar *ptr, int len)
3974 {
3975 const char *pn = posix_names;
3976 register int yield = 0;
3977 while (posix_name_lengths[yield] != 0)
3978   {
3979   if (len == posix_name_lengths[yield] &&
3980     STRNCMP_UC_C8(ptr, pn, (unsigned int)len) == 0) return yield;
3981   pn += posix_name_lengths[yield] + 1;
3982   yield++;
3983   }
3984 return -1;
3985 }
3986 
3987 
3988 /*************************************************
3989 *    Adjust OP_RECURSE items in repeated group   *
3990 *************************************************/
3991 
3992 /* OP_RECURSE items contain an offset from the start of the regex to the group
3993 that is referenced. This means that groups can be replicated for fixed
3994 repetition simply by copying (because the recursion is allowed to refer to
3995 earlier groups that are outside the current group). However, when a group is
3996 optional (i.e. the minimum quantifier is zero), OP_BRAZERO or OP_SKIPZERO is
3997 inserted before it, after it has been compiled. This means that any OP_RECURSE
3998 items within it that refer to the group itself or any contained groups have to
3999 have their offsets adjusted. That one of the jobs of this function. Before it
4000 is called, the partially compiled regex must be temporarily terminated with
4001 OP_END.
4002 
4003 This function has been extended to cope with forward references for recursions
4004 and subroutine calls. It must check the list of such references for the
4005 group we are dealing with. If it finds that one of the recursions in the
4006 current group is on this list, it does not adjust the value in the reference
4007 (which is a group number). After the group has been scanned, all the offsets in
4008 the forward reference list for the group are adjusted.
4009 
4010 Arguments:
4011   group      points to the start of the group
4012   adjust     the amount by which the group is to be moved
4013   utf        TRUE in UTF-8 / UTF-16 / UTF-32 mode
4014   cd         contains pointers to tables etc.
4015   save_hwm_offset   the hwm forward reference offset at the start of the group
4016 
4017 Returns:     nothing
4018 */
4019 
4020 static void
adjust_recurse(pcre_uchar * group,int adjust,BOOL utf,compile_data * cd,size_t save_hwm_offset)4021 adjust_recurse(pcre_uchar *group, int adjust, BOOL utf, compile_data *cd,
4022   size_t save_hwm_offset)
4023 {
4024 int offset;
4025 pcre_uchar *hc;
4026 pcre_uchar *ptr = group;
4027 
4028 while ((ptr = (pcre_uchar *)find_recurse(ptr, utf)) != NULL)
4029   {
4030   for (hc = (pcre_uchar *)cd->start_workspace + save_hwm_offset; hc < cd->hwm;
4031        hc += LINK_SIZE)
4032     {
4033     offset = (int)GET(hc, 0);
4034     if (cd->start_code + offset == ptr + 1) break;
4035     }
4036 
4037   /* If we have not found this recursion on the forward reference list, adjust
4038   the recursion's offset if it's after the start of this group. */
4039 
4040   if (hc >= cd->hwm)
4041     {
4042     offset = (int)GET(ptr, 1);
4043     if (cd->start_code + offset >= group) PUT(ptr, 1, offset + adjust);
4044     }
4045 
4046   ptr += 1 + LINK_SIZE;
4047   }
4048 
4049 /* Now adjust all forward reference offsets for the group. */
4050 
4051 for (hc = (pcre_uchar *)cd->start_workspace + save_hwm_offset; hc < cd->hwm;
4052      hc += LINK_SIZE)
4053   {
4054   offset = (int)GET(hc, 0);
4055   PUT(hc, 0, offset + adjust);
4056   }
4057 }
4058 
4059 
4060 
4061 /*************************************************
4062 *        Insert an automatic callout point       *
4063 *************************************************/
4064 
4065 /* This function is called when the PCRE_AUTO_CALLOUT option is set, to insert
4066 callout points before each pattern item.
4067 
4068 Arguments:
4069   code           current code pointer
4070   ptr            current pattern pointer
4071   cd             pointers to tables etc
4072 
4073 Returns:         new code pointer
4074 */
4075 
4076 static pcre_uchar *
auto_callout(pcre_uchar * code,const pcre_uchar * ptr,compile_data * cd)4077 auto_callout(pcre_uchar *code, const pcre_uchar *ptr, compile_data *cd)
4078 {
4079 *code++ = OP_CALLOUT;
4080 *code++ = 255;
4081 PUT(code, 0, (int)(ptr - cd->start_pattern));  /* Pattern offset */
4082 PUT(code, LINK_SIZE, 0);                       /* Default length */
4083 return code + 2 * LINK_SIZE;
4084 }
4085 
4086 
4087 
4088 /*************************************************
4089 *         Complete a callout item                *
4090 *************************************************/
4091 
4092 /* A callout item contains the length of the next item in the pattern, which
4093 we can't fill in till after we have reached the relevant point. This is used
4094 for both automatic and manual callouts.
4095 
4096 Arguments:
4097   previous_callout   points to previous callout item
4098   ptr                current pattern pointer
4099   cd                 pointers to tables etc
4100 
4101 Returns:             nothing
4102 */
4103 
4104 static void
complete_callout(pcre_uchar * previous_callout,const pcre_uchar * ptr,compile_data * cd)4105 complete_callout(pcre_uchar *previous_callout, const pcre_uchar *ptr, compile_data *cd)
4106 {
4107 int length = (int)(ptr - cd->start_pattern - GET(previous_callout, 2));
4108 PUT(previous_callout, 2 + LINK_SIZE, length);
4109 }
4110 
4111 
4112 
4113 #ifdef SUPPORT_UCP
4114 /*************************************************
4115 *           Get othercase range                  *
4116 *************************************************/
4117 
4118 /* This function is passed the start and end of a class range, in UTF-8 mode
4119 with UCP support. It searches up the characters, looking for ranges of
4120 characters in the "other" case. Each call returns the next one, updating the
4121 start address. A character with multiple other cases is returned on its own
4122 with a special return value.
4123 
4124 Arguments:
4125   cptr        points to starting character value; updated
4126   d           end value
4127   ocptr       where to put start of othercase range
4128   odptr       where to put end of othercase range
4129 
4130 Yield:        -1 when no more
4131                0 when a range is returned
4132               >0 the CASESET offset for char with multiple other cases
4133                 in this case, ocptr contains the original
4134 */
4135 
4136 static int
get_othercase_range(pcre_uint32 * cptr,pcre_uint32 d,pcre_uint32 * ocptr,pcre_uint32 * odptr)4137 get_othercase_range(pcre_uint32 *cptr, pcre_uint32 d, pcre_uint32 *ocptr,
4138   pcre_uint32 *odptr)
4139 {
4140 pcre_uint32 c, othercase, next;
4141 unsigned int co;
4142 
4143 /* Find the first character that has an other case. If it has multiple other
4144 cases, return its case offset value. */
4145 
4146 for (c = *cptr; c <= d; c++)
4147   {
4148   if ((co = UCD_CASESET(c)) != 0)
4149     {
4150     *ocptr = c++;   /* Character that has the set */
4151     *cptr = c;      /* Rest of input range */
4152     return (int)co;
4153     }
4154   if ((othercase = UCD_OTHERCASE(c)) != c) break;
4155   }
4156 
4157 if (c > d) return -1;  /* Reached end of range */
4158 
4159 /* Found a character that has a single other case. Search for the end of the
4160 range, which is either the end of the input range, or a character that has zero
4161 or more than one other cases. */
4162 
4163 *ocptr = othercase;
4164 next = othercase + 1;
4165 
4166 for (++c; c <= d; c++)
4167   {
4168   if ((co = UCD_CASESET(c)) != 0 || UCD_OTHERCASE(c) != next) break;
4169   next++;
4170   }
4171 
4172 *odptr = next - 1;     /* End of othercase range */
4173 *cptr = c;             /* Rest of input range */
4174 return 0;
4175 }
4176 #endif  /* SUPPORT_UCP */
4177 
4178 
4179 
4180 /*************************************************
4181 *        Add a character or range to a class     *
4182 *************************************************/
4183 
4184 /* This function packages up the logic of adding a character or range of
4185 characters to a class. The character values in the arguments will be within the
4186 valid values for the current mode (8-bit, 16-bit, UTF, etc). This function is
4187 mutually recursive with the function immediately below.
4188 
4189 Arguments:
4190   classbits     the bit map for characters < 256
4191   uchardptr     points to the pointer for extra data
4192   options       the options word
4193   cd            contains pointers to tables etc.
4194   start         start of range character
4195   end           end of range character
4196 
4197 Returns:        the number of < 256 characters added
4198                 the pointer to extra data is updated
4199 */
4200 
4201 static int
add_to_class(pcre_uint8 * classbits,pcre_uchar ** uchardptr,int options,compile_data * cd,pcre_uint32 start,pcre_uint32 end)4202 add_to_class(pcre_uint8 *classbits, pcre_uchar **uchardptr, int options,
4203   compile_data *cd, pcre_uint32 start, pcre_uint32 end)
4204 {
4205 pcre_uint32 c;
4206 pcre_uint32 classbits_end = (end <= 0xff ? end : 0xff);
4207 int n8 = 0;
4208 
4209 /* If caseless matching is required, scan the range and process alternate
4210 cases. In Unicode, there are 8-bit characters that have alternate cases that
4211 are greater than 255 and vice-versa. Sometimes we can just extend the original
4212 range. */
4213 
4214 if ((options & PCRE_CASELESS) != 0)
4215   {
4216 #ifdef SUPPORT_UCP
4217   if ((options & PCRE_UTF8) != 0)
4218     {
4219     int rc;
4220     pcre_uint32 oc, od;
4221 
4222     options &= ~PCRE_CASELESS;   /* Remove for recursive calls */
4223     c = start;
4224 
4225     while ((rc = get_othercase_range(&c, end, &oc, &od)) >= 0)
4226       {
4227       /* Handle a single character that has more than one other case. */
4228 
4229       if (rc > 0) n8 += add_list_to_class(classbits, uchardptr, options, cd,
4230         PRIV(ucd_caseless_sets) + rc, oc);
4231 
4232       /* Do nothing if the other case range is within the original range. */
4233 
4234       else if (oc >= start && od <= end) continue;
4235 
4236       /* Extend the original range if there is overlap, noting that if oc < c, we
4237       can't have od > end because a subrange is always shorter than the basic
4238       range. Otherwise, use a recursive call to add the additional range. */
4239 
4240       else if (oc < start && od >= start - 1) start = oc; /* Extend downwards */
4241       else if (od > end && oc <= end + 1)
4242         {
4243         end = od;       /* Extend upwards */
4244         if (end > classbits_end) classbits_end = (end <= 0xff ? end : 0xff);
4245         }
4246       else n8 += add_to_class(classbits, uchardptr, options, cd, oc, od);
4247       }
4248     }
4249   else
4250 #endif  /* SUPPORT_UCP */
4251 
4252   /* Not UTF-mode, or no UCP */
4253 
4254   for (c = start; c <= classbits_end; c++)
4255     {
4256     SETBIT(classbits, cd->fcc[c]);
4257     n8++;
4258     }
4259   }
4260 
4261 /* Now handle the original range. Adjust the final value according to the bit
4262 length - this means that the same lists of (e.g.) horizontal spaces can be used
4263 in all cases. */
4264 
4265 #if defined COMPILE_PCRE8
4266 #ifdef SUPPORT_UTF
4267   if ((options & PCRE_UTF8) == 0)
4268 #endif
4269   if (end > 0xff) end = 0xff;
4270 
4271 #elif defined COMPILE_PCRE16
4272 #ifdef SUPPORT_UTF
4273   if ((options & PCRE_UTF16) == 0)
4274 #endif
4275   if (end > 0xffff) end = 0xffff;
4276 
4277 #endif /* COMPILE_PCRE[8|16] */
4278 
4279 /* Use the bitmap for characters < 256. Otherwise use extra data.*/
4280 
4281 for (c = start; c <= classbits_end; c++)
4282   {
4283   /* Regardless of start, c will always be <= 255. */
4284   SETBIT(classbits, c);
4285   n8++;
4286   }
4287 
4288 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4289 if (start <= 0xff) start = 0xff + 1;
4290 
4291 if (end >= start)
4292   {
4293   pcre_uchar *uchardata = *uchardptr;
4294 #ifdef SUPPORT_UTF
4295   if ((options & PCRE_UTF8) != 0)  /* All UTFs use the same flag bit */
4296     {
4297     if (start < end)
4298       {
4299       *uchardata++ = XCL_RANGE;
4300       uchardata += PRIV(ord2utf)(start, uchardata);
4301       uchardata += PRIV(ord2utf)(end, uchardata);
4302       }
4303     else if (start == end)
4304       {
4305       *uchardata++ = XCL_SINGLE;
4306       uchardata += PRIV(ord2utf)(start, uchardata);
4307       }
4308     }
4309   else
4310 #endif  /* SUPPORT_UTF */
4311 
4312   /* Without UTF support, character values are constrained by the bit length,
4313   and can only be > 256 for 16-bit and 32-bit libraries. */
4314 
4315 #ifdef COMPILE_PCRE8
4316     {}
4317 #else
4318   if (start < end)
4319     {
4320     *uchardata++ = XCL_RANGE;
4321     *uchardata++ = start;
4322     *uchardata++ = end;
4323     }
4324   else if (start == end)
4325     {
4326     *uchardata++ = XCL_SINGLE;
4327     *uchardata++ = start;
4328     }
4329 #endif
4330 
4331   *uchardptr = uchardata;   /* Updata extra data pointer */
4332   }
4333 #endif /* SUPPORT_UTF || !COMPILE_PCRE8 */
4334 
4335 return n8;    /* Number of 8-bit characters */
4336 }
4337 
4338 
4339 
4340 
4341 /*************************************************
4342 *        Add a list of characters to a class     *
4343 *************************************************/
4344 
4345 /* This function is used for adding a list of case-equivalent characters to a
4346 class, and also for adding a list of horizontal or vertical whitespace. If the
4347 list is in order (which it should be), ranges of characters are detected and
4348 handled appropriately. This function is mutually recursive with the function
4349 above.
4350 
4351 Arguments:
4352   classbits     the bit map for characters < 256
4353   uchardptr     points to the pointer for extra data
4354   options       the options word
4355   cd            contains pointers to tables etc.
4356   p             points to row of 32-bit values, terminated by NOTACHAR
4357   except        character to omit; this is used when adding lists of
4358                   case-equivalent characters to avoid including the one we
4359                   already know about
4360 
4361 Returns:        the number of < 256 characters added
4362                 the pointer to extra data is updated
4363 */
4364 
4365 static int
add_list_to_class(pcre_uint8 * classbits,pcre_uchar ** uchardptr,int options,compile_data * cd,const pcre_uint32 * p,unsigned int except)4366 add_list_to_class(pcre_uint8 *classbits, pcre_uchar **uchardptr, int options,
4367   compile_data *cd, const pcre_uint32 *p, unsigned int except)
4368 {
4369 int n8 = 0;
4370 while (p[0] < NOTACHAR)
4371   {
4372   int n = 0;
4373   if (p[0] != except)
4374     {
4375     while(p[n+1] == p[0] + n + 1) n++;
4376     n8 += add_to_class(classbits, uchardptr, options, cd, p[0], p[n]);
4377     }
4378   p += n + 1;
4379   }
4380 return n8;
4381 }
4382 
4383 
4384 
4385 /*************************************************
4386 *    Add characters not in a list to a class     *
4387 *************************************************/
4388 
4389 /* This function is used for adding the complement of a list of horizontal or
4390 vertical whitespace to a class. The list must be in order.
4391 
4392 Arguments:
4393   classbits     the bit map for characters < 256
4394   uchardptr     points to the pointer for extra data
4395   options       the options word
4396   cd            contains pointers to tables etc.
4397   p             points to row of 32-bit values, terminated by NOTACHAR
4398 
4399 Returns:        the number of < 256 characters added
4400                 the pointer to extra data is updated
4401 */
4402 
4403 static int
add_not_list_to_class(pcre_uint8 * classbits,pcre_uchar ** uchardptr,int options,compile_data * cd,const pcre_uint32 * p)4404 add_not_list_to_class(pcre_uint8 *classbits, pcre_uchar **uchardptr,
4405   int options, compile_data *cd, const pcre_uint32 *p)
4406 {
4407 BOOL utf = (options & PCRE_UTF8) != 0;
4408 int n8 = 0;
4409 if (p[0] > 0)
4410   n8 += add_to_class(classbits, uchardptr, options, cd, 0, p[0] - 1);
4411 while (p[0] < NOTACHAR)
4412   {
4413   while (p[1] == p[0] + 1) p++;
4414   n8 += add_to_class(classbits, uchardptr, options, cd, p[0] + 1,
4415     (p[1] == NOTACHAR) ? (utf ? 0x10ffffu : 0xffffffffu) : p[1] - 1);
4416   p++;
4417   }
4418 return n8;
4419 }
4420 
4421 
4422 
4423 /*************************************************
4424 *           Compile one branch                   *
4425 *************************************************/
4426 
4427 /* Scan the pattern, compiling it into the a vector. If the options are
4428 changed during the branch, the pointer is used to change the external options
4429 bits. This function is used during the pre-compile phase when we are trying
4430 to find out the amount of memory needed, as well as during the real compile
4431 phase. The value of lengthptr distinguishes the two phases.
4432 
4433 Arguments:
4434   optionsptr        pointer to the option bits
4435   codeptr           points to the pointer to the current code point
4436   ptrptr            points to the current pattern pointer
4437   errorcodeptr      points to error code variable
4438   firstcharptr      place to put the first required character
4439   firstcharflagsptr place to put the first character flags, or a negative number
4440   reqcharptr        place to put the last required character
4441   reqcharflagsptr   place to put the last required character flags, or a negative number
4442   bcptr             points to current branch chain
4443   cond_depth        conditional nesting depth
4444   cd                contains pointers to tables etc.
4445   lengthptr         NULL during the real compile phase
4446                     points to length accumulator during pre-compile phase
4447 
4448 Returns:            TRUE on success
4449                     FALSE, with *errorcodeptr set non-zero on error
4450 */
4451 
4452 static BOOL
compile_branch(int * optionsptr,pcre_uchar ** codeptr,const pcre_uchar ** ptrptr,int * errorcodeptr,pcre_uint32 * firstcharptr,pcre_int32 * firstcharflagsptr,pcre_uint32 * reqcharptr,pcre_int32 * reqcharflagsptr,branch_chain * bcptr,int cond_depth,compile_data * cd,int * lengthptr)4453 compile_branch(int *optionsptr, pcre_uchar **codeptr,
4454   const pcre_uchar **ptrptr, int *errorcodeptr,
4455   pcre_uint32 *firstcharptr, pcre_int32 *firstcharflagsptr,
4456   pcre_uint32 *reqcharptr, pcre_int32 *reqcharflagsptr,
4457   branch_chain *bcptr, int cond_depth,
4458   compile_data *cd, int *lengthptr)
4459 {
4460 int repeat_type, op_type;
4461 int repeat_min = 0, repeat_max = 0;      /* To please picky compilers */
4462 int bravalue = 0;
4463 int greedy_default, greedy_non_default;
4464 pcre_uint32 firstchar, reqchar;
4465 pcre_int32 firstcharflags, reqcharflags;
4466 pcre_uint32 zeroreqchar, zerofirstchar;
4467 pcre_int32 zeroreqcharflags, zerofirstcharflags;
4468 pcre_int32 req_caseopt, reqvary, tempreqvary;
4469 int options = *optionsptr;               /* May change dynamically */
4470 int after_manual_callout = 0;
4471 int length_prevgroup = 0;
4472 register pcre_uint32 c;
4473 int escape;
4474 register pcre_uchar *code = *codeptr;
4475 pcre_uchar *last_code = code;
4476 pcre_uchar *orig_code = code;
4477 pcre_uchar *tempcode;
4478 BOOL inescq = FALSE;
4479 BOOL groupsetfirstchar = FALSE;
4480 const pcre_uchar *ptr = *ptrptr;
4481 const pcre_uchar *tempptr;
4482 const pcre_uchar *nestptr = NULL;
4483 pcre_uchar *previous = NULL;
4484 pcre_uchar *previous_callout = NULL;
4485 size_t item_hwm_offset = 0;
4486 pcre_uint8 classbits[32];
4487 
4488 /* We can fish out the UTF-8 setting once and for all into a BOOL, but we
4489 must not do this for other options (e.g. PCRE_EXTENDED) because they may change
4490 dynamically as we process the pattern. */
4491 
4492 #ifdef SUPPORT_UTF
4493 /* PCRE_UTF[16|32] have the same value as PCRE_UTF8. */
4494 BOOL utf = (options & PCRE_UTF8) != 0;
4495 #ifndef COMPILE_PCRE32
4496 pcre_uchar utf_chars[6];
4497 #endif
4498 #else
4499 BOOL utf = FALSE;
4500 #endif
4501 
4502 /* Helper variables for OP_XCLASS opcode (for characters > 255). We define
4503 class_uchardata always so that it can be passed to add_to_class() always,
4504 though it will not be used in non-UTF 8-bit cases. This avoids having to supply
4505 alternative calls for the different cases. */
4506 
4507 pcre_uchar *class_uchardata;
4508 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4509 BOOL xclass;
4510 pcre_uchar *class_uchardata_base;
4511 #endif
4512 
4513 #ifdef PCRE_DEBUG
4514 if (lengthptr != NULL) DPRINTF((">> start branch\n"));
4515 #endif
4516 
4517 /* Set up the default and non-default settings for greediness */
4518 
4519 greedy_default = ((options & PCRE_UNGREEDY) != 0);
4520 greedy_non_default = greedy_default ^ 1;
4521 
4522 /* Initialize no first byte, no required byte. REQ_UNSET means "no char
4523 matching encountered yet". It gets changed to REQ_NONE if we hit something that
4524 matches a non-fixed char first char; reqchar just remains unset if we never
4525 find one.
4526 
4527 When we hit a repeat whose minimum is zero, we may have to adjust these values
4528 to take the zero repeat into account. This is implemented by setting them to
4529 zerofirstbyte and zeroreqchar when such a repeat is encountered. The individual
4530 item types that can be repeated set these backoff variables appropriately. */
4531 
4532 firstchar = reqchar = zerofirstchar = zeroreqchar = 0;
4533 firstcharflags = reqcharflags = zerofirstcharflags = zeroreqcharflags = REQ_UNSET;
4534 
4535 /* The variable req_caseopt contains either the REQ_CASELESS value
4536 or zero, according to the current setting of the caseless flag. The
4537 REQ_CASELESS leaves the lower 28 bit empty. It is added into the
4538 firstchar or reqchar variables to record the case status of the
4539 value. This is used only for ASCII characters. */
4540 
4541 req_caseopt = ((options & PCRE_CASELESS) != 0)? REQ_CASELESS:0;
4542 
4543 /* Switch on next character until the end of the branch */
4544 
4545 for (;; ptr++)
4546   {
4547   BOOL negate_class;
4548   BOOL should_flip_negation;
4549   BOOL possessive_quantifier;
4550   BOOL is_quantifier;
4551   BOOL is_recurse;
4552   BOOL reset_bracount;
4553   int class_has_8bitchar;
4554   int class_one_char;
4555 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4556   BOOL xclass_has_prop;
4557 #endif
4558   int newoptions;
4559   int recno;
4560   int refsign;
4561   int skipbytes;
4562   pcre_uint32 subreqchar, subfirstchar;
4563   pcre_int32 subreqcharflags, subfirstcharflags;
4564   int terminator;
4565   unsigned int mclength;
4566   unsigned int tempbracount;
4567   pcre_uint32 ec;
4568   pcre_uchar mcbuffer[8];
4569 
4570   /* Come here to restart the loop without advancing the pointer. */
4571 
4572   REDO_LOOP:
4573 
4574   /* Get next character in the pattern */
4575 
4576   c = *ptr;
4577 
4578   /* If we are at the end of a nested substitution, revert to the outer level
4579   string. Nesting only happens one level deep. */
4580 
4581   if (c == CHAR_NULL && nestptr != NULL)
4582     {
4583     ptr = nestptr;
4584     nestptr = NULL;
4585     c = *ptr;
4586     }
4587 
4588   /* If we are in the pre-compile phase, accumulate the length used for the
4589   previous cycle of this loop. */
4590 
4591   if (lengthptr != NULL)
4592     {
4593 #ifdef PCRE_DEBUG
4594     if (code > cd->hwm) cd->hwm = code;                 /* High water info */
4595 #endif
4596     if (code > cd->start_workspace + cd->workspace_size -
4597         WORK_SIZE_SAFETY_MARGIN)                       /* Check for overrun */
4598       {
4599       *errorcodeptr = (code >= cd->start_workspace + cd->workspace_size)?
4600         ERR52 : ERR87;
4601       goto FAILED;
4602       }
4603 
4604     /* There is at least one situation where code goes backwards: this is the
4605     case of a zero quantifier after a class (e.g. [ab]{0}). At compile time,
4606     the class is simply eliminated. However, it is created first, so we have to
4607     allow memory for it. Therefore, don't ever reduce the length at this point.
4608     */
4609 
4610     if (code < last_code) code = last_code;
4611 
4612     /* Paranoid check for integer overflow */
4613 
4614     if (OFLOW_MAX - *lengthptr < code - last_code)
4615       {
4616       *errorcodeptr = ERR20;
4617       goto FAILED;
4618       }
4619 
4620     *lengthptr += (int)(code - last_code);
4621     DPRINTF(("length=%d added %d c=%c (0x%x)\n", *lengthptr,
4622       (int)(code - last_code), c, c));
4623 
4624     /* If "previous" is set and it is not at the start of the work space, move
4625     it back to there, in order to avoid filling up the work space. Otherwise,
4626     if "previous" is NULL, reset the current code pointer to the start. */
4627 
4628     if (previous != NULL)
4629       {
4630       if (previous > orig_code)
4631         {
4632         memmove(orig_code, previous, IN_UCHARS(code - previous));
4633         code -= previous - orig_code;
4634         previous = orig_code;
4635         }
4636       }
4637     else code = orig_code;
4638 
4639     /* Remember where this code item starts so we can pick up the length
4640     next time round. */
4641 
4642     last_code = code;
4643     }
4644 
4645   /* In the real compile phase, just check the workspace used by the forward
4646   reference list. */
4647 
4648   else if (cd->hwm > cd->start_workspace + cd->workspace_size)
4649     {
4650     *errorcodeptr = ERR52;
4651     goto FAILED;
4652     }
4653 
4654   /* If in \Q...\E, check for the end; if not, we have a literal. Otherwise an
4655   isolated \E is ignored. */
4656 
4657   if (c != CHAR_NULL)
4658     {
4659     if (c == CHAR_BACKSLASH && ptr[1] == CHAR_E)
4660       {
4661       inescq = FALSE;
4662       ptr++;
4663       continue;
4664       }
4665     else if (inescq)
4666       {
4667       if (previous_callout != NULL)
4668         {
4669         if (lengthptr == NULL)  /* Don't attempt in pre-compile phase */
4670           complete_callout(previous_callout, ptr, cd);
4671         previous_callout = NULL;
4672         }
4673       if ((options & PCRE_AUTO_CALLOUT) != 0)
4674         {
4675         previous_callout = code;
4676         code = auto_callout(code, ptr, cd);
4677         }
4678       goto NORMAL_CHAR;
4679       }
4680 
4681     /* Check for the start of a \Q...\E sequence. We must do this here rather
4682     than later in case it is immediately followed by \E, which turns it into a
4683     "do nothing" sequence. */
4684 
4685     if (c == CHAR_BACKSLASH && ptr[1] == CHAR_Q)
4686       {
4687       inescq = TRUE;
4688       ptr++;
4689       continue;
4690       }
4691     }
4692 
4693   /* In extended mode, skip white space and comments. */
4694 
4695   if ((options & PCRE_EXTENDED) != 0)
4696     {
4697     const pcre_uchar *wscptr = ptr;
4698     while (MAX_255(c) && (cd->ctypes[c] & ctype_space) != 0) c = *(++ptr);
4699     if (c == CHAR_NUMBER_SIGN)
4700       {
4701       ptr++;
4702       while (*ptr != CHAR_NULL)
4703         {
4704         if (IS_NEWLINE(ptr))         /* For non-fixed-length newline cases, */
4705           {                          /* IS_NEWLINE sets cd->nllen. */
4706           ptr += cd->nllen;
4707           break;
4708           }
4709         ptr++;
4710 #ifdef SUPPORT_UTF
4711         if (utf) FORWARDCHAR(ptr);
4712 #endif
4713         }
4714       }
4715 
4716     /* If we skipped any characters, restart the loop. Otherwise, we didn't see
4717     a comment. */
4718 
4719     if (ptr > wscptr) goto REDO_LOOP;
4720     }
4721 
4722   /* Skip over (?# comments. We need to do this here because we want to know if
4723   the next thing is a quantifier, and these comments may come between an item
4724   and its quantifier. */
4725 
4726   if (c == CHAR_LEFT_PARENTHESIS && ptr[1] == CHAR_QUESTION_MARK &&
4727       ptr[2] == CHAR_NUMBER_SIGN)
4728     {
4729     ptr += 3;
4730     while (*ptr != CHAR_NULL && *ptr != CHAR_RIGHT_PARENTHESIS) ptr++;
4731     if (*ptr == CHAR_NULL)
4732       {
4733       *errorcodeptr = ERR18;
4734       goto FAILED;
4735       }
4736     continue;
4737     }
4738 
4739   /* See if the next thing is a quantifier. */
4740 
4741   is_quantifier =
4742     c == CHAR_ASTERISK || c == CHAR_PLUS || c == CHAR_QUESTION_MARK ||
4743     (c == CHAR_LEFT_CURLY_BRACKET && is_counted_repeat(ptr+1));
4744 
4745   /* Fill in length of a previous callout, except when the next thing is a
4746   quantifier or when processing a property substitution string in UCP mode. */
4747 
4748   if (!is_quantifier && previous_callout != NULL && nestptr == NULL &&
4749        after_manual_callout-- <= 0)
4750     {
4751     if (lengthptr == NULL)      /* Don't attempt in pre-compile phase */
4752       complete_callout(previous_callout, ptr, cd);
4753     previous_callout = NULL;
4754     }
4755 
4756   /* Create auto callout, except for quantifiers, or while processing property
4757   strings that are substituted for \w etc in UCP mode. */
4758 
4759   if ((options & PCRE_AUTO_CALLOUT) != 0 && !is_quantifier && nestptr == NULL)
4760     {
4761     previous_callout = code;
4762     code = auto_callout(code, ptr, cd);
4763     }
4764 
4765   /* Process the next pattern item. */
4766 
4767   switch(c)
4768     {
4769     /* ===================================================================*/
4770     case CHAR_NULL:                /* The branch terminates at string end */
4771     case CHAR_VERTICAL_LINE:       /* or | or ) */
4772     case CHAR_RIGHT_PARENTHESIS:
4773     *firstcharptr = firstchar;
4774     *firstcharflagsptr = firstcharflags;
4775     *reqcharptr = reqchar;
4776     *reqcharflagsptr = reqcharflags;
4777     *codeptr = code;
4778     *ptrptr = ptr;
4779     if (lengthptr != NULL)
4780       {
4781       if (OFLOW_MAX - *lengthptr < code - last_code)
4782         {
4783         *errorcodeptr = ERR20;
4784         goto FAILED;
4785         }
4786       *lengthptr += (int)(code - last_code);   /* To include callout length */
4787       DPRINTF((">> end branch\n"));
4788       }
4789     return TRUE;
4790 
4791 
4792     /* ===================================================================*/
4793     /* Handle single-character metacharacters. In multiline mode, ^ disables
4794     the setting of any following char as a first character. */
4795 
4796     case CHAR_CIRCUMFLEX_ACCENT:
4797     previous = NULL;
4798     if ((options & PCRE_MULTILINE) != 0)
4799       {
4800       if (firstcharflags == REQ_UNSET)
4801         zerofirstcharflags = firstcharflags = REQ_NONE;
4802       *code++ = OP_CIRCM;
4803       }
4804     else *code++ = OP_CIRC;
4805     break;
4806 
4807     case CHAR_DOLLAR_SIGN:
4808     previous = NULL;
4809     *code++ = ((options & PCRE_MULTILINE) != 0)? OP_DOLLM : OP_DOLL;
4810     break;
4811 
4812     /* There can never be a first char if '.' is first, whatever happens about
4813     repeats. The value of reqchar doesn't change either. */
4814 
4815     case CHAR_DOT:
4816     if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
4817     zerofirstchar = firstchar;
4818     zerofirstcharflags = firstcharflags;
4819     zeroreqchar = reqchar;
4820     zeroreqcharflags = reqcharflags;
4821     previous = code;
4822     item_hwm_offset = cd->hwm - cd->start_workspace;
4823     *code++ = ((options & PCRE_DOTALL) != 0)? OP_ALLANY: OP_ANY;
4824     break;
4825 
4826 
4827     /* ===================================================================*/
4828     /* Character classes. If the included characters are all < 256, we build a
4829     32-byte bitmap of the permitted characters, except in the special case
4830     where there is only one such character. For negated classes, we build the
4831     map as usual, then invert it at the end. However, we use a different opcode
4832     so that data characters > 255 can be handled correctly.
4833 
4834     If the class contains characters outside the 0-255 range, a different
4835     opcode is compiled. It may optionally have a bit map for characters < 256,
4836     but those above are are explicitly listed afterwards. A flag byte tells
4837     whether the bitmap is present, and whether this is a negated class or not.
4838 
4839     In JavaScript compatibility mode, an isolated ']' causes an error. In
4840     default (Perl) mode, it is treated as a data character. */
4841 
4842     case CHAR_RIGHT_SQUARE_BRACKET:
4843     if ((cd->external_options & PCRE_JAVASCRIPT_COMPAT) != 0)
4844       {
4845       *errorcodeptr = ERR64;
4846       goto FAILED;
4847       }
4848     goto NORMAL_CHAR;
4849 
4850     /* In another (POSIX) regex library, the ugly syntax [[:<:]] and [[:>:]] is
4851     used for "start of word" and "end of word". As these are otherwise illegal
4852     sequences, we don't break anything by recognizing them. They are replaced
4853     by \b(?=\w) and \b(?<=\w) respectively. Sequences like [a[:<:]] are
4854     erroneous and are handled by the normal code below. */
4855 
4856     case CHAR_LEFT_SQUARE_BRACKET:
4857     if (STRNCMP_UC_C8(ptr+1, STRING_WEIRD_STARTWORD, 6) == 0)
4858       {
4859       nestptr = ptr + 7;
4860       ptr = sub_start_of_word;
4861       goto REDO_LOOP;
4862       }
4863 
4864     if (STRNCMP_UC_C8(ptr+1, STRING_WEIRD_ENDWORD, 6) == 0)
4865       {
4866       nestptr = ptr + 7;
4867       ptr = sub_end_of_word;
4868       goto REDO_LOOP;
4869       }
4870 
4871     /* Handle a real character class. */
4872 
4873     previous = code;
4874     item_hwm_offset = cd->hwm - cd->start_workspace;
4875 
4876     /* PCRE supports POSIX class stuff inside a class. Perl gives an error if
4877     they are encountered at the top level, so we'll do that too. */
4878 
4879     if ((ptr[1] == CHAR_COLON || ptr[1] == CHAR_DOT ||
4880          ptr[1] == CHAR_EQUALS_SIGN) &&
4881         check_posix_syntax(ptr, &tempptr))
4882       {
4883       *errorcodeptr = (ptr[1] == CHAR_COLON)? ERR13 : ERR31;
4884       goto FAILED;
4885       }
4886 
4887     /* If the first character is '^', set the negation flag and skip it. Also,
4888     if the first few characters (either before or after ^) are \Q\E or \E we
4889     skip them too. This makes for compatibility with Perl. */
4890 
4891     negate_class = FALSE;
4892     for (;;)
4893       {
4894       c = *(++ptr);
4895       if (c == CHAR_BACKSLASH)
4896         {
4897         if (ptr[1] == CHAR_E)
4898           ptr++;
4899         else if (STRNCMP_UC_C8(ptr + 1, STR_Q STR_BACKSLASH STR_E, 3) == 0)
4900           ptr += 3;
4901         else
4902           break;
4903         }
4904       else if (!negate_class && c == CHAR_CIRCUMFLEX_ACCENT)
4905         negate_class = TRUE;
4906       else break;
4907       }
4908 
4909     /* Empty classes are allowed in JavaScript compatibility mode. Otherwise,
4910     an initial ']' is taken as a data character -- the code below handles
4911     that. In JS mode, [] must always fail, so generate OP_FAIL, whereas
4912     [^] must match any character, so generate OP_ALLANY. */
4913 
4914     if (c == CHAR_RIGHT_SQUARE_BRACKET &&
4915         (cd->external_options & PCRE_JAVASCRIPT_COMPAT) != 0)
4916       {
4917       *code++ = negate_class? OP_ALLANY : OP_FAIL;
4918       if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
4919       zerofirstchar = firstchar;
4920       zerofirstcharflags = firstcharflags;
4921       break;
4922       }
4923 
4924     /* If a class contains a negative special such as \S, we need to flip the
4925     negation flag at the end, so that support for characters > 255 works
4926     correctly (they are all included in the class). */
4927 
4928     should_flip_negation = FALSE;
4929 
4930     /* Extended class (xclass) will be used when characters > 255
4931     might match. */
4932 
4933 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4934     xclass = FALSE;
4935     class_uchardata = code + LINK_SIZE + 2;   /* For XCLASS items */
4936     class_uchardata_base = class_uchardata;   /* Save the start */
4937 #endif
4938 
4939     /* For optimization purposes, we track some properties of the class:
4940     class_has_8bitchar will be non-zero if the class contains at least one <
4941     256 character; class_one_char will be 1 if the class contains just one
4942     character; xclass_has_prop will be TRUE if unicode property checks
4943     are present in the class. */
4944 
4945     class_has_8bitchar = 0;
4946     class_one_char = 0;
4947 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4948     xclass_has_prop = FALSE;
4949 #endif
4950 
4951     /* Initialize the 32-char bit map to all zeros. We build the map in a
4952     temporary bit of memory, in case the class contains fewer than two
4953     8-bit characters because in that case the compiled code doesn't use the bit
4954     map. */
4955 
4956     memset(classbits, 0, 32 * sizeof(pcre_uint8));
4957 
4958     /* Process characters until ] is reached. By writing this as a "do" it
4959     means that an initial ] is taken as a data character. At the start of the
4960     loop, c contains the first byte of the character. */
4961 
4962     if (c != CHAR_NULL) do
4963       {
4964       const pcre_uchar *oldptr;
4965 
4966 #ifdef SUPPORT_UTF
4967       if (utf && HAS_EXTRALEN(c))
4968         {                           /* Braces are required because the */
4969         GETCHARLEN(c, ptr, ptr);    /* macro generates multiple statements */
4970         }
4971 #endif
4972 
4973 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
4974       /* In the pre-compile phase, accumulate the length of any extra
4975       data and reset the pointer. This is so that very large classes that
4976       contain a zillion > 255 characters no longer overwrite the work space
4977       (which is on the stack). We have to remember that there was XCLASS data,
4978       however. */
4979 
4980       if (class_uchardata > class_uchardata_base) xclass = TRUE;
4981 
4982       if (lengthptr != NULL && class_uchardata > class_uchardata_base)
4983         {
4984         *lengthptr += (int)(class_uchardata - class_uchardata_base);
4985         class_uchardata = class_uchardata_base;
4986         }
4987 #endif
4988 
4989       /* Inside \Q...\E everything is literal except \E */
4990 
4991       if (inescq)
4992         {
4993         if (c == CHAR_BACKSLASH && ptr[1] == CHAR_E)  /* If we are at \E */
4994           {
4995           inescq = FALSE;                   /* Reset literal state */
4996           ptr++;                            /* Skip the 'E' */
4997           continue;                         /* Carry on with next */
4998           }
4999         goto CHECK_RANGE;                   /* Could be range if \E follows */
5000         }
5001 
5002       /* Handle POSIX class names. Perl allows a negation extension of the
5003       form [:^name:]. A square bracket that doesn't match the syntax is
5004       treated as a literal. We also recognize the POSIX constructions
5005       [.ch.] and [=ch=] ("collating elements") and fault them, as Perl
5006       5.6 and 5.8 do. */
5007 
5008       if (c == CHAR_LEFT_SQUARE_BRACKET &&
5009           (ptr[1] == CHAR_COLON || ptr[1] == CHAR_DOT ||
5010            ptr[1] == CHAR_EQUALS_SIGN) && check_posix_syntax(ptr, &tempptr))
5011         {
5012         BOOL local_negate = FALSE;
5013         int posix_class, taboffset, tabopt;
5014         register const pcre_uint8 *cbits = cd->cbits;
5015         pcre_uint8 pbits[32];
5016 
5017         if (ptr[1] != CHAR_COLON)
5018           {
5019           *errorcodeptr = ERR31;
5020           goto FAILED;
5021           }
5022 
5023         ptr += 2;
5024         if (*ptr == CHAR_CIRCUMFLEX_ACCENT)
5025           {
5026           local_negate = TRUE;
5027           should_flip_negation = TRUE;  /* Note negative special */
5028           ptr++;
5029           }
5030 
5031         posix_class = check_posix_name(ptr, (int)(tempptr - ptr));
5032         if (posix_class < 0)
5033           {
5034           *errorcodeptr = ERR30;
5035           goto FAILED;
5036           }
5037 
5038         /* If matching is caseless, upper and lower are converted to
5039         alpha. This relies on the fact that the class table starts with
5040         alpha, lower, upper as the first 3 entries. */
5041 
5042         if ((options & PCRE_CASELESS) != 0 && posix_class <= 2)
5043           posix_class = 0;
5044 
5045         /* When PCRE_UCP is set, some of the POSIX classes are converted to
5046         different escape sequences that use Unicode properties \p or \P. Others
5047         that are not available via \p or \P generate XCL_PROP/XCL_NOTPROP
5048         directly. */
5049 
5050 #ifdef SUPPORT_UCP
5051         if ((options & PCRE_UCP) != 0)
5052           {
5053           unsigned int ptype = 0;
5054           int pc = posix_class + ((local_negate)? POSIX_SUBSIZE/2 : 0);
5055 
5056           /* The posix_substitutes table specifies which POSIX classes can be
5057           converted to \p or \P items. */
5058 
5059           if (posix_substitutes[pc] != NULL)
5060             {
5061             nestptr = tempptr + 1;
5062             ptr = posix_substitutes[pc] - 1;
5063             continue;
5064             }
5065 
5066           /* There are three other classes that generate special property calls
5067           that are recognized only in an XCLASS. */
5068 
5069           else switch(posix_class)
5070             {
5071             case PC_GRAPH:
5072             ptype = PT_PXGRAPH;
5073             /* Fall through */
5074             case PC_PRINT:
5075             if (ptype == 0) ptype = PT_PXPRINT;
5076             /* Fall through */
5077             case PC_PUNCT:
5078             if (ptype == 0) ptype = PT_PXPUNCT;
5079             *class_uchardata++ = local_negate? XCL_NOTPROP : XCL_PROP;
5080             *class_uchardata++ = ptype;
5081             *class_uchardata++ = 0;
5082             xclass_has_prop = TRUE;
5083             ptr = tempptr + 1;
5084             continue;
5085 
5086             /* For the other POSIX classes (ascii, cntrl, xdigit) we are going
5087             to fall through to the non-UCP case and build a bit map for
5088             characters with code points less than 256. If we are in a negated
5089             POSIX class, characters with code points greater than 255 must
5090             either all match or all not match. In the special case where we
5091             have not yet generated any xclass data, and this is the final item
5092             in the overall class, we need do nothing: later on, the opcode
5093             OP_NCLASS will be used to indicate that characters greater than 255
5094             are acceptable. If we have already seen an xclass item or one may
5095             follow (we have to assume that it might if this is not the end of
5096             the class), explicitly list all wide codepoints, which will then
5097             either not match or match, depending on whether the class is or is
5098             not negated. */
5099 
5100             default:
5101             if (local_negate &&
5102                 (xclass || tempptr[2] != CHAR_RIGHT_SQUARE_BRACKET))
5103               {
5104               *class_uchardata++ = XCL_RANGE;
5105               class_uchardata += PRIV(ord2utf)(0x100, class_uchardata);
5106               class_uchardata += PRIV(ord2utf)(0x10ffff, class_uchardata);
5107               }
5108             break;
5109             }
5110           }
5111 #endif
5112         /* In the non-UCP case, or when UCP makes no difference, we build the
5113         bit map for the POSIX class in a chunk of local store because we may be
5114         adding and subtracting from it, and we don't want to subtract bits that
5115         may be in the main map already. At the end we or the result into the
5116         bit map that is being built. */
5117 
5118         posix_class *= 3;
5119 
5120         /* Copy in the first table (always present) */
5121 
5122         memcpy(pbits, cbits + posix_class_maps[posix_class],
5123           32 * sizeof(pcre_uint8));
5124 
5125         /* If there is a second table, add or remove it as required. */
5126 
5127         taboffset = posix_class_maps[posix_class + 1];
5128         tabopt = posix_class_maps[posix_class + 2];
5129 
5130         if (taboffset >= 0)
5131           {
5132           if (tabopt >= 0)
5133             for (c = 0; c < 32; c++) pbits[c] |= cbits[c + taboffset];
5134           else
5135             for (c = 0; c < 32; c++) pbits[c] &= ~cbits[c + taboffset];
5136           }
5137 
5138         /* Now see if we need to remove any special characters. An option
5139         value of 1 removes vertical space and 2 removes underscore. */
5140 
5141         if (tabopt < 0) tabopt = -tabopt;
5142         if (tabopt == 1) pbits[1] &= ~0x3c;
5143           else if (tabopt == 2) pbits[11] &= 0x7f;
5144 
5145         /* Add the POSIX table or its complement into the main table that is
5146         being built and we are done. */
5147 
5148         if (local_negate)
5149           for (c = 0; c < 32; c++) classbits[c] |= ~pbits[c];
5150         else
5151           for (c = 0; c < 32; c++) classbits[c] |= pbits[c];
5152 
5153         ptr = tempptr + 1;
5154         /* Every class contains at least one < 256 character. */
5155         class_has_8bitchar = 1;
5156         /* Every class contains at least two characters. */
5157         class_one_char = 2;
5158         continue;    /* End of POSIX syntax handling */
5159         }
5160 
5161       /* Backslash may introduce a single character, or it may introduce one
5162       of the specials, which just set a flag. The sequence \b is a special
5163       case. Inside a class (and only there) it is treated as backspace. We
5164       assume that other escapes have more than one character in them, so
5165       speculatively set both class_has_8bitchar and class_one_char bigger
5166       than one. Unrecognized escapes fall through and are either treated
5167       as literal characters (by default), or are faulted if
5168       PCRE_EXTRA is set. */
5169 
5170       if (c == CHAR_BACKSLASH)
5171         {
5172         escape = check_escape(&ptr, &ec, errorcodeptr, cd->bracount, options,
5173           TRUE);
5174         if (*errorcodeptr != 0) goto FAILED;
5175         if (escape == 0) c = ec;
5176         else if (escape == ESC_b) c = CHAR_BS; /* \b is backspace in a class */
5177         else if (escape == ESC_N)          /* \N is not supported in a class */
5178           {
5179           *errorcodeptr = ERR71;
5180           goto FAILED;
5181           }
5182         else if (escape == ESC_Q)            /* Handle start of quoted string */
5183           {
5184           if (ptr[1] == CHAR_BACKSLASH && ptr[2] == CHAR_E)
5185             {
5186             ptr += 2; /* avoid empty string */
5187             }
5188           else inescq = TRUE;
5189           continue;
5190           }
5191         else if (escape == ESC_E) continue;  /* Ignore orphan \E */
5192 
5193         else
5194           {
5195           register const pcre_uint8 *cbits = cd->cbits;
5196           /* Every class contains at least two < 256 characters. */
5197           class_has_8bitchar++;
5198           /* Every class contains at least two characters. */
5199           class_one_char += 2;
5200 
5201           switch (escape)
5202             {
5203 #ifdef SUPPORT_UCP
5204             case ESC_du:     /* These are the values given for \d etc */
5205             case ESC_DU:     /* when PCRE_UCP is set. We replace the */
5206             case ESC_wu:     /* escape sequence with an appropriate \p */
5207             case ESC_WU:     /* or \P to test Unicode properties instead */
5208             case ESC_su:     /* of the default ASCII testing. */
5209             case ESC_SU:
5210             nestptr = ptr;
5211             ptr = substitutes[escape - ESC_DU] - 1;  /* Just before substitute */
5212             class_has_8bitchar--;                /* Undo! */
5213             continue;
5214 #endif
5215             case ESC_d:
5216             for (c = 0; c < 32; c++) classbits[c] |= cbits[c+cbit_digit];
5217             continue;
5218 
5219             case ESC_D:
5220             should_flip_negation = TRUE;
5221             for (c = 0; c < 32; c++) classbits[c] |= ~cbits[c+cbit_digit];
5222             continue;
5223 
5224             case ESC_w:
5225             for (c = 0; c < 32; c++) classbits[c] |= cbits[c+cbit_word];
5226             continue;
5227 
5228             case ESC_W:
5229             should_flip_negation = TRUE;
5230             for (c = 0; c < 32; c++) classbits[c] |= ~cbits[c+cbit_word];
5231             continue;
5232 
5233             /* Perl 5.004 onwards omitted VT from \s, but restored it at Perl
5234             5.18. Before PCRE 8.34, we had to preserve the VT bit if it was
5235             previously set by something earlier in the character class.
5236             Luckily, the value of CHAR_VT is 0x0b in both ASCII and EBCDIC, so
5237             we could just adjust the appropriate bit. From PCRE 8.34 we no
5238             longer treat \s and \S specially. */
5239 
5240             case ESC_s:
5241             for (c = 0; c < 32; c++) classbits[c] |= cbits[c+cbit_space];
5242             continue;
5243 
5244             case ESC_S:
5245             should_flip_negation = TRUE;
5246             for (c = 0; c < 32; c++) classbits[c] |= ~cbits[c+cbit_space];
5247             continue;
5248 
5249             /* The rest apply in both UCP and non-UCP cases. */
5250 
5251             case ESC_h:
5252             (void)add_list_to_class(classbits, &class_uchardata, options, cd,
5253               PRIV(hspace_list), NOTACHAR);
5254             continue;
5255 
5256             case ESC_H:
5257             (void)add_not_list_to_class(classbits, &class_uchardata, options,
5258               cd, PRIV(hspace_list));
5259             continue;
5260 
5261             case ESC_v:
5262             (void)add_list_to_class(classbits, &class_uchardata, options, cd,
5263               PRIV(vspace_list), NOTACHAR);
5264             continue;
5265 
5266             case ESC_V:
5267             (void)add_not_list_to_class(classbits, &class_uchardata, options,
5268               cd, PRIV(vspace_list));
5269             continue;
5270 
5271             case ESC_p:
5272             case ESC_P:
5273 #ifdef SUPPORT_UCP
5274               {
5275               BOOL negated;
5276               unsigned int ptype = 0, pdata = 0;
5277               if (!get_ucp(&ptr, &negated, &ptype, &pdata, errorcodeptr))
5278                 goto FAILED;
5279               *class_uchardata++ = ((escape == ESC_p) != negated)?
5280                 XCL_PROP : XCL_NOTPROP;
5281               *class_uchardata++ = ptype;
5282               *class_uchardata++ = pdata;
5283               xclass_has_prop = TRUE;
5284               class_has_8bitchar--;                /* Undo! */
5285               continue;
5286               }
5287 #else
5288             *errorcodeptr = ERR45;
5289             goto FAILED;
5290 #endif
5291             /* Unrecognized escapes are faulted if PCRE is running in its
5292             strict mode. By default, for compatibility with Perl, they are
5293             treated as literals. */
5294 
5295             default:
5296             if ((options & PCRE_EXTRA) != 0)
5297               {
5298               *errorcodeptr = ERR7;
5299               goto FAILED;
5300               }
5301             class_has_8bitchar--;    /* Undo the speculative increase. */
5302             class_one_char -= 2;     /* Undo the speculative increase. */
5303             c = *ptr;                /* Get the final character and fall through */
5304             break;
5305             }
5306           }
5307 
5308         /* Fall through if the escape just defined a single character (c >= 0).
5309         This may be greater than 256. */
5310 
5311         escape = 0;
5312 
5313         }   /* End of backslash handling */
5314 
5315       /* A character may be followed by '-' to form a range. However, Perl does
5316       not permit ']' to be the end of the range. A '-' character at the end is
5317       treated as a literal. Perl ignores orphaned \E sequences entirely. The
5318       code for handling \Q and \E is messy. */
5319 
5320       CHECK_RANGE:
5321       while (ptr[1] == CHAR_BACKSLASH && ptr[2] == CHAR_E)
5322         {
5323         inescq = FALSE;
5324         ptr += 2;
5325         }
5326       oldptr = ptr;
5327 
5328       /* Remember if \r or \n were explicitly used */
5329 
5330       if (c == CHAR_CR || c == CHAR_NL) cd->external_flags |= PCRE_HASCRORLF;
5331 
5332       /* Check for range */
5333 
5334       if (!inescq && ptr[1] == CHAR_MINUS)
5335         {
5336         pcre_uint32 d;
5337         ptr += 2;
5338         while (*ptr == CHAR_BACKSLASH && ptr[1] == CHAR_E) ptr += 2;
5339 
5340         /* If we hit \Q (not followed by \E) at this point, go into escaped
5341         mode. */
5342 
5343         while (*ptr == CHAR_BACKSLASH && ptr[1] == CHAR_Q)
5344           {
5345           ptr += 2;
5346           if (*ptr == CHAR_BACKSLASH && ptr[1] == CHAR_E)
5347             { ptr += 2; continue; }
5348           inescq = TRUE;
5349           break;
5350           }
5351 
5352         /* Minus (hyphen) at the end of a class is treated as a literal, so put
5353         back the pointer and jump to handle the character that preceded it. */
5354 
5355         if (*ptr == CHAR_NULL || (!inescq && *ptr == CHAR_RIGHT_SQUARE_BRACKET))
5356           {
5357           ptr = oldptr;
5358           goto CLASS_SINGLE_CHARACTER;
5359           }
5360 
5361         /* Otherwise, we have a potential range; pick up the next character */
5362 
5363 #ifdef SUPPORT_UTF
5364         if (utf)
5365           {                           /* Braces are required because the */
5366           GETCHARLEN(d, ptr, ptr);    /* macro generates multiple statements */
5367           }
5368         else
5369 #endif
5370         d = *ptr;  /* Not UTF-8 mode */
5371 
5372         /* The second part of a range can be a single-character escape
5373         sequence, but not any of the other escapes. Perl treats a hyphen as a
5374         literal in such circumstances. However, in Perl's warning mode, a
5375         warning is given, so PCRE now faults it as it is almost certainly a
5376         mistake on the user's part. */
5377 
5378         if (!inescq)
5379           {
5380           if (d == CHAR_BACKSLASH)
5381             {
5382             int descape;
5383             descape = check_escape(&ptr, &d, errorcodeptr, cd->bracount, options, TRUE);
5384             if (*errorcodeptr != 0) goto FAILED;
5385 
5386             /* 0 means a character was put into d; \b is backspace; any other
5387             special causes an error. */
5388 
5389             if (descape != 0)
5390               {
5391               if (descape == ESC_b) d = CHAR_BS; else
5392                 {
5393                 *errorcodeptr = ERR83;
5394                 goto FAILED;
5395                 }
5396               }
5397             }
5398 
5399           /* A hyphen followed by a POSIX class is treated in the same way. */
5400 
5401           else if (d == CHAR_LEFT_SQUARE_BRACKET &&
5402                    (ptr[1] == CHAR_COLON || ptr[1] == CHAR_DOT ||
5403                     ptr[1] == CHAR_EQUALS_SIGN) &&
5404                    check_posix_syntax(ptr, &tempptr))
5405             {
5406             *errorcodeptr = ERR83;
5407             goto FAILED;
5408             }
5409           }
5410 
5411         /* Check that the two values are in the correct order. Optimize
5412         one-character ranges. */
5413 
5414         if (d < c)
5415           {
5416           *errorcodeptr = ERR8;
5417           goto FAILED;
5418           }
5419         if (d == c) goto CLASS_SINGLE_CHARACTER;  /* A few lines below */
5420 
5421         /* We have found a character range, so single character optimizations
5422         cannot be done anymore. Any value greater than 1 indicates that there
5423         is more than one character. */
5424 
5425         class_one_char = 2;
5426 
5427         /* Remember an explicit \r or \n, and add the range to the class. */
5428 
5429         if (d == CHAR_CR || d == CHAR_NL) cd->external_flags |= PCRE_HASCRORLF;
5430 
5431         class_has_8bitchar +=
5432           add_to_class(classbits, &class_uchardata, options, cd, c, d);
5433 
5434         continue;   /* Go get the next char in the class */
5435         }
5436 
5437       /* Handle a single character - we can get here for a normal non-escape
5438       char, or after \ that introduces a single character or for an apparent
5439       range that isn't. Only the value 1 matters for class_one_char, so don't
5440       increase it if it is already 2 or more ... just in case there's a class
5441       with a zillion characters in it. */
5442 
5443       CLASS_SINGLE_CHARACTER:
5444       if (class_one_char < 2) class_one_char++;
5445 
5446       /* If xclass_has_prop is false and class_one_char is 1, we have the first
5447       single character in the class, and there have been no prior ranges, or
5448       XCLASS items generated by escapes. If this is the final character in the
5449       class, we can optimize by turning the item into a 1-character OP_CHAR[I]
5450       if it's positive, or OP_NOT[I] if it's negative. In the positive case, it
5451       can cause firstchar to be set. Otherwise, there can be no first char if
5452       this item is first, whatever repeat count may follow. In the case of
5453       reqchar, save the previous value for reinstating. */
5454 
5455       if (!inescq &&
5456 #ifdef SUPPORT_UCP
5457           !xclass_has_prop &&
5458 #endif
5459           class_one_char == 1 && ptr[1] == CHAR_RIGHT_SQUARE_BRACKET)
5460         {
5461         ptr++;
5462         zeroreqchar = reqchar;
5463         zeroreqcharflags = reqcharflags;
5464 
5465         if (negate_class)
5466           {
5467 #ifdef SUPPORT_UCP
5468           int d;
5469 #endif
5470           if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
5471           zerofirstchar = firstchar;
5472           zerofirstcharflags = firstcharflags;
5473 
5474           /* For caseless UTF-8 mode when UCP support is available, check
5475           whether this character has more than one other case. If so, generate
5476           a special OP_NOTPROP item instead of OP_NOTI. */
5477 
5478 #ifdef SUPPORT_UCP
5479           if (utf && (options & PCRE_CASELESS) != 0 &&
5480               (d = UCD_CASESET(c)) != 0)
5481             {
5482             *code++ = OP_NOTPROP;
5483             *code++ = PT_CLIST;
5484             *code++ = d;
5485             }
5486           else
5487 #endif
5488           /* Char has only one other case, or UCP not available */
5489 
5490             {
5491             *code++ = ((options & PCRE_CASELESS) != 0)? OP_NOTI: OP_NOT;
5492 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5493             if (utf && c > MAX_VALUE_FOR_SINGLE_CHAR)
5494               code += PRIV(ord2utf)(c, code);
5495             else
5496 #endif
5497               *code++ = c;
5498             }
5499 
5500           /* We are finished with this character class */
5501 
5502           goto END_CLASS;
5503           }
5504 
5505         /* For a single, positive character, get the value into mcbuffer, and
5506         then we can handle this with the normal one-character code. */
5507 
5508 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5509         if (utf && c > MAX_VALUE_FOR_SINGLE_CHAR)
5510           mclength = PRIV(ord2utf)(c, mcbuffer);
5511         else
5512 #endif
5513           {
5514           mcbuffer[0] = c;
5515           mclength = 1;
5516           }
5517         goto ONE_CHAR;
5518         }       /* End of 1-char optimization */
5519 
5520       /* There is more than one character in the class, or an XCLASS item
5521       has been generated. Add this character to the class. */
5522 
5523       class_has_8bitchar +=
5524         add_to_class(classbits, &class_uchardata, options, cd, c, c);
5525       }
5526 
5527     /* Loop until ']' reached. This "while" is the end of the "do" far above.
5528     If we are at the end of an internal nested string, revert to the outer
5529     string. */
5530 
5531     while (((c = *(++ptr)) != CHAR_NULL ||
5532            (nestptr != NULL &&
5533              (ptr = nestptr, nestptr = NULL, c = *(++ptr)) != CHAR_NULL)) &&
5534            (c != CHAR_RIGHT_SQUARE_BRACKET || inescq));
5535 
5536     /* Check for missing terminating ']' */
5537 
5538     if (c == CHAR_NULL)
5539       {
5540       *errorcodeptr = ERR6;
5541       goto FAILED;
5542       }
5543 
5544     /* We will need an XCLASS if data has been placed in class_uchardata. In
5545     the second phase this is a sufficient test. However, in the pre-compile
5546     phase, class_uchardata gets emptied to prevent workspace overflow, so it
5547     only if the very last character in the class needs XCLASS will it contain
5548     anything at this point. For this reason, xclass gets set TRUE above when
5549     uchar_classdata is emptied, and that's why this code is the way it is here
5550     instead of just doing a test on class_uchardata below. */
5551 
5552 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
5553     if (class_uchardata > class_uchardata_base) xclass = TRUE;
5554 #endif
5555 
5556     /* If this is the first thing in the branch, there can be no first char
5557     setting, whatever the repeat count. Any reqchar setting must remain
5558     unchanged after any kind of repeat. */
5559 
5560     if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
5561     zerofirstchar = firstchar;
5562     zerofirstcharflags = firstcharflags;
5563     zeroreqchar = reqchar;
5564     zeroreqcharflags = reqcharflags;
5565 
5566     /* If there are characters with values > 255, we have to compile an
5567     extended class, with its own opcode, unless there was a negated special
5568     such as \S in the class, and PCRE_UCP is not set, because in that case all
5569     characters > 255 are in the class, so any that were explicitly given as
5570     well can be ignored. If (when there are explicit characters > 255 that must
5571     be listed) there are no characters < 256, we can omit the bitmap in the
5572     actual compiled code. */
5573 
5574 #ifdef SUPPORT_UTF
5575     if (xclass && (xclass_has_prop || !should_flip_negation ||
5576         (options & PCRE_UCP) != 0))
5577 #elif !defined COMPILE_PCRE8
5578     if (xclass && (xclass_has_prop || !should_flip_negation))
5579 #endif
5580 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
5581       {
5582       /* For non-UCP wide characters, in a non-negative class containing \S or
5583       similar (should_flip_negation is set), all characters greater than 255
5584       must be in the class. */
5585 
5586       if (
5587 #if defined COMPILE_PCRE8
5588            utf &&
5589 #endif
5590            should_flip_negation && !negate_class && (options & PCRE_UCP) == 0)
5591         {
5592         *class_uchardata++ = XCL_RANGE;
5593         if (utf)   /* Will always be utf in the 8-bit library */
5594           {
5595           class_uchardata += PRIV(ord2utf)(0x100, class_uchardata);
5596           class_uchardata += PRIV(ord2utf)(0x10ffff, class_uchardata);
5597           }
5598         else       /* Can only happen for the 16-bit & 32-bit libraries */
5599           {
5600 #if defined COMPILE_PCRE16
5601           *class_uchardata++ = 0x100;
5602           *class_uchardata++ = 0xffffu;
5603 #elif defined COMPILE_PCRE32
5604           *class_uchardata++ = 0x100;
5605           *class_uchardata++ = 0xffffffffu;
5606 #endif
5607           }
5608         }
5609 
5610       *class_uchardata++ = XCL_END;    /* Marks the end of extra data */
5611       *code++ = OP_XCLASS;
5612       code += LINK_SIZE;
5613       *code = negate_class? XCL_NOT:0;
5614       if (xclass_has_prop) *code |= XCL_HASPROP;
5615 
5616       /* If the map is required, move up the extra data to make room for it;
5617       otherwise just move the code pointer to the end of the extra data. */
5618 
5619       if (class_has_8bitchar > 0)
5620         {
5621         *code++ |= XCL_MAP;
5622         memmove(code + (32 / sizeof(pcre_uchar)), code,
5623           IN_UCHARS(class_uchardata - code));
5624         if (negate_class && !xclass_has_prop)
5625           for (c = 0; c < 32; c++) classbits[c] = ~classbits[c];
5626         memcpy(code, classbits, 32);
5627         code = class_uchardata + (32 / sizeof(pcre_uchar));
5628         }
5629       else code = class_uchardata;
5630 
5631       /* Now fill in the complete length of the item */
5632 
5633       PUT(previous, 1, (int)(code - previous));
5634       break;   /* End of class handling */
5635       }
5636 
5637     /* Even though any XCLASS list is now discarded, we must allow for
5638     its memory. */
5639 
5640     if (lengthptr != NULL)
5641       *lengthptr += (int)(class_uchardata - class_uchardata_base);
5642 #endif
5643 
5644     /* If there are no characters > 255, or they are all to be included or
5645     excluded, set the opcode to OP_CLASS or OP_NCLASS, depending on whether the
5646     whole class was negated and whether there were negative specials such as \S
5647     (non-UCP) in the class. Then copy the 32-byte map into the code vector,
5648     negating it if necessary. */
5649 
5650     *code++ = (negate_class == should_flip_negation) ? OP_CLASS : OP_NCLASS;
5651     if (lengthptr == NULL)    /* Save time in the pre-compile phase */
5652       {
5653       if (negate_class)
5654         for (c = 0; c < 32; c++) classbits[c] = ~classbits[c];
5655       memcpy(code, classbits, 32);
5656       }
5657     code += 32 / sizeof(pcre_uchar);
5658 
5659     END_CLASS:
5660     break;
5661 
5662 
5663     /* ===================================================================*/
5664     /* Various kinds of repeat; '{' is not necessarily a quantifier, but this
5665     has been tested above. */
5666 
5667     case CHAR_LEFT_CURLY_BRACKET:
5668     if (!is_quantifier) goto NORMAL_CHAR;
5669     ptr = read_repeat_counts(ptr+1, &repeat_min, &repeat_max, errorcodeptr);
5670     if (*errorcodeptr != 0) goto FAILED;
5671     goto REPEAT;
5672 
5673     case CHAR_ASTERISK:
5674     repeat_min = 0;
5675     repeat_max = -1;
5676     goto REPEAT;
5677 
5678     case CHAR_PLUS:
5679     repeat_min = 1;
5680     repeat_max = -1;
5681     goto REPEAT;
5682 
5683     case CHAR_QUESTION_MARK:
5684     repeat_min = 0;
5685     repeat_max = 1;
5686 
5687     REPEAT:
5688     if (previous == NULL)
5689       {
5690       *errorcodeptr = ERR9;
5691       goto FAILED;
5692       }
5693 
5694     if (repeat_min == 0)
5695       {
5696       firstchar = zerofirstchar;    /* Adjust for zero repeat */
5697       firstcharflags = zerofirstcharflags;
5698       reqchar = zeroreqchar;        /* Ditto */
5699       reqcharflags = zeroreqcharflags;
5700       }
5701 
5702     /* Remember whether this is a variable length repeat */
5703 
5704     reqvary = (repeat_min == repeat_max)? 0 : REQ_VARY;
5705 
5706     op_type = 0;                    /* Default single-char op codes */
5707     possessive_quantifier = FALSE;  /* Default not possessive quantifier */
5708 
5709     /* Save start of previous item, in case we have to move it up in order to
5710     insert something before it. */
5711 
5712     tempcode = previous;
5713 
5714     /* Before checking for a possessive quantifier, we must skip over
5715     whitespace and comments in extended mode because Perl allows white space at
5716     this point. */
5717 
5718     if ((options & PCRE_EXTENDED) != 0)
5719       {
5720       const pcre_uchar *p = ptr + 1;
5721       for (;;)
5722         {
5723         while (MAX_255(*p) && (cd->ctypes[*p] & ctype_space) != 0) p++;
5724         if (*p != CHAR_NUMBER_SIGN) break;
5725         p++;
5726         while (*p != CHAR_NULL)
5727           {
5728           if (IS_NEWLINE(p))         /* For non-fixed-length newline cases, */
5729             {                        /* IS_NEWLINE sets cd->nllen. */
5730             p += cd->nllen;
5731             break;
5732             }
5733           p++;
5734 #ifdef SUPPORT_UTF
5735           if (utf) FORWARDCHAR(p);
5736 #endif
5737           }           /* Loop for comment characters */
5738         }             /* Loop for multiple comments */
5739       ptr = p - 1;    /* Character before the next significant one. */
5740       }
5741 
5742     /* We also need to skip over (?# comments, which are not dependent on
5743     extended mode. */
5744 
5745     if (ptr[1] == CHAR_LEFT_PARENTHESIS && ptr[2] == CHAR_QUESTION_MARK &&
5746         ptr[3] == CHAR_NUMBER_SIGN)
5747       {
5748       ptr += 4;
5749       while (*ptr != CHAR_NULL && *ptr != CHAR_RIGHT_PARENTHESIS) ptr++;
5750       if (*ptr == CHAR_NULL)
5751         {
5752         *errorcodeptr = ERR18;
5753         goto FAILED;
5754         }
5755       }
5756 
5757     /* If the next character is '+', we have a possessive quantifier. This
5758     implies greediness, whatever the setting of the PCRE_UNGREEDY option.
5759     If the next character is '?' this is a minimizing repeat, by default,
5760     but if PCRE_UNGREEDY is set, it works the other way round. We change the
5761     repeat type to the non-default. */
5762 
5763     if (ptr[1] == CHAR_PLUS)
5764       {
5765       repeat_type = 0;                  /* Force greedy */
5766       possessive_quantifier = TRUE;
5767       ptr++;
5768       }
5769     else if (ptr[1] == CHAR_QUESTION_MARK)
5770       {
5771       repeat_type = greedy_non_default;
5772       ptr++;
5773       }
5774     else repeat_type = greedy_default;
5775 
5776     /* If previous was a recursion call, wrap it in atomic brackets so that
5777     previous becomes the atomic group. All recursions were so wrapped in the
5778     past, but it no longer happens for non-repeated recursions. In fact, the
5779     repeated ones could be re-implemented independently so as not to need this,
5780     but for the moment we rely on the code for repeating groups. */
5781 
5782     if (*previous == OP_RECURSE)
5783       {
5784       memmove(previous + 1 + LINK_SIZE, previous, IN_UCHARS(1 + LINK_SIZE));
5785       *previous = OP_ONCE;
5786       PUT(previous, 1, 2 + 2*LINK_SIZE);
5787       previous[2 + 2*LINK_SIZE] = OP_KET;
5788       PUT(previous, 3 + 2*LINK_SIZE, 2 + 2*LINK_SIZE);
5789       code += 2 + 2 * LINK_SIZE;
5790       length_prevgroup = 3 + 3*LINK_SIZE;
5791 
5792       /* When actually compiling, we need to check whether this was a forward
5793       reference, and if so, adjust the offset. */
5794 
5795       if (lengthptr == NULL && cd->hwm >= cd->start_workspace + LINK_SIZE)
5796         {
5797         int offset = GET(cd->hwm, -LINK_SIZE);
5798         if (offset == previous + 1 - cd->start_code)
5799           PUT(cd->hwm, -LINK_SIZE, offset + 1 + LINK_SIZE);
5800         }
5801       }
5802 
5803     /* Now handle repetition for the different types of item. */
5804 
5805     /* If previous was a character or negated character match, abolish the item
5806     and generate a repeat item instead. If a char item has a minimum of more
5807     than one, ensure that it is set in reqchar - it might not be if a sequence
5808     such as x{3} is the first thing in a branch because the x will have gone
5809     into firstchar instead.  */
5810 
5811     if (*previous == OP_CHAR || *previous == OP_CHARI
5812         || *previous == OP_NOT || *previous == OP_NOTI)
5813       {
5814       switch (*previous)
5815         {
5816         default: /* Make compiler happy. */
5817         case OP_CHAR:  op_type = OP_STAR - OP_STAR; break;
5818         case OP_CHARI: op_type = OP_STARI - OP_STAR; break;
5819         case OP_NOT:   op_type = OP_NOTSTAR - OP_STAR; break;
5820         case OP_NOTI:  op_type = OP_NOTSTARI - OP_STAR; break;
5821         }
5822 
5823       /* Deal with UTF characters that take up more than one character. It's
5824       easier to write this out separately than try to macrify it. Use c to
5825       hold the length of the character in bytes, plus UTF_LENGTH to flag that
5826       it's a length rather than a small character. */
5827 
5828 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5829       if (utf && NOT_FIRSTCHAR(code[-1]))
5830         {
5831         pcre_uchar *lastchar = code - 1;
5832         BACKCHAR(lastchar);
5833         c = (int)(code - lastchar);     /* Length of UTF-8 character */
5834         memcpy(utf_chars, lastchar, IN_UCHARS(c)); /* Save the char */
5835         c |= UTF_LENGTH;                /* Flag c as a length */
5836         }
5837       else
5838 #endif /* SUPPORT_UTF */
5839 
5840       /* Handle the case of a single charater - either with no UTF support, or
5841       with UTF disabled, or for a single character UTF character. */
5842         {
5843         c = code[-1];
5844         if (*previous <= OP_CHARI && repeat_min > 1)
5845           {
5846           reqchar = c;
5847           reqcharflags = req_caseopt | cd->req_varyopt;
5848           }
5849         }
5850 
5851       goto OUTPUT_SINGLE_REPEAT;   /* Code shared with single character types */
5852       }
5853 
5854     /* If previous was a character type match (\d or similar), abolish it and
5855     create a suitable repeat item. The code is shared with single-character
5856     repeats by setting op_type to add a suitable offset into repeat_type. Note
5857     the the Unicode property types will be present only when SUPPORT_UCP is
5858     defined, but we don't wrap the little bits of code here because it just
5859     makes it horribly messy. */
5860 
5861     else if (*previous < OP_EODN)
5862       {
5863       pcre_uchar *oldcode;
5864       int prop_type, prop_value;
5865       op_type = OP_TYPESTAR - OP_STAR;  /* Use type opcodes */
5866       c = *previous;
5867 
5868       OUTPUT_SINGLE_REPEAT:
5869       if (*previous == OP_PROP || *previous == OP_NOTPROP)
5870         {
5871         prop_type = previous[1];
5872         prop_value = previous[2];
5873         }
5874       else prop_type = prop_value = -1;
5875 
5876       oldcode = code;
5877       code = previous;                  /* Usually overwrite previous item */
5878 
5879       /* If the maximum is zero then the minimum must also be zero; Perl allows
5880       this case, so we do too - by simply omitting the item altogether. */
5881 
5882       if (repeat_max == 0) goto END_REPEAT;
5883 
5884       /* Combine the op_type with the repeat_type */
5885 
5886       repeat_type += op_type;
5887 
5888       /* A minimum of zero is handled either as the special case * or ?, or as
5889       an UPTO, with the maximum given. */
5890 
5891       if (repeat_min == 0)
5892         {
5893         if (repeat_max == -1) *code++ = OP_STAR + repeat_type;
5894           else if (repeat_max == 1) *code++ = OP_QUERY + repeat_type;
5895         else
5896           {
5897           *code++ = OP_UPTO + repeat_type;
5898           PUT2INC(code, 0, repeat_max);
5899           }
5900         }
5901 
5902       /* A repeat minimum of 1 is optimized into some special cases. If the
5903       maximum is unlimited, we use OP_PLUS. Otherwise, the original item is
5904       left in place and, if the maximum is greater than 1, we use OP_UPTO with
5905       one less than the maximum. */
5906 
5907       else if (repeat_min == 1)
5908         {
5909         if (repeat_max == -1)
5910           *code++ = OP_PLUS + repeat_type;
5911         else
5912           {
5913           code = oldcode;                 /* leave previous item in place */
5914           if (repeat_max == 1) goto END_REPEAT;
5915           *code++ = OP_UPTO + repeat_type;
5916           PUT2INC(code, 0, repeat_max - 1);
5917           }
5918         }
5919 
5920       /* The case {n,n} is just an EXACT, while the general case {n,m} is
5921       handled as an EXACT followed by an UPTO. */
5922 
5923       else
5924         {
5925         *code++ = OP_EXACT + op_type;  /* NB EXACT doesn't have repeat_type */
5926         PUT2INC(code, 0, repeat_min);
5927 
5928         /* If the maximum is unlimited, insert an OP_STAR. Before doing so,
5929         we have to insert the character for the previous code. For a repeated
5930         Unicode property match, there are two extra bytes that define the
5931         required property. In UTF-8 mode, long characters have their length in
5932         c, with the UTF_LENGTH bit as a flag. */
5933 
5934         if (repeat_max < 0)
5935           {
5936 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5937           if (utf && (c & UTF_LENGTH) != 0)
5938             {
5939             memcpy(code, utf_chars, IN_UCHARS(c & 7));
5940             code += c & 7;
5941             }
5942           else
5943 #endif
5944             {
5945             *code++ = c;
5946             if (prop_type >= 0)
5947               {
5948               *code++ = prop_type;
5949               *code++ = prop_value;
5950               }
5951             }
5952           *code++ = OP_STAR + repeat_type;
5953           }
5954 
5955         /* Else insert an UPTO if the max is greater than the min, again
5956         preceded by the character, for the previously inserted code. If the
5957         UPTO is just for 1 instance, we can use QUERY instead. */
5958 
5959         else if (repeat_max != repeat_min)
5960           {
5961 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5962           if (utf && (c & UTF_LENGTH) != 0)
5963             {
5964             memcpy(code, utf_chars, IN_UCHARS(c & 7));
5965             code += c & 7;
5966             }
5967           else
5968 #endif
5969           *code++ = c;
5970           if (prop_type >= 0)
5971             {
5972             *code++ = prop_type;
5973             *code++ = prop_value;
5974             }
5975           repeat_max -= repeat_min;
5976 
5977           if (repeat_max == 1)
5978             {
5979             *code++ = OP_QUERY + repeat_type;
5980             }
5981           else
5982             {
5983             *code++ = OP_UPTO + repeat_type;
5984             PUT2INC(code, 0, repeat_max);
5985             }
5986           }
5987         }
5988 
5989       /* The character or character type itself comes last in all cases. */
5990 
5991 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
5992       if (utf && (c & UTF_LENGTH) != 0)
5993         {
5994         memcpy(code, utf_chars, IN_UCHARS(c & 7));
5995         code += c & 7;
5996         }
5997       else
5998 #endif
5999       *code++ = c;
6000 
6001       /* For a repeated Unicode property match, there are two extra bytes that
6002       define the required property. */
6003 
6004 #ifdef SUPPORT_UCP
6005       if (prop_type >= 0)
6006         {
6007         *code++ = prop_type;
6008         *code++ = prop_value;
6009         }
6010 #endif
6011       }
6012 
6013     /* If previous was a character class or a back reference, we put the repeat
6014     stuff after it, but just skip the item if the repeat was {0,0}. */
6015 
6016     else if (*previous == OP_CLASS || *previous == OP_NCLASS ||
6017 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
6018              *previous == OP_XCLASS ||
6019 #endif
6020              *previous == OP_REF   || *previous == OP_REFI ||
6021              *previous == OP_DNREF || *previous == OP_DNREFI)
6022       {
6023       if (repeat_max == 0)
6024         {
6025         code = previous;
6026         goto END_REPEAT;
6027         }
6028 
6029       if (repeat_min == 0 && repeat_max == -1)
6030         *code++ = OP_CRSTAR + repeat_type;
6031       else if (repeat_min == 1 && repeat_max == -1)
6032         *code++ = OP_CRPLUS + repeat_type;
6033       else if (repeat_min == 0 && repeat_max == 1)
6034         *code++ = OP_CRQUERY + repeat_type;
6035       else
6036         {
6037         *code++ = OP_CRRANGE + repeat_type;
6038         PUT2INC(code, 0, repeat_min);
6039         if (repeat_max == -1) repeat_max = 0;  /* 2-byte encoding for max */
6040         PUT2INC(code, 0, repeat_max);
6041         }
6042       }
6043 
6044     /* If previous was a bracket group, we may have to replicate it in certain
6045     cases. Note that at this point we can encounter only the "basic" bracket
6046     opcodes such as BRA and CBRA, as this is the place where they get converted
6047     into the more special varieties such as BRAPOS and SBRA. A test for >=
6048     OP_ASSERT and <= OP_COND includes ASSERT, ASSERT_NOT, ASSERTBACK,
6049     ASSERTBACK_NOT, ONCE, ONCE_NC, BRA, BRAPOS, CBRA, CBRAPOS, and COND.
6050     Originally, PCRE did not allow repetition of assertions, but now it does,
6051     for Perl compatibility. */
6052 
6053     else if (*previous >= OP_ASSERT && *previous <= OP_COND)
6054       {
6055       register int i;
6056       int len = (int)(code - previous);
6057       size_t base_hwm_offset = item_hwm_offset;
6058       pcre_uchar *bralink = NULL;
6059       pcre_uchar *brazeroptr = NULL;
6060 
6061       /* Repeating a DEFINE group is pointless, but Perl allows the syntax, so
6062       we just ignore the repeat. */
6063 
6064       if (*previous == OP_COND && previous[LINK_SIZE+1] == OP_DEF)
6065         goto END_REPEAT;
6066 
6067       /* There is no sense in actually repeating assertions. The only potential
6068       use of repetition is in cases when the assertion is optional. Therefore,
6069       if the minimum is greater than zero, just ignore the repeat. If the
6070       maximum is not zero or one, set it to 1. */
6071 
6072       if (*previous < OP_ONCE)    /* Assertion */
6073         {
6074         if (repeat_min > 0) goto END_REPEAT;
6075         if (repeat_max < 0 || repeat_max > 1) repeat_max = 1;
6076         }
6077 
6078       /* The case of a zero minimum is special because of the need to stick
6079       OP_BRAZERO in front of it, and because the group appears once in the
6080       data, whereas in other cases it appears the minimum number of times. For
6081       this reason, it is simplest to treat this case separately, as otherwise
6082       the code gets far too messy. There are several special subcases when the
6083       minimum is zero. */
6084 
6085       if (repeat_min == 0)
6086         {
6087         /* If the maximum is also zero, we used to just omit the group from the
6088         output altogether, like this:
6089 
6090         ** if (repeat_max == 0)
6091         **   {
6092         **   code = previous;
6093         **   goto END_REPEAT;
6094         **   }
6095 
6096         However, that fails when a group or a subgroup within it is referenced
6097         as a subroutine from elsewhere in the pattern, so now we stick in
6098         OP_SKIPZERO in front of it so that it is skipped on execution. As we
6099         don't have a list of which groups are referenced, we cannot do this
6100         selectively.
6101 
6102         If the maximum is 1 or unlimited, we just have to stick in the BRAZERO
6103         and do no more at this point. However, we do need to adjust any
6104         OP_RECURSE calls inside the group that refer to the group itself or any
6105         internal or forward referenced group, because the offset is from the
6106         start of the whole regex. Temporarily terminate the pattern while doing
6107         this. */
6108 
6109         if (repeat_max <= 1)    /* Covers 0, 1, and unlimited */
6110           {
6111           *code = OP_END;
6112           adjust_recurse(previous, 1, utf, cd, item_hwm_offset);
6113           memmove(previous + 1, previous, IN_UCHARS(len));
6114           code++;
6115           if (repeat_max == 0)
6116             {
6117             *previous++ = OP_SKIPZERO;
6118             goto END_REPEAT;
6119             }
6120           brazeroptr = previous;    /* Save for possessive optimizing */
6121           *previous++ = OP_BRAZERO + repeat_type;
6122           }
6123 
6124         /* If the maximum is greater than 1 and limited, we have to replicate
6125         in a nested fashion, sticking OP_BRAZERO before each set of brackets.
6126         The first one has to be handled carefully because it's the original
6127         copy, which has to be moved up. The remainder can be handled by code
6128         that is common with the non-zero minimum case below. We have to
6129         adjust the value or repeat_max, since one less copy is required. Once
6130         again, we may have to adjust any OP_RECURSE calls inside the group. */
6131 
6132         else
6133           {
6134           int offset;
6135           *code = OP_END;
6136           adjust_recurse(previous, 2 + LINK_SIZE, utf, cd, item_hwm_offset);
6137           memmove(previous + 2 + LINK_SIZE, previous, IN_UCHARS(len));
6138           code += 2 + LINK_SIZE;
6139           *previous++ = OP_BRAZERO + repeat_type;
6140           *previous++ = OP_BRA;
6141 
6142           /* We chain together the bracket offset fields that have to be
6143           filled in later when the ends of the brackets are reached. */
6144 
6145           offset = (bralink == NULL)? 0 : (int)(previous - bralink);
6146           bralink = previous;
6147           PUTINC(previous, 0, offset);
6148           }
6149 
6150         repeat_max--;
6151         }
6152 
6153       /* If the minimum is greater than zero, replicate the group as many
6154       times as necessary, and adjust the maximum to the number of subsequent
6155       copies that we need. If we set a first char from the group, and didn't
6156       set a required char, copy the latter from the former. If there are any
6157       forward reference subroutine calls in the group, there will be entries on
6158       the workspace list; replicate these with an appropriate increment. */
6159 
6160       else
6161         {
6162         if (repeat_min > 1)
6163           {
6164           /* In the pre-compile phase, we don't actually do the replication. We
6165           just adjust the length as if we had. Do some paranoid checks for
6166           potential integer overflow. The INT64_OR_DOUBLE type is a 64-bit
6167           integer type when available, otherwise double. */
6168 
6169           if (lengthptr != NULL)
6170             {
6171             int delta = (repeat_min - 1)*length_prevgroup;
6172             if ((INT64_OR_DOUBLE)(repeat_min - 1)*
6173                   (INT64_OR_DOUBLE)length_prevgroup >
6174                     (INT64_OR_DOUBLE)INT_MAX ||
6175                 OFLOW_MAX - *lengthptr < delta)
6176               {
6177               *errorcodeptr = ERR20;
6178               goto FAILED;
6179               }
6180             *lengthptr += delta;
6181             }
6182 
6183           /* This is compiling for real. If there is a set first byte for
6184           the group, and we have not yet set a "required byte", set it. Make
6185           sure there is enough workspace for copying forward references before
6186           doing the copy. */
6187 
6188           else
6189             {
6190             if (groupsetfirstchar && reqcharflags < 0)
6191               {
6192               reqchar = firstchar;
6193               reqcharflags = firstcharflags;
6194               }
6195 
6196             for (i = 1; i < repeat_min; i++)
6197               {
6198               pcre_uchar *hc;
6199               size_t this_hwm_offset = cd->hwm - cd->start_workspace;
6200               memcpy(code, previous, IN_UCHARS(len));
6201 
6202               while (cd->hwm > cd->start_workspace + cd->workspace_size -
6203                      WORK_SIZE_SAFETY_MARGIN -
6204                      (this_hwm_offset - base_hwm_offset))
6205                 {
6206                 *errorcodeptr = expand_workspace(cd);
6207                 if (*errorcodeptr != 0) goto FAILED;
6208                 }
6209 
6210               for (hc = (pcre_uchar *)cd->start_workspace + base_hwm_offset;
6211                    hc < (pcre_uchar *)cd->start_workspace + this_hwm_offset;
6212                    hc += LINK_SIZE)
6213                 {
6214                 PUT(cd->hwm, 0, GET(hc, 0) + len);
6215                 cd->hwm += LINK_SIZE;
6216                 }
6217               base_hwm_offset = this_hwm_offset;
6218               code += len;
6219               }
6220             }
6221           }
6222 
6223         if (repeat_max > 0) repeat_max -= repeat_min;
6224         }
6225 
6226       /* This code is common to both the zero and non-zero minimum cases. If
6227       the maximum is limited, it replicates the group in a nested fashion,
6228       remembering the bracket starts on a stack. In the case of a zero minimum,
6229       the first one was set up above. In all cases the repeat_max now specifies
6230       the number of additional copies needed. Again, we must remember to
6231       replicate entries on the forward reference list. */
6232 
6233       if (repeat_max >= 0)
6234         {
6235         /* In the pre-compile phase, we don't actually do the replication. We
6236         just adjust the length as if we had. For each repetition we must add 1
6237         to the length for BRAZERO and for all but the last repetition we must
6238         add 2 + 2*LINKSIZE to allow for the nesting that occurs. Do some
6239         paranoid checks to avoid integer overflow. The INT64_OR_DOUBLE type is
6240         a 64-bit integer type when available, otherwise double. */
6241 
6242         if (lengthptr != NULL && repeat_max > 0)
6243           {
6244           int delta = repeat_max * (length_prevgroup + 1 + 2 + 2*LINK_SIZE) -
6245                       2 - 2*LINK_SIZE;   /* Last one doesn't nest */
6246           if ((INT64_OR_DOUBLE)repeat_max *
6247                 (INT64_OR_DOUBLE)(length_prevgroup + 1 + 2 + 2*LINK_SIZE)
6248                   > (INT64_OR_DOUBLE)INT_MAX ||
6249               OFLOW_MAX - *lengthptr < delta)
6250             {
6251             *errorcodeptr = ERR20;
6252             goto FAILED;
6253             }
6254           *lengthptr += delta;
6255           }
6256 
6257         /* This is compiling for real */
6258 
6259         else for (i = repeat_max - 1; i >= 0; i--)
6260           {
6261           pcre_uchar *hc;
6262           size_t this_hwm_offset = cd->hwm - cd->start_workspace;
6263 
6264           *code++ = OP_BRAZERO + repeat_type;
6265 
6266           /* All but the final copy start a new nesting, maintaining the
6267           chain of brackets outstanding. */
6268 
6269           if (i != 0)
6270             {
6271             int offset;
6272             *code++ = OP_BRA;
6273             offset = (bralink == NULL)? 0 : (int)(code - bralink);
6274             bralink = code;
6275             PUTINC(code, 0, offset);
6276             }
6277 
6278           memcpy(code, previous, IN_UCHARS(len));
6279 
6280           /* Ensure there is enough workspace for forward references before
6281           copying them. */
6282 
6283           while (cd->hwm > cd->start_workspace + cd->workspace_size -
6284                  WORK_SIZE_SAFETY_MARGIN -
6285                  (this_hwm_offset - base_hwm_offset))
6286             {
6287             *errorcodeptr = expand_workspace(cd);
6288             if (*errorcodeptr != 0) goto FAILED;
6289             }
6290 
6291           for (hc = (pcre_uchar *)cd->start_workspace + base_hwm_offset;
6292                hc < (pcre_uchar *)cd->start_workspace + this_hwm_offset;
6293                hc += LINK_SIZE)
6294             {
6295             PUT(cd->hwm, 0, GET(hc, 0) + len + ((i != 0)? 2+LINK_SIZE : 1));
6296             cd->hwm += LINK_SIZE;
6297             }
6298           base_hwm_offset = this_hwm_offset;
6299           code += len;
6300           }
6301 
6302         /* Now chain through the pending brackets, and fill in their length
6303         fields (which are holding the chain links pro tem). */
6304 
6305         while (bralink != NULL)
6306           {
6307           int oldlinkoffset;
6308           int offset = (int)(code - bralink + 1);
6309           pcre_uchar *bra = code - offset;
6310           oldlinkoffset = GET(bra, 1);
6311           bralink = (oldlinkoffset == 0)? NULL : bralink - oldlinkoffset;
6312           *code++ = OP_KET;
6313           PUTINC(code, 0, offset);
6314           PUT(bra, 1, offset);
6315           }
6316         }
6317 
6318       /* If the maximum is unlimited, set a repeater in the final copy. For
6319       ONCE brackets, that's all we need to do. However, possessively repeated
6320       ONCE brackets can be converted into non-capturing brackets, as the
6321       behaviour of (?:xx)++ is the same as (?>xx)++ and this saves having to
6322       deal with possessive ONCEs specially.
6323 
6324       Otherwise, when we are doing the actual compile phase, check to see
6325       whether this group is one that could match an empty string. If so,
6326       convert the initial operator to the S form (e.g. OP_BRA -> OP_SBRA) so
6327       that runtime checking can be done. [This check is also applied to ONCE
6328       groups at runtime, but in a different way.]
6329 
6330       Then, if the quantifier was possessive and the bracket is not a
6331       conditional, we convert the BRA code to the POS form, and the KET code to
6332       KETRPOS. (It turns out to be convenient at runtime to detect this kind of
6333       subpattern at both the start and at the end.) The use of special opcodes
6334       makes it possible to reduce greatly the stack usage in pcre_exec(). If
6335       the group is preceded by OP_BRAZERO, convert this to OP_BRAPOSZERO.
6336 
6337       Then, if the minimum number of matches is 1 or 0, cancel the possessive
6338       flag so that the default action below, of wrapping everything inside
6339       atomic brackets, does not happen. When the minimum is greater than 1,
6340       there will be earlier copies of the group, and so we still have to wrap
6341       the whole thing. */
6342 
6343       else
6344         {
6345         pcre_uchar *ketcode = code - 1 - LINK_SIZE;
6346         pcre_uchar *bracode = ketcode - GET(ketcode, 1);
6347 
6348         /* Convert possessive ONCE brackets to non-capturing */
6349 
6350         if ((*bracode == OP_ONCE || *bracode == OP_ONCE_NC) &&
6351             possessive_quantifier) *bracode = OP_BRA;
6352 
6353         /* For non-possessive ONCE brackets, all we need to do is to
6354         set the KET. */
6355 
6356         if (*bracode == OP_ONCE || *bracode == OP_ONCE_NC)
6357           *ketcode = OP_KETRMAX + repeat_type;
6358 
6359         /* Handle non-ONCE brackets and possessive ONCEs (which have been
6360         converted to non-capturing above). */
6361 
6362         else
6363           {
6364           /* In the compile phase, check for empty string matching. */
6365 
6366           if (lengthptr == NULL)
6367             {
6368             pcre_uchar *scode = bracode;
6369             do
6370               {
6371               if (could_be_empty_branch(scode, ketcode, utf, cd, NULL))
6372                 {
6373                 *bracode += OP_SBRA - OP_BRA;
6374                 break;
6375                 }
6376               scode += GET(scode, 1);
6377               }
6378             while (*scode == OP_ALT);
6379             }
6380 
6381           /* A conditional group with only one branch has an implicit empty
6382           alternative branch. */
6383 
6384           if (*bracode == OP_COND && bracode[GET(bracode,1)] != OP_ALT)
6385             *bracode = OP_SCOND;
6386 
6387           /* Handle possessive quantifiers. */
6388 
6389           if (possessive_quantifier)
6390             {
6391             /* For COND brackets, we wrap the whole thing in a possessively
6392             repeated non-capturing bracket, because we have not invented POS
6393             versions of the COND opcodes. Because we are moving code along, we
6394             must ensure that any pending recursive references are updated. */
6395 
6396             if (*bracode == OP_COND || *bracode == OP_SCOND)
6397               {
6398               int nlen = (int)(code - bracode);
6399               *code = OP_END;
6400               adjust_recurse(bracode, 1 + LINK_SIZE, utf, cd, item_hwm_offset);
6401               memmove(bracode + 1 + LINK_SIZE, bracode, IN_UCHARS(nlen));
6402               code += 1 + LINK_SIZE;
6403               nlen += 1 + LINK_SIZE;
6404               *bracode = (*bracode == OP_COND)? OP_BRAPOS : OP_SBRAPOS;
6405               *code++ = OP_KETRPOS;
6406               PUTINC(code, 0, nlen);
6407               PUT(bracode, 1, nlen);
6408               }
6409 
6410             /* For non-COND brackets, we modify the BRA code and use KETRPOS. */
6411 
6412             else
6413               {
6414               *bracode += 1;              /* Switch to xxxPOS opcodes */
6415               *ketcode = OP_KETRPOS;
6416               }
6417 
6418             /* If the minimum is zero, mark it as possessive, then unset the
6419             possessive flag when the minimum is 0 or 1. */
6420 
6421             if (brazeroptr != NULL) *brazeroptr = OP_BRAPOSZERO;
6422             if (repeat_min < 2) possessive_quantifier = FALSE;
6423             }
6424 
6425           /* Non-possessive quantifier */
6426 
6427           else *ketcode = OP_KETRMAX + repeat_type;
6428           }
6429         }
6430       }
6431 
6432     /* If previous is OP_FAIL, it was generated by an empty class [] in
6433     JavaScript mode. The other ways in which OP_FAIL can be generated, that is
6434     by (*FAIL) or (?!) set previous to NULL, which gives a "nothing to repeat"
6435     error above. We can just ignore the repeat in JS case. */
6436 
6437     else if (*previous == OP_FAIL) goto END_REPEAT;
6438 
6439     /* Else there's some kind of shambles */
6440 
6441     else
6442       {
6443       *errorcodeptr = ERR11;
6444       goto FAILED;
6445       }
6446 
6447     /* If the character following a repeat is '+', possessive_quantifier is
6448     TRUE. For some opcodes, there are special alternative opcodes for this
6449     case. For anything else, we wrap the entire repeated item inside OP_ONCE
6450     brackets. Logically, the '+' notation is just syntactic sugar, taken from
6451     Sun's Java package, but the special opcodes can optimize it.
6452 
6453     Some (but not all) possessively repeated subpatterns have already been
6454     completely handled in the code just above. For them, possessive_quantifier
6455     is always FALSE at this stage. Note that the repeated item starts at
6456     tempcode, not at previous, which might be the first part of a string whose
6457     (former) last char we repeated. */
6458 
6459     if (possessive_quantifier)
6460       {
6461       int len;
6462 
6463       /* Possessifying an EXACT quantifier has no effect, so we can ignore it.
6464       However, QUERY, STAR, or UPTO may follow (for quantifiers such as {5,6},
6465       {5,}, or {5,10}). We skip over an EXACT item; if the length of what
6466       remains is greater than zero, there's a further opcode that can be
6467       handled. If not, do nothing, leaving the EXACT alone. */
6468 
6469       switch(*tempcode)
6470         {
6471         case OP_TYPEEXACT:
6472         tempcode += PRIV(OP_lengths)[*tempcode] +
6473           ((tempcode[1 + IMM2_SIZE] == OP_PROP
6474           || tempcode[1 + IMM2_SIZE] == OP_NOTPROP)? 2 : 0);
6475         break;
6476 
6477         /* CHAR opcodes are used for exacts whose count is 1. */
6478 
6479         case OP_CHAR:
6480         case OP_CHARI:
6481         case OP_NOT:
6482         case OP_NOTI:
6483         case OP_EXACT:
6484         case OP_EXACTI:
6485         case OP_NOTEXACT:
6486         case OP_NOTEXACTI:
6487         tempcode += PRIV(OP_lengths)[*tempcode];
6488 #ifdef SUPPORT_UTF
6489         if (utf && HAS_EXTRALEN(tempcode[-1]))
6490           tempcode += GET_EXTRALEN(tempcode[-1]);
6491 #endif
6492         break;
6493 
6494         /* For the class opcodes, the repeat operator appears at the end;
6495         adjust tempcode to point to it. */
6496 
6497         case OP_CLASS:
6498         case OP_NCLASS:
6499         tempcode += 1 + 32/sizeof(pcre_uchar);
6500         break;
6501 
6502 #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
6503         case OP_XCLASS:
6504         tempcode += GET(tempcode, 1);
6505         break;
6506 #endif
6507         }
6508 
6509       /* If tempcode is equal to code (which points to the end of the repeated
6510       item), it means we have skipped an EXACT item but there is no following
6511       QUERY, STAR, or UPTO; the value of len will be 0, and we do nothing. In
6512       all other cases, tempcode will be pointing to the repeat opcode, and will
6513       be less than code, so the value of len will be greater than 0. */
6514 
6515       len = (int)(code - tempcode);
6516       if (len > 0)
6517         {
6518         unsigned int repcode = *tempcode;
6519 
6520         /* There is a table for possessifying opcodes, all of which are less
6521         than OP_CALLOUT. A zero entry means there is no possessified version.
6522         */
6523 
6524         if (repcode < OP_CALLOUT && opcode_possessify[repcode] > 0)
6525           *tempcode = opcode_possessify[repcode];
6526 
6527         /* For opcode without a special possessified version, wrap the item in
6528         ONCE brackets. Because we are moving code along, we must ensure that any
6529         pending recursive references are updated. */
6530 
6531         else
6532           {
6533           *code = OP_END;
6534           adjust_recurse(tempcode, 1 + LINK_SIZE, utf, cd, item_hwm_offset);
6535           memmove(tempcode + 1 + LINK_SIZE, tempcode, IN_UCHARS(len));
6536           code += 1 + LINK_SIZE;
6537           len += 1 + LINK_SIZE;
6538           tempcode[0] = OP_ONCE;
6539           *code++ = OP_KET;
6540           PUTINC(code, 0, len);
6541           PUT(tempcode, 1, len);
6542           }
6543         }
6544 
6545 #ifdef NEVER
6546       if (len > 0) switch (*tempcode)
6547         {
6548         case OP_STAR:  *tempcode = OP_POSSTAR; break;
6549         case OP_PLUS:  *tempcode = OP_POSPLUS; break;
6550         case OP_QUERY: *tempcode = OP_POSQUERY; break;
6551         case OP_UPTO:  *tempcode = OP_POSUPTO; break;
6552 
6553         case OP_STARI:  *tempcode = OP_POSSTARI; break;
6554         case OP_PLUSI:  *tempcode = OP_POSPLUSI; break;
6555         case OP_QUERYI: *tempcode = OP_POSQUERYI; break;
6556         case OP_UPTOI:  *tempcode = OP_POSUPTOI; break;
6557 
6558         case OP_NOTSTAR:  *tempcode = OP_NOTPOSSTAR; break;
6559         case OP_NOTPLUS:  *tempcode = OP_NOTPOSPLUS; break;
6560         case OP_NOTQUERY: *tempcode = OP_NOTPOSQUERY; break;
6561         case OP_NOTUPTO:  *tempcode = OP_NOTPOSUPTO; break;
6562 
6563         case OP_NOTSTARI:  *tempcode = OP_NOTPOSSTARI; break;
6564         case OP_NOTPLUSI:  *tempcode = OP_NOTPOSPLUSI; break;
6565         case OP_NOTQUERYI: *tempcode = OP_NOTPOSQUERYI; break;
6566         case OP_NOTUPTOI:  *tempcode = OP_NOTPOSUPTOI; break;
6567 
6568         case OP_TYPESTAR:  *tempcode = OP_TYPEPOSSTAR; break;
6569         case OP_TYPEPLUS:  *tempcode = OP_TYPEPOSPLUS; break;
6570         case OP_TYPEQUERY: *tempcode = OP_TYPEPOSQUERY; break;
6571         case OP_TYPEUPTO:  *tempcode = OP_TYPEPOSUPTO; break;
6572 
6573         case OP_CRSTAR:   *tempcode = OP_CRPOSSTAR; break;
6574         case OP_CRPLUS:   *tempcode = OP_CRPOSPLUS; break;
6575         case OP_CRQUERY:  *tempcode = OP_CRPOSQUERY; break;
6576         case OP_CRRANGE:  *tempcode = OP_CRPOSRANGE; break;
6577 
6578         /* Because we are moving code along, we must ensure that any
6579         pending recursive references are updated. */
6580 
6581         default:
6582         *code = OP_END;
6583         adjust_recurse(tempcode, 1 + LINK_SIZE, utf, cd, item_hwm_offset);
6584         memmove(tempcode + 1 + LINK_SIZE, tempcode, IN_UCHARS(len));
6585         code += 1 + LINK_SIZE;
6586         len += 1 + LINK_SIZE;
6587         tempcode[0] = OP_ONCE;
6588         *code++ = OP_KET;
6589         PUTINC(code, 0, len);
6590         PUT(tempcode, 1, len);
6591         break;
6592         }
6593 #endif
6594       }
6595 
6596     /* In all case we no longer have a previous item. We also set the
6597     "follows varying string" flag for subsequently encountered reqchars if
6598     it isn't already set and we have just passed a varying length item. */
6599 
6600     END_REPEAT:
6601     previous = NULL;
6602     cd->req_varyopt |= reqvary;
6603     break;
6604 
6605 
6606     /* ===================================================================*/
6607     /* Start of nested parenthesized sub-expression, or comment or lookahead or
6608     lookbehind or option setting or condition or all the other extended
6609     parenthesis forms.  */
6610 
6611     case CHAR_LEFT_PARENTHESIS:
6612     ptr++;
6613 
6614     /* Now deal with various "verbs" that can be introduced by '*'. */
6615 
6616     if (ptr[0] == CHAR_ASTERISK && (ptr[1] == ':'
6617          || (MAX_255(ptr[1]) && ((cd->ctypes[ptr[1]] & ctype_letter) != 0))))
6618       {
6619       int i, namelen;
6620       int arglen = 0;
6621       const char *vn = verbnames;
6622       const pcre_uchar *name = ptr + 1;
6623       const pcre_uchar *arg = NULL;
6624       previous = NULL;
6625       ptr++;
6626       while (MAX_255(*ptr) && (cd->ctypes[*ptr] & ctype_letter) != 0) ptr++;
6627       namelen = (int)(ptr - name);
6628 
6629       /* It appears that Perl allows any characters whatsoever, other than
6630       a closing parenthesis, to appear in arguments, so we no longer insist on
6631       letters, digits, and underscores. */
6632 
6633       if (*ptr == CHAR_COLON)
6634         {
6635         arg = ++ptr;
6636         while (*ptr != CHAR_NULL && *ptr != CHAR_RIGHT_PARENTHESIS) ptr++;
6637         arglen = (int)(ptr - arg);
6638         if ((unsigned int)arglen > MAX_MARK)
6639           {
6640           *errorcodeptr = ERR75;
6641           goto FAILED;
6642           }
6643         }
6644 
6645       if (*ptr != CHAR_RIGHT_PARENTHESIS)
6646         {
6647         *errorcodeptr = ERR60;
6648         goto FAILED;
6649         }
6650 
6651       /* Scan the table of verb names */
6652 
6653       for (i = 0; i < verbcount; i++)
6654         {
6655         if (namelen == verbs[i].len &&
6656             STRNCMP_UC_C8(name, vn, namelen) == 0)
6657           {
6658           int setverb;
6659 
6660           /* Check for open captures before ACCEPT and convert it to
6661           ASSERT_ACCEPT if in an assertion. */
6662 
6663           if (verbs[i].op == OP_ACCEPT)
6664             {
6665             open_capitem *oc;
6666             if (arglen != 0)
6667               {
6668               *errorcodeptr = ERR59;
6669               goto FAILED;
6670               }
6671             cd->had_accept = TRUE;
6672             for (oc = cd->open_caps; oc != NULL; oc = oc->next)
6673               {
6674               if (lengthptr != NULL)
6675                 {
6676 #ifdef COMPILE_PCRE8
6677                 *lengthptr += 1 + IMM2_SIZE;
6678 #elif defined COMPILE_PCRE16
6679                 *lengthptr += 2 + IMM2_SIZE;
6680 #elif defined COMPILE_PCRE32
6681                 *lengthptr += 4 + IMM2_SIZE;
6682 #endif
6683                 }
6684               else
6685                 {
6686                 *code++ = OP_CLOSE;
6687                 PUT2INC(code, 0, oc->number);
6688                 }
6689               }
6690             setverb = *code++ =
6691               (cd->assert_depth > 0)? OP_ASSERT_ACCEPT : OP_ACCEPT;
6692 
6693             /* Do not set firstchar after *ACCEPT */
6694             if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
6695             }
6696 
6697           /* Handle other cases with/without an argument */
6698 
6699           else if (arglen == 0)
6700             {
6701             if (verbs[i].op < 0)   /* Argument is mandatory */
6702               {
6703               *errorcodeptr = ERR66;
6704               goto FAILED;
6705               }
6706             setverb = *code++ = verbs[i].op;
6707             }
6708 
6709           else
6710             {
6711             if (verbs[i].op_arg < 0)   /* Argument is forbidden */
6712               {
6713               *errorcodeptr = ERR59;
6714               goto FAILED;
6715               }
6716             setverb = *code++ = verbs[i].op_arg;
6717             if (lengthptr != NULL)    /* In pass 1 just add in the length */
6718               {                       /* to avoid potential workspace */
6719               *lengthptr += arglen;   /* overflow. */
6720               *code++ = 0;
6721               }
6722             else
6723               {
6724               *code++ = arglen;
6725               memcpy(code, arg, IN_UCHARS(arglen));
6726               code += arglen;
6727               }
6728             *code++ = 0;
6729             }
6730 
6731           switch (setverb)
6732             {
6733             case OP_THEN:
6734             case OP_THEN_ARG:
6735             cd->external_flags |= PCRE_HASTHEN;
6736             break;
6737 
6738             case OP_PRUNE:
6739             case OP_PRUNE_ARG:
6740             case OP_SKIP:
6741             case OP_SKIP_ARG:
6742             cd->had_pruneorskip = TRUE;
6743             break;
6744             }
6745 
6746           break;  /* Found verb, exit loop */
6747           }
6748 
6749         vn += verbs[i].len + 1;
6750         }
6751 
6752       if (i < verbcount) continue;    /* Successfully handled a verb */
6753       *errorcodeptr = ERR60;          /* Verb not recognized */
6754       goto FAILED;
6755       }
6756 
6757     /* Initialize for "real" parentheses */
6758 
6759     newoptions = options;
6760     skipbytes = 0;
6761     bravalue = OP_CBRA;
6762     item_hwm_offset = cd->hwm - cd->start_workspace;
6763     reset_bracount = FALSE;
6764 
6765     /* Deal with the extended parentheses; all are introduced by '?', and the
6766     appearance of any of them means that this is not a capturing group. */
6767 
6768     if (*ptr == CHAR_QUESTION_MARK)
6769       {
6770       int i, set, unset, namelen;
6771       int *optset;
6772       const pcre_uchar *name;
6773       pcre_uchar *slot;
6774 
6775       switch (*(++ptr))
6776         {
6777         /* ------------------------------------------------------------ */
6778         case CHAR_VERTICAL_LINE:  /* Reset capture count for each branch */
6779         reset_bracount = TRUE;
6780         cd->dupgroups = TRUE;     /* Record (?| encountered */
6781         /* Fall through */
6782 
6783         /* ------------------------------------------------------------ */
6784         case CHAR_COLON:          /* Non-capturing bracket */
6785         bravalue = OP_BRA;
6786         ptr++;
6787         break;
6788 
6789 
6790         /* ------------------------------------------------------------ */
6791         case CHAR_LEFT_PARENTHESIS:
6792         bravalue = OP_COND;       /* Conditional group */
6793         tempptr = ptr;
6794 
6795         /* A condition can be an assertion, a number (referring to a numbered
6796         group's having been set), a name (referring to a named group), or 'R',
6797         referring to recursion. R<digits> and R&name are also permitted for
6798         recursion tests.
6799 
6800         There are ways of testing a named group: (?(name)) is used by Python;
6801         Perl 5.10 onwards uses (?(<name>) or (?('name')).
6802 
6803         There is one unfortunate ambiguity, caused by history. 'R' can be the
6804         recursive thing or the name 'R' (and similarly for 'R' followed by
6805         digits). We look for a name first; if not found, we try the other case.
6806 
6807         For compatibility with auto-callouts, we allow a callout to be
6808         specified before a condition that is an assertion. First, check for the
6809         syntax of a callout; if found, adjust the temporary pointer that is
6810         used to check for an assertion condition. That's all that is needed! */
6811 
6812         if (ptr[1] == CHAR_QUESTION_MARK && ptr[2] == CHAR_C)
6813           {
6814           for (i = 3;; i++) if (!IS_DIGIT(ptr[i])) break;
6815           if (ptr[i] == CHAR_RIGHT_PARENTHESIS)
6816             tempptr += i + 1;
6817 
6818           /* tempptr should now be pointing to the opening parenthesis of the
6819           assertion condition. */
6820 
6821           if (*tempptr != CHAR_LEFT_PARENTHESIS)
6822             {
6823             *errorcodeptr = ERR28;
6824             goto FAILED;
6825             }
6826           }
6827 
6828         /* For conditions that are assertions, check the syntax, and then exit
6829         the switch. This will take control down to where bracketed groups,
6830         including assertions, are processed. */
6831 
6832         if (tempptr[1] == CHAR_QUESTION_MARK &&
6833               (tempptr[2] == CHAR_EQUALS_SIGN ||
6834                tempptr[2] == CHAR_EXCLAMATION_MARK ||
6835                  (tempptr[2] == CHAR_LESS_THAN_SIGN &&
6836                    (tempptr[3] == CHAR_EQUALS_SIGN ||
6837                     tempptr[3] == CHAR_EXCLAMATION_MARK))))
6838           {
6839           cd->iscondassert = TRUE;
6840           break;
6841           }
6842 
6843         /* Other conditions use OP_CREF/OP_DNCREF/OP_RREF/OP_DNRREF, and all
6844         need to skip at least 1+IMM2_SIZE bytes at the start of the group. */
6845 
6846         code[1+LINK_SIZE] = OP_CREF;
6847         skipbytes = 1+IMM2_SIZE;
6848         refsign = -1;     /* => not a number */
6849         namelen = -1;     /* => not a name; must set to avoid warning */
6850         name = NULL;      /* Always set to avoid warning */
6851         recno = 0;        /* Always set to avoid warning */
6852 
6853         /* Check for a test for recursion in a named group. */
6854 
6855         ptr++;
6856         if (*ptr == CHAR_R && ptr[1] == CHAR_AMPERSAND)
6857           {
6858           terminator = -1;
6859           ptr += 2;
6860           code[1+LINK_SIZE] = OP_RREF;    /* Change the type of test */
6861           }
6862 
6863         /* Check for a test for a named group's having been set, using the Perl
6864         syntax (?(<name>) or (?('name'), and also allow for the original PCRE
6865         syntax of (?(name) or for (?(+n), (?(-n), and just (?(n). */
6866 
6867         else if (*ptr == CHAR_LESS_THAN_SIGN)
6868           {
6869           terminator = CHAR_GREATER_THAN_SIGN;
6870           ptr++;
6871           }
6872         else if (*ptr == CHAR_APOSTROPHE)
6873           {
6874           terminator = CHAR_APOSTROPHE;
6875           ptr++;
6876           }
6877         else
6878           {
6879           terminator = CHAR_NULL;
6880           if (*ptr == CHAR_MINUS || *ptr == CHAR_PLUS) refsign = *ptr++;
6881             else if (IS_DIGIT(*ptr)) refsign = 0;
6882           }
6883 
6884         /* Handle a number */
6885 
6886         if (refsign >= 0)
6887           {
6888           while (IS_DIGIT(*ptr))
6889             {
6890             if (recno > INT_MAX / 10 - 1)  /* Integer overflow */
6891               {
6892               while (IS_DIGIT(*ptr)) ptr++;
6893               *errorcodeptr = ERR61;
6894               goto FAILED;
6895               }
6896             recno = recno * 10 + (int)(*ptr - CHAR_0);
6897             ptr++;
6898             }
6899           }
6900 
6901         /* Otherwise we expect to read a name; anything else is an error. When
6902         a name is one of a number of duplicates, a different opcode is used and
6903         it needs more memory. Unfortunately we cannot tell whether a name is a
6904         duplicate in the first pass, so we have to allow for more memory. */
6905 
6906         else
6907           {
6908           if (IS_DIGIT(*ptr))
6909             {
6910             *errorcodeptr = ERR84;
6911             goto FAILED;
6912             }
6913           if (!MAX_255(*ptr) || (cd->ctypes[*ptr] & ctype_word) == 0)
6914             {
6915             *errorcodeptr = ERR28;   /* Assertion expected */
6916             goto FAILED;
6917             }
6918           name = ptr++;
6919           while (MAX_255(*ptr) && (cd->ctypes[*ptr] & ctype_word) != 0)
6920             {
6921             ptr++;
6922             }
6923           namelen = (int)(ptr - name);
6924           if (lengthptr != NULL) skipbytes += IMM2_SIZE;
6925           }
6926 
6927         /* Check the terminator */
6928 
6929         if ((terminator > 0 && *ptr++ != (pcre_uchar)terminator) ||
6930             *ptr++ != CHAR_RIGHT_PARENTHESIS)
6931           {
6932           ptr--;                  /* Error offset */
6933           *errorcodeptr = ERR26;  /* Malformed number or name */
6934           goto FAILED;
6935           }
6936 
6937         /* Do no further checking in the pre-compile phase. */
6938 
6939         if (lengthptr != NULL) break;
6940 
6941         /* In the real compile we do the work of looking for the actual
6942         reference. If refsign is not negative, it means we have a number in
6943         recno. */
6944 
6945         if (refsign >= 0)
6946           {
6947           if (recno <= 0)
6948             {
6949             *errorcodeptr = ERR35;
6950             goto FAILED;
6951             }
6952           if (refsign != 0) recno = (refsign == CHAR_MINUS)?
6953             cd->bracount - recno + 1 : recno + cd->bracount;
6954           if (recno <= 0 || recno > cd->final_bracount)
6955             {
6956             *errorcodeptr = ERR15;
6957             goto FAILED;
6958             }
6959           PUT2(code, 2+LINK_SIZE, recno);
6960           if (recno > cd->top_backref) cd->top_backref = recno;
6961           break;
6962           }
6963 
6964         /* Otherwise look for the name. */
6965 
6966         slot = cd->name_table;
6967         for (i = 0; i < cd->names_found; i++)
6968           {
6969           if (STRNCMP_UC_UC(name, slot+IMM2_SIZE, namelen) == 0 &&
6970             slot[IMM2_SIZE+namelen] == 0) break;
6971           slot += cd->name_entry_size;
6972           }
6973 
6974         /* Found the named subpattern. If the name is duplicated, add one to
6975         the opcode to change CREF/RREF into DNCREF/DNRREF and insert
6976         appropriate data values. Otherwise, just insert the unique subpattern
6977         number. */
6978 
6979         if (i < cd->names_found)
6980           {
6981           int offset = i++;
6982           int count = 1;
6983           recno = GET2(slot, 0);   /* Number from first found */
6984           if (recno > cd->top_backref) cd->top_backref = recno;
6985           for (; i < cd->names_found; i++)
6986             {
6987             slot += cd->name_entry_size;
6988             if (STRNCMP_UC_UC(name, slot+IMM2_SIZE, namelen) != 0 ||
6989               (slot+IMM2_SIZE)[namelen] != 0) break;
6990             count++;
6991             }
6992 
6993           if (count > 1)
6994             {
6995             PUT2(code, 2+LINK_SIZE, offset);
6996             PUT2(code, 2+LINK_SIZE+IMM2_SIZE, count);
6997             skipbytes += IMM2_SIZE;
6998             code[1+LINK_SIZE]++;
6999             }
7000           else  /* Not a duplicated name */
7001             {
7002             PUT2(code, 2+LINK_SIZE, recno);
7003             }
7004           }
7005 
7006         /* If terminator == CHAR_NULL it means that the name followed directly
7007         after the opening parenthesis [e.g. (?(abc)...] and in this case there
7008         are some further alternatives to try. For the cases where terminator !=
7009         CHAR_NULL [things like (?(<name>... or (?('name')... or (?(R&name)... ]
7010         we have now checked all the possibilities, so give an error. */
7011 
7012         else if (terminator != CHAR_NULL)
7013           {
7014           *errorcodeptr = ERR15;
7015           goto FAILED;
7016           }
7017 
7018         /* Check for (?(R) for recursion. Allow digits after R to specify a
7019         specific group number. */
7020 
7021         else if (*name == CHAR_R)
7022           {
7023           recno = 0;
7024           for (i = 1; i < namelen; i++)
7025             {
7026             if (!IS_DIGIT(name[i]))
7027               {
7028               *errorcodeptr = ERR15;
7029               goto FAILED;
7030               }
7031             if (recno > INT_MAX / 10 - 1)   /* Integer overflow */
7032               {
7033               *errorcodeptr = ERR61;
7034               goto FAILED;
7035               }
7036             recno = recno * 10 + name[i] - CHAR_0;
7037             }
7038           if (recno == 0) recno = RREF_ANY;
7039           code[1+LINK_SIZE] = OP_RREF;      /* Change test type */
7040           PUT2(code, 2+LINK_SIZE, recno);
7041           }
7042 
7043         /* Similarly, check for the (?(DEFINE) "condition", which is always
7044         false. */
7045 
7046         else if (namelen == 6 && STRNCMP_UC_C8(name, STRING_DEFINE, 6) == 0)
7047           {
7048           code[1+LINK_SIZE] = OP_DEF;
7049           skipbytes = 1;
7050           }
7051 
7052         /* Reference to an unidentified subpattern. */
7053 
7054         else
7055           {
7056           *errorcodeptr = ERR15;
7057           goto FAILED;
7058           }
7059         break;
7060 
7061 
7062         /* ------------------------------------------------------------ */
7063         case CHAR_EQUALS_SIGN:                 /* Positive lookahead */
7064         bravalue = OP_ASSERT;
7065         cd->assert_depth += 1;
7066         ptr++;
7067         break;
7068 
7069         /* Optimize (?!) to (*FAIL) unless it is quantified - which is a weird
7070         thing to do, but Perl allows all assertions to be quantified, and when
7071         they contain capturing parentheses there may be a potential use for
7072         this feature. Not that that applies to a quantified (?!) but we allow
7073         it for uniformity. */
7074 
7075         /* ------------------------------------------------------------ */
7076         case CHAR_EXCLAMATION_MARK:            /* Negative lookahead */
7077         ptr++;
7078         if (*ptr == CHAR_RIGHT_PARENTHESIS && ptr[1] != CHAR_ASTERISK &&
7079              ptr[1] != CHAR_PLUS && ptr[1] != CHAR_QUESTION_MARK &&
7080             (ptr[1] != CHAR_LEFT_CURLY_BRACKET || !is_counted_repeat(ptr+2)))
7081           {
7082           *code++ = OP_FAIL;
7083           previous = NULL;
7084           continue;
7085           }
7086         bravalue = OP_ASSERT_NOT;
7087         cd->assert_depth += 1;
7088         break;
7089 
7090 
7091         /* ------------------------------------------------------------ */
7092         case CHAR_LESS_THAN_SIGN:              /* Lookbehind or named define */
7093         switch (ptr[1])
7094           {
7095           case CHAR_EQUALS_SIGN:               /* Positive lookbehind */
7096           bravalue = OP_ASSERTBACK;
7097           cd->assert_depth += 1;
7098           ptr += 2;
7099           break;
7100 
7101           case CHAR_EXCLAMATION_MARK:          /* Negative lookbehind */
7102           bravalue = OP_ASSERTBACK_NOT;
7103           cd->assert_depth += 1;
7104           ptr += 2;
7105           break;
7106 
7107           default:                /* Could be name define, else bad */
7108           if (MAX_255(ptr[1]) && (cd->ctypes[ptr[1]] & ctype_word) != 0)
7109             goto DEFINE_NAME;
7110           ptr++;                  /* Correct offset for error */
7111           *errorcodeptr = ERR24;
7112           goto FAILED;
7113           }
7114         break;
7115 
7116 
7117         /* ------------------------------------------------------------ */
7118         case CHAR_GREATER_THAN_SIGN:           /* One-time brackets */
7119         bravalue = OP_ONCE;
7120         ptr++;
7121         break;
7122 
7123 
7124         /* ------------------------------------------------------------ */
7125         case CHAR_C:                 /* Callout - may be followed by digits; */
7126         previous_callout = code;     /* Save for later completion */
7127         after_manual_callout = 1;    /* Skip one item before completing */
7128         *code++ = OP_CALLOUT;
7129           {
7130           int n = 0;
7131           ptr++;
7132           while(IS_DIGIT(*ptr))
7133             n = n * 10 + *ptr++ - CHAR_0;
7134           if (*ptr != CHAR_RIGHT_PARENTHESIS)
7135             {
7136             *errorcodeptr = ERR39;
7137             goto FAILED;
7138             }
7139           if (n > 255)
7140             {
7141             *errorcodeptr = ERR38;
7142             goto FAILED;
7143             }
7144           *code++ = n;
7145           PUT(code, 0, (int)(ptr - cd->start_pattern + 1)); /* Pattern offset */
7146           PUT(code, LINK_SIZE, 0);                          /* Default length */
7147           code += 2 * LINK_SIZE;
7148           }
7149         previous = NULL;
7150         continue;
7151 
7152 
7153         /* ------------------------------------------------------------ */
7154         case CHAR_P:              /* Python-style named subpattern handling */
7155         if (*(++ptr) == CHAR_EQUALS_SIGN ||
7156             *ptr == CHAR_GREATER_THAN_SIGN)  /* Reference or recursion */
7157           {
7158           is_recurse = *ptr == CHAR_GREATER_THAN_SIGN;
7159           terminator = CHAR_RIGHT_PARENTHESIS;
7160           goto NAMED_REF_OR_RECURSE;
7161           }
7162         else if (*ptr != CHAR_LESS_THAN_SIGN)  /* Test for Python-style defn */
7163           {
7164           *errorcodeptr = ERR41;
7165           goto FAILED;
7166           }
7167         /* Fall through to handle (?P< as (?< is handled */
7168 
7169 
7170         /* ------------------------------------------------------------ */
7171         DEFINE_NAME:    /* Come here from (?< handling */
7172         case CHAR_APOSTROPHE:
7173         terminator = (*ptr == CHAR_LESS_THAN_SIGN)?
7174           CHAR_GREATER_THAN_SIGN : CHAR_APOSTROPHE;
7175         name = ++ptr;
7176         if (IS_DIGIT(*ptr))
7177           {
7178           *errorcodeptr = ERR84;   /* Group name must start with non-digit */
7179           goto FAILED;
7180           }
7181         while (MAX_255(*ptr) && (cd->ctypes[*ptr] & ctype_word) != 0) ptr++;
7182         namelen = (int)(ptr - name);
7183 
7184         /* In the pre-compile phase, do a syntax check, remember the longest
7185         name, and then remember the group in a vector, expanding it if
7186         necessary. Duplicates for the same number are skipped; other duplicates
7187         are checked for validity. In the actual compile, there is nothing to
7188         do. */
7189 
7190         if (lengthptr != NULL)
7191           {
7192           named_group *ng;
7193           pcre_uint32 number = cd->bracount + 1;
7194 
7195           if (*ptr != (pcre_uchar)terminator)
7196             {
7197             *errorcodeptr = ERR42;
7198             goto FAILED;
7199             }
7200 
7201           if (cd->names_found >= MAX_NAME_COUNT)
7202             {
7203             *errorcodeptr = ERR49;
7204             goto FAILED;
7205             }
7206 
7207           if (namelen + IMM2_SIZE + 1 > cd->name_entry_size)
7208             {
7209             cd->name_entry_size = namelen + IMM2_SIZE + 1;
7210             if (namelen > MAX_NAME_SIZE)
7211               {
7212               *errorcodeptr = ERR48;
7213               goto FAILED;
7214               }
7215             }
7216 
7217           /* Scan the list to check for duplicates. For duplicate names, if the
7218           number is the same, break the loop, which causes the name to be
7219           discarded; otherwise, if DUPNAMES is not set, give an error.
7220           If it is set, allow the name with a different number, but continue
7221           scanning in case this is a duplicate with the same number. For
7222           non-duplicate names, give an error if the number is duplicated. */
7223 
7224           ng = cd->named_groups;
7225           for (i = 0; i < cd->names_found; i++, ng++)
7226             {
7227             if (namelen == ng->length &&
7228                 STRNCMP_UC_UC(name, ng->name, namelen) == 0)
7229               {
7230               if (ng->number == number) break;
7231               if ((options & PCRE_DUPNAMES) == 0)
7232                 {
7233                 *errorcodeptr = ERR43;
7234                 goto FAILED;
7235                 }
7236               cd->dupnames = TRUE;  /* Duplicate names exist */
7237               }
7238             else if (ng->number == number)
7239               {
7240               *errorcodeptr = ERR65;
7241               goto FAILED;
7242               }
7243             }
7244 
7245           if (i >= cd->names_found)     /* Not a duplicate with same number */
7246             {
7247             /* Increase the list size if necessary */
7248 
7249             if (cd->names_found >= cd->named_group_list_size)
7250               {
7251               int newsize = cd->named_group_list_size * 2;
7252               named_group *newspace = (PUBL(malloc))
7253                 (newsize * sizeof(named_group));
7254 
7255               if (newspace == NULL)
7256                 {
7257                 *errorcodeptr = ERR21;
7258                 goto FAILED;
7259                 }
7260 
7261               memcpy(newspace, cd->named_groups,
7262                 cd->named_group_list_size * sizeof(named_group));
7263               if (cd->named_group_list_size > NAMED_GROUP_LIST_SIZE)
7264                 (PUBL(free))((void *)cd->named_groups);
7265               cd->named_groups = newspace;
7266               cd->named_group_list_size = newsize;
7267               }
7268 
7269             cd->named_groups[cd->names_found].name = name;
7270             cd->named_groups[cd->names_found].length = namelen;
7271             cd->named_groups[cd->names_found].number = number;
7272             cd->names_found++;
7273             }
7274           }
7275 
7276         ptr++;                    /* Move past > or ' in both passes. */
7277         goto NUMBERED_GROUP;
7278 
7279 
7280         /* ------------------------------------------------------------ */
7281         case CHAR_AMPERSAND:            /* Perl recursion/subroutine syntax */
7282         terminator = CHAR_RIGHT_PARENTHESIS;
7283         is_recurse = TRUE;
7284         /* Fall through */
7285 
7286         /* We come here from the Python syntax above that handles both
7287         references (?P=name) and recursion (?P>name), as well as falling
7288         through from the Perl recursion syntax (?&name). We also come here from
7289         the Perl \k<name> or \k'name' back reference syntax and the \k{name}
7290         .NET syntax, and the Oniguruma \g<...> and \g'...' subroutine syntax. */
7291 
7292         NAMED_REF_OR_RECURSE:
7293         name = ++ptr;
7294         if (IS_DIGIT(*ptr))
7295           {
7296           *errorcodeptr = ERR84;   /* Group name must start with non-digit */
7297           goto FAILED;
7298           }
7299         while (MAX_255(*ptr) && (cd->ctypes[*ptr] & ctype_word) != 0) ptr++;
7300         namelen = (int)(ptr - name);
7301 
7302         /* In the pre-compile phase, do a syntax check. We used to just set
7303         a dummy reference number, because it was not used in the first pass.
7304         However, with the change of recursive back references to be atomic,
7305         we have to look for the number so that this state can be identified, as
7306         otherwise the incorrect length is computed. If it's not a backwards
7307         reference, the dummy number will do. */
7308 
7309         if (lengthptr != NULL)
7310           {
7311           named_group *ng;
7312           recno = 0;
7313 
7314           if (namelen == 0)
7315             {
7316             *errorcodeptr = ERR62;
7317             goto FAILED;
7318             }
7319           if (*ptr != (pcre_uchar)terminator)
7320             {
7321             *errorcodeptr = ERR42;
7322             goto FAILED;
7323             }
7324           if (namelen > MAX_NAME_SIZE)
7325             {
7326             *errorcodeptr = ERR48;
7327             goto FAILED;
7328             }
7329 
7330           /* Count named back references. */
7331 
7332           if (!is_recurse) cd->namedrefcount++;
7333 
7334           /* We have to allow for a named reference to a duplicated name (this
7335           cannot be determined until the second pass). This needs an extra
7336           16-bit data item. */
7337 
7338           *lengthptr += IMM2_SIZE;
7339 
7340           /* If this is a forward reference and we are within a (?|...) group,
7341           the reference may end up as the number of a group which we are
7342           currently inside, that is, it could be a recursive reference. In the
7343           real compile this will be picked up and the reference wrapped with
7344           OP_ONCE to make it atomic, so we must space in case this occurs. */
7345 
7346           /* In fact, this can happen for a non-forward reference because
7347           another group with the same number might be created later. This
7348           issue is fixed "properly" in PCRE2. As PCRE1 is now in maintenance
7349           only mode, we finesse the bug by allowing more memory always. */
7350 
7351           *lengthptr += 4 + 4*LINK_SIZE;
7352 
7353           /* It is even worse than that. The current reference may be to an
7354           existing named group with a different number (so apparently not
7355           recursive) but which later on is also attached to a group with the
7356           current number. This can only happen if $(| has been previous
7357           encountered. In that case, we allow yet more memory, just in case.
7358           (Again, this is fixed "properly" in PCRE2. */
7359 
7360           if (cd->dupgroups) *lengthptr += 4 + 4*LINK_SIZE;
7361 
7362           /* Otherwise, check for recursion here. The name table does not exist
7363           in the first pass; instead we must scan the list of names encountered
7364           so far in order to get the number. If the name is not found, leave
7365           the value of recno as 0 for a forward reference. */
7366 
7367           /* This patch (removing "else") fixes a problem when a reference is
7368           to multiple identically named nested groups from within the nest.
7369           Once again, it is not the "proper" fix, and it results in an
7370           over-allocation of memory. */
7371 
7372           /* else */
7373             {
7374             ng = cd->named_groups;
7375             for (i = 0; i < cd->names_found; i++, ng++)
7376               {
7377               if (namelen == ng->length &&
7378                   STRNCMP_UC_UC(name, ng->name, namelen) == 0)
7379                 {
7380                 open_capitem *oc;
7381                 recno = ng->number;
7382                 if (is_recurse) break;
7383                 for (oc = cd->open_caps; oc != NULL; oc = oc->next)
7384                   {
7385                   if (oc->number == recno)
7386                     {
7387                     oc->flag = TRUE;
7388                     break;
7389                     }
7390                   }
7391                 }
7392               }
7393             }
7394           }
7395 
7396         /* In the real compile, search the name table. We check the name
7397         first, and then check that we have reached the end of the name in the
7398         table. That way, if the name is longer than any in the table, the
7399         comparison will fail without reading beyond the table entry. */
7400 
7401         else
7402           {
7403           slot = cd->name_table;
7404           for (i = 0; i < cd->names_found; i++)
7405             {
7406             if (STRNCMP_UC_UC(name, slot+IMM2_SIZE, namelen) == 0 &&
7407                 slot[IMM2_SIZE+namelen] == 0)
7408               break;
7409             slot += cd->name_entry_size;
7410             }
7411 
7412           if (i < cd->names_found)
7413             {
7414             recno = GET2(slot, 0);
7415             }
7416           else
7417             {
7418             *errorcodeptr = ERR15;
7419             goto FAILED;
7420             }
7421           }
7422 
7423         /* In both phases, for recursions, we can now go to the code than
7424         handles numerical recursion. */
7425 
7426         if (is_recurse) goto HANDLE_RECURSION;
7427 
7428         /* In the second pass we must see if the name is duplicated. If so, we
7429         generate a different opcode. */
7430 
7431         if (lengthptr == NULL && cd->dupnames)
7432           {
7433           int count = 1;
7434           unsigned int index = i;
7435           pcre_uchar *cslot = slot + cd->name_entry_size;
7436 
7437           for (i++; i < cd->names_found; i++)
7438             {
7439             if (STRCMP_UC_UC(slot + IMM2_SIZE, cslot + IMM2_SIZE) != 0) break;
7440             count++;
7441             cslot += cd->name_entry_size;
7442             }
7443 
7444           if (count > 1)
7445             {
7446             if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
7447             previous = code;
7448             item_hwm_offset = cd->hwm - cd->start_workspace;
7449             *code++ = ((options & PCRE_CASELESS) != 0)? OP_DNREFI : OP_DNREF;
7450             PUT2INC(code, 0, index);
7451             PUT2INC(code, 0, count);
7452 
7453             /* Process each potentially referenced group. */
7454 
7455             for (; slot < cslot; slot += cd->name_entry_size)
7456               {
7457               open_capitem *oc;
7458               recno = GET2(slot, 0);
7459               cd->backref_map |= (recno < 32)? (1 << recno) : 1;
7460               if (recno > cd->top_backref) cd->top_backref = recno;
7461 
7462               /* Check to see if this back reference is recursive, that it, it
7463               is inside the group that it references. A flag is set so that the
7464               group can be made atomic. */
7465 
7466               for (oc = cd->open_caps; oc != NULL; oc = oc->next)
7467                 {
7468                 if (oc->number == recno)
7469                   {
7470                   oc->flag = TRUE;
7471                   break;
7472                   }
7473                 }
7474               }
7475 
7476             continue;  /* End of back ref handling */
7477             }
7478           }
7479 
7480         /* First pass, or a non-duplicated name. */
7481 
7482         goto HANDLE_REFERENCE;
7483 
7484 
7485         /* ------------------------------------------------------------ */
7486         case CHAR_R:              /* Recursion, same as (?0) */
7487         recno = 0;
7488         if (*(++ptr) != CHAR_RIGHT_PARENTHESIS)
7489           {
7490           *errorcodeptr = ERR29;
7491           goto FAILED;
7492           }
7493         goto HANDLE_RECURSION;
7494 
7495 
7496         /* ------------------------------------------------------------ */
7497         case CHAR_MINUS: case CHAR_PLUS:  /* Recursion or subroutine */
7498         case CHAR_0: case CHAR_1: case CHAR_2: case CHAR_3: case CHAR_4:
7499         case CHAR_5: case CHAR_6: case CHAR_7: case CHAR_8: case CHAR_9:
7500           {
7501           const pcre_uchar *called;
7502           terminator = CHAR_RIGHT_PARENTHESIS;
7503 
7504           /* Come here from the \g<...> and \g'...' code (Oniguruma
7505           compatibility). However, the syntax has been checked to ensure that
7506           the ... are a (signed) number, so that neither ERR63 nor ERR29 will
7507           be called on this path, nor with the jump to OTHER_CHAR_AFTER_QUERY
7508           ever be taken. */
7509 
7510           HANDLE_NUMERICAL_RECURSION:
7511 
7512           if ((refsign = *ptr) == CHAR_PLUS)
7513             {
7514             ptr++;
7515             if (!IS_DIGIT(*ptr))
7516               {
7517               *errorcodeptr = ERR63;
7518               goto FAILED;
7519               }
7520             }
7521           else if (refsign == CHAR_MINUS)
7522             {
7523             if (!IS_DIGIT(ptr[1]))
7524               goto OTHER_CHAR_AFTER_QUERY;
7525             ptr++;
7526             }
7527 
7528           recno = 0;
7529           while(IS_DIGIT(*ptr))
7530             {
7531             if (recno > INT_MAX / 10 - 1) /* Integer overflow */
7532               {
7533               while (IS_DIGIT(*ptr)) ptr++;
7534               *errorcodeptr = ERR61;
7535               goto FAILED;
7536               }
7537             recno = recno * 10 + *ptr++ - CHAR_0;
7538             }
7539 
7540           if (*ptr != (pcre_uchar)terminator)
7541             {
7542             *errorcodeptr = ERR29;
7543             goto FAILED;
7544             }
7545 
7546           if (refsign == CHAR_MINUS)
7547             {
7548             if (recno == 0)
7549               {
7550               *errorcodeptr = ERR58;
7551               goto FAILED;
7552               }
7553             recno = cd->bracount - recno + 1;
7554             if (recno <= 0)
7555               {
7556               *errorcodeptr = ERR15;
7557               goto FAILED;
7558               }
7559             }
7560           else if (refsign == CHAR_PLUS)
7561             {
7562             if (recno == 0)
7563               {
7564               *errorcodeptr = ERR58;
7565               goto FAILED;
7566               }
7567             recno += cd->bracount;
7568             }
7569 
7570           /* Come here from code above that handles a named recursion */
7571 
7572           HANDLE_RECURSION:
7573 
7574           previous = code;
7575           item_hwm_offset = cd->hwm - cd->start_workspace;
7576           called = cd->start_code;
7577 
7578           /* When we are actually compiling, find the bracket that is being
7579           referenced. Temporarily end the regex in case it doesn't exist before
7580           this point. If we end up with a forward reference, first check that
7581           the bracket does occur later so we can give the error (and position)
7582           now. Then remember this forward reference in the workspace so it can
7583           be filled in at the end. */
7584 
7585           if (lengthptr == NULL)
7586             {
7587             *code = OP_END;
7588             if (recno != 0)
7589               called = PRIV(find_bracket)(cd->start_code, utf, recno);
7590 
7591             /* Forward reference */
7592 
7593             if (called == NULL)
7594               {
7595               if (recno > cd->final_bracount)
7596                 {
7597                 *errorcodeptr = ERR15;
7598                 goto FAILED;
7599                 }
7600 
7601               /* Fudge the value of "called" so that when it is inserted as an
7602               offset below, what it actually inserted is the reference number
7603               of the group. Then remember the forward reference. */
7604 
7605               called = cd->start_code + recno;
7606               if (cd->hwm >= cd->start_workspace + cd->workspace_size -
7607                   WORK_SIZE_SAFETY_MARGIN)
7608                 {
7609                 *errorcodeptr = expand_workspace(cd);
7610                 if (*errorcodeptr != 0) goto FAILED;
7611                 }
7612               PUTINC(cd->hwm, 0, (int)(code + 1 - cd->start_code));
7613               }
7614 
7615             /* If not a forward reference, and the subpattern is still open,
7616             this is a recursive call. We check to see if this is a left
7617             recursion that could loop for ever, and diagnose that case. We
7618             must not, however, do this check if we are in a conditional
7619             subpattern because the condition might be testing for recursion in
7620             a pattern such as /(?(R)a+|(?R)b)/, which is perfectly valid.
7621             Forever loops are also detected at runtime, so those that occur in
7622             conditional subpatterns will be picked up then. */
7623 
7624             else if (GET(called, 1) == 0 && cond_depth <= 0 &&
7625                      could_be_empty(called, code, bcptr, utf, cd))
7626               {
7627               *errorcodeptr = ERR40;
7628               goto FAILED;
7629               }
7630             }
7631 
7632           /* Insert the recursion/subroutine item. It does not have a set first
7633           character (relevant if it is repeated, because it will then be
7634           wrapped with ONCE brackets). */
7635 
7636           *code = OP_RECURSE;
7637           PUT(code, 1, (int)(called - cd->start_code));
7638           code += 1 + LINK_SIZE;
7639           groupsetfirstchar = FALSE;
7640           }
7641 
7642         /* Can't determine a first byte now */
7643 
7644         if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
7645         continue;
7646 
7647 
7648         /* ------------------------------------------------------------ */
7649         default:              /* Other characters: check option setting */
7650         OTHER_CHAR_AFTER_QUERY:
7651         set = unset = 0;
7652         optset = &set;
7653 
7654         while (*ptr != CHAR_RIGHT_PARENTHESIS && *ptr != CHAR_COLON)
7655           {
7656           switch (*ptr++)
7657             {
7658             case CHAR_MINUS: optset = &unset; break;
7659 
7660             case CHAR_J:    /* Record that it changed in the external options */
7661             *optset |= PCRE_DUPNAMES;
7662             cd->external_flags |= PCRE_JCHANGED;
7663             break;
7664 
7665             case CHAR_i: *optset |= PCRE_CASELESS; break;
7666             case CHAR_m: *optset |= PCRE_MULTILINE; break;
7667             case CHAR_s: *optset |= PCRE_DOTALL; break;
7668             case CHAR_x: *optset |= PCRE_EXTENDED; break;
7669             case CHAR_U: *optset |= PCRE_UNGREEDY; break;
7670             case CHAR_X: *optset |= PCRE_EXTRA; break;
7671 
7672             default:  *errorcodeptr = ERR12;
7673                       ptr--;    /* Correct the offset */
7674                       goto FAILED;
7675             }
7676           }
7677 
7678         /* Set up the changed option bits, but don't change anything yet. */
7679 
7680         newoptions = (options | set) & (~unset);
7681 
7682         /* If the options ended with ')' this is not the start of a nested
7683         group with option changes, so the options change at this level.
7684         If we are not at the pattern start, reset the greedy defaults and the
7685         case value for firstchar and reqchar. */
7686 
7687         if (*ptr == CHAR_RIGHT_PARENTHESIS)
7688           {
7689           greedy_default = ((newoptions & PCRE_UNGREEDY) != 0);
7690           greedy_non_default = greedy_default ^ 1;
7691           req_caseopt = ((newoptions & PCRE_CASELESS) != 0)? REQ_CASELESS:0;
7692 
7693           /* Change options at this level, and pass them back for use
7694           in subsequent branches. */
7695 
7696           *optionsptr = options = newoptions;
7697           previous = NULL;       /* This item can't be repeated */
7698           continue;              /* It is complete */
7699           }
7700 
7701         /* If the options ended with ':' we are heading into a nested group
7702         with possible change of options. Such groups are non-capturing and are
7703         not assertions of any kind. All we need to do is skip over the ':';
7704         the newoptions value is handled below. */
7705 
7706         bravalue = OP_BRA;
7707         ptr++;
7708         }     /* End of switch for character following (? */
7709       }       /* End of (? handling */
7710 
7711     /* Opening parenthesis not followed by '*' or '?'. If PCRE_NO_AUTO_CAPTURE
7712     is set, all unadorned brackets become non-capturing and behave like (?:...)
7713     brackets. */
7714 
7715     else if ((options & PCRE_NO_AUTO_CAPTURE) != 0)
7716       {
7717       bravalue = OP_BRA;
7718       }
7719 
7720     /* Else we have a capturing group. */
7721 
7722     else
7723       {
7724       NUMBERED_GROUP:
7725       cd->bracount += 1;
7726       PUT2(code, 1+LINK_SIZE, cd->bracount);
7727       skipbytes = IMM2_SIZE;
7728       }
7729 
7730     /* Process nested bracketed regex. First check for parentheses nested too
7731     deeply. */
7732 
7733     if ((cd->parens_depth += 1) > PARENS_NEST_LIMIT)
7734       {
7735       *errorcodeptr = ERR82;
7736       goto FAILED;
7737       }
7738 
7739     /* All assertions used not to be repeatable, but this was changed for Perl
7740     compatibility. All kinds can now be repeated except for assertions that are
7741     conditions (Perl also forbids these to be repeated). We copy code into a
7742     non-register variable (tempcode) in order to be able to pass its address
7743     because some compilers complain otherwise. At the start of a conditional
7744     group whose condition is an assertion, cd->iscondassert is set. We unset it
7745     here so as to allow assertions later in the group to be quantified. */
7746 
7747     if (bravalue >= OP_ASSERT && bravalue <= OP_ASSERTBACK_NOT &&
7748         cd->iscondassert)
7749       {
7750       previous = NULL;
7751       cd->iscondassert = FALSE;
7752       }
7753     else
7754       {
7755       previous = code;
7756       item_hwm_offset = cd->hwm - cd->start_workspace;
7757       }
7758 
7759     *code = bravalue;
7760     tempcode = code;
7761     tempreqvary = cd->req_varyopt;        /* Save value before bracket */
7762     tempbracount = cd->bracount;          /* Save value before bracket */
7763     length_prevgroup = 0;                 /* Initialize for pre-compile phase */
7764 
7765     if (!compile_regex(
7766          newoptions,                      /* The complete new option state */
7767          &tempcode,                       /* Where to put code (updated) */
7768          &ptr,                            /* Input pointer (updated) */
7769          errorcodeptr,                    /* Where to put an error message */
7770          (bravalue == OP_ASSERTBACK ||
7771           bravalue == OP_ASSERTBACK_NOT), /* TRUE if back assert */
7772          reset_bracount,                  /* True if (?| group */
7773          skipbytes,                       /* Skip over bracket number */
7774          cond_depth +
7775            ((bravalue == OP_COND)?1:0),   /* Depth of condition subpatterns */
7776          &subfirstchar,                   /* For possible first char */
7777          &subfirstcharflags,
7778          &subreqchar,                     /* For possible last char */
7779          &subreqcharflags,
7780          bcptr,                           /* Current branch chain */
7781          cd,                              /* Tables block */
7782          (lengthptr == NULL)? NULL :      /* Actual compile phase */
7783            &length_prevgroup              /* Pre-compile phase */
7784          ))
7785       goto FAILED;
7786 
7787     cd->parens_depth -= 1;
7788 
7789     /* If this was an atomic group and there are no capturing groups within it,
7790     generate OP_ONCE_NC instead of OP_ONCE. */
7791 
7792     if (bravalue == OP_ONCE && cd->bracount <= tempbracount)
7793       *code = OP_ONCE_NC;
7794 
7795     if (bravalue >= OP_ASSERT && bravalue <= OP_ASSERTBACK_NOT)
7796       cd->assert_depth -= 1;
7797 
7798     /* At the end of compiling, code is still pointing to the start of the
7799     group, while tempcode has been updated to point past the end of the group.
7800     The pattern pointer (ptr) is on the bracket.
7801 
7802     If this is a conditional bracket, check that there are no more than
7803     two branches in the group, or just one if it's a DEFINE group. We do this
7804     in the real compile phase, not in the pre-pass, where the whole group may
7805     not be available. */
7806 
7807     if (bravalue == OP_COND && lengthptr == NULL)
7808       {
7809       pcre_uchar *tc = code;
7810       int condcount = 0;
7811 
7812       do {
7813          condcount++;
7814          tc += GET(tc,1);
7815          }
7816       while (*tc != OP_KET);
7817 
7818       /* A DEFINE group is never obeyed inline (the "condition" is always
7819       false). It must have only one branch. */
7820 
7821       if (code[LINK_SIZE+1] == OP_DEF)
7822         {
7823         if (condcount > 1)
7824           {
7825           *errorcodeptr = ERR54;
7826           goto FAILED;
7827           }
7828         bravalue = OP_DEF;   /* Just a flag to suppress char handling below */
7829         }
7830 
7831       /* A "normal" conditional group. If there is just one branch, we must not
7832       make use of its firstchar or reqchar, because this is equivalent to an
7833       empty second branch. */
7834 
7835       else
7836         {
7837         if (condcount > 2)
7838           {
7839           *errorcodeptr = ERR27;
7840           goto FAILED;
7841           }
7842         if (condcount == 1) subfirstcharflags = subreqcharflags = REQ_NONE;
7843         }
7844       }
7845 
7846     /* Error if hit end of pattern */
7847 
7848     if (*ptr != CHAR_RIGHT_PARENTHESIS)
7849       {
7850       *errorcodeptr = ERR14;
7851       goto FAILED;
7852       }
7853 
7854     /* In the pre-compile phase, update the length by the length of the group,
7855     less the brackets at either end. Then reduce the compiled code to just a
7856     set of non-capturing brackets so that it doesn't use much memory if it is
7857     duplicated by a quantifier.*/
7858 
7859     if (lengthptr != NULL)
7860       {
7861       if (OFLOW_MAX - *lengthptr < length_prevgroup - 2 - 2*LINK_SIZE)
7862         {
7863         *errorcodeptr = ERR20;
7864         goto FAILED;
7865         }
7866       *lengthptr += length_prevgroup - 2 - 2*LINK_SIZE;
7867       code++;   /* This already contains bravalue */
7868       PUTINC(code, 0, 1 + LINK_SIZE);
7869       *code++ = OP_KET;
7870       PUTINC(code, 0, 1 + LINK_SIZE);
7871       break;    /* No need to waste time with special character handling */
7872       }
7873 
7874     /* Otherwise update the main code pointer to the end of the group. */
7875 
7876     code = tempcode;
7877 
7878     /* For a DEFINE group, required and first character settings are not
7879     relevant. */
7880 
7881     if (bravalue == OP_DEF) break;
7882 
7883     /* Handle updating of the required and first characters for other types of
7884     group. Update for normal brackets of all kinds, and conditions with two
7885     branches (see code above). If the bracket is followed by a quantifier with
7886     zero repeat, we have to back off. Hence the definition of zeroreqchar and
7887     zerofirstchar outside the main loop so that they can be accessed for the
7888     back off. */
7889 
7890     zeroreqchar = reqchar;
7891     zeroreqcharflags = reqcharflags;
7892     zerofirstchar = firstchar;
7893     zerofirstcharflags = firstcharflags;
7894     groupsetfirstchar = FALSE;
7895 
7896     if (bravalue >= OP_ONCE)
7897       {
7898       /* If we have not yet set a firstchar in this branch, take it from the
7899       subpattern, remembering that it was set here so that a repeat of more
7900       than one can replicate it as reqchar if necessary. If the subpattern has
7901       no firstchar, set "none" for the whole branch. In both cases, a zero
7902       repeat forces firstchar to "none". */
7903 
7904       if (firstcharflags == REQ_UNSET)
7905         {
7906         if (subfirstcharflags >= 0)
7907           {
7908           firstchar = subfirstchar;
7909           firstcharflags = subfirstcharflags;
7910           groupsetfirstchar = TRUE;
7911           }
7912         else firstcharflags = REQ_NONE;
7913         zerofirstcharflags = REQ_NONE;
7914         }
7915 
7916       /* If firstchar was previously set, convert the subpattern's firstchar
7917       into reqchar if there wasn't one, using the vary flag that was in
7918       existence beforehand. */
7919 
7920       else if (subfirstcharflags >= 0 && subreqcharflags < 0)
7921         {
7922         subreqchar = subfirstchar;
7923         subreqcharflags = subfirstcharflags | tempreqvary;
7924         }
7925 
7926       /* If the subpattern set a required byte (or set a first byte that isn't
7927       really the first byte - see above), set it. */
7928 
7929       if (subreqcharflags >= 0)
7930         {
7931         reqchar = subreqchar;
7932         reqcharflags = subreqcharflags;
7933         }
7934       }
7935 
7936     /* For a forward assertion, we take the reqchar, if set, provided that the
7937     group has also set a first char. This can be helpful if the pattern that
7938     follows the assertion doesn't set a different char. For example, it's
7939     useful for /(?=abcde).+/. We can't set firstchar for an assertion, however
7940     because it leads to incorrect effect for patterns such as /(?=a)a.+/ when
7941     the "real" "a" would then become a reqchar instead of a firstchar. This is
7942     overcome by a scan at the end if there's no firstchar, looking for an
7943     asserted first char. */
7944 
7945     else if (bravalue == OP_ASSERT && subreqcharflags >= 0 &&
7946              subfirstcharflags >= 0)
7947       {
7948       reqchar = subreqchar;
7949       reqcharflags = subreqcharflags;
7950       }
7951     break;     /* End of processing '(' */
7952 
7953 
7954     /* ===================================================================*/
7955     /* Handle metasequences introduced by \. For ones like \d, the ESC_ values
7956     are arranged to be the negation of the corresponding OP_values in the
7957     default case when PCRE_UCP is not set. For the back references, the values
7958     are negative the reference number. Only back references and those types
7959     that consume a character may be repeated. We can test for values between
7960     ESC_b and ESC_Z for the latter; this may have to change if any new ones are
7961     ever created. */
7962 
7963     case CHAR_BACKSLASH:
7964     tempptr = ptr;
7965     escape = check_escape(&ptr, &ec, errorcodeptr, cd->bracount, options, FALSE);
7966     if (*errorcodeptr != 0) goto FAILED;
7967 
7968     if (escape == 0)                  /* The escape coded a single character */
7969       c = ec;
7970     else
7971       {
7972       /* For metasequences that actually match a character, we disable the
7973       setting of a first character if it hasn't already been set. */
7974 
7975       if (firstcharflags == REQ_UNSET && escape > ESC_b && escape < ESC_Z)
7976         firstcharflags = REQ_NONE;
7977 
7978       /* Set values to reset to if this is followed by a zero repeat. */
7979 
7980       zerofirstchar = firstchar;
7981       zerofirstcharflags = firstcharflags;
7982       zeroreqchar = reqchar;
7983       zeroreqcharflags = reqcharflags;
7984 
7985       /* \g<name> or \g'name' is a subroutine call by name and \g<n> or \g'n'
7986       is a subroutine call by number (Oniguruma syntax). In fact, the value
7987       ESC_g is returned only for these cases. So we don't need to check for <
7988       or ' if the value is ESC_g. For the Perl syntax \g{n} the value is
7989       -n, and for the Perl syntax \g{name} the result is ESC_k (as
7990       that is a synonym for a named back reference). */
7991 
7992       if (escape == ESC_g)
7993         {
7994         const pcre_uchar *p;
7995         pcre_uint32 cf;
7996 
7997         item_hwm_offset = cd->hwm - cd->start_workspace;   /* Normally this is set when '(' is read */
7998         terminator = (*(++ptr) == CHAR_LESS_THAN_SIGN)?
7999           CHAR_GREATER_THAN_SIGN : CHAR_APOSTROPHE;
8000 
8001         /* These two statements stop the compiler for warning about possibly
8002         unset variables caused by the jump to HANDLE_NUMERICAL_RECURSION. In
8003         fact, because we do the check for a number below, the paths that
8004         would actually be in error are never taken. */
8005 
8006         skipbytes = 0;
8007         reset_bracount = FALSE;
8008 
8009         /* If it's not a signed or unsigned number, treat it as a name. */
8010 
8011         cf = ptr[1];
8012         if (cf != CHAR_PLUS && cf != CHAR_MINUS && !IS_DIGIT(cf))
8013           {
8014           is_recurse = TRUE;
8015           goto NAMED_REF_OR_RECURSE;
8016           }
8017 
8018         /* Signed or unsigned number (cf = ptr[1]) is known to be plus or minus
8019         or a digit. */
8020 
8021         p = ptr + 2;
8022         while (IS_DIGIT(*p)) p++;
8023         if (*p != (pcre_uchar)terminator)
8024           {
8025           *errorcodeptr = ERR57;
8026           goto FAILED;
8027           }
8028         ptr++;
8029         goto HANDLE_NUMERICAL_RECURSION;
8030         }
8031 
8032       /* \k<name> or \k'name' is a back reference by name (Perl syntax).
8033       We also support \k{name} (.NET syntax).  */
8034 
8035       if (escape == ESC_k)
8036         {
8037         if ((ptr[1] != CHAR_LESS_THAN_SIGN &&
8038           ptr[1] != CHAR_APOSTROPHE && ptr[1] != CHAR_LEFT_CURLY_BRACKET))
8039           {
8040           *errorcodeptr = ERR69;
8041           goto FAILED;
8042           }
8043         is_recurse = FALSE;
8044         terminator = (*(++ptr) == CHAR_LESS_THAN_SIGN)?
8045           CHAR_GREATER_THAN_SIGN : (*ptr == CHAR_APOSTROPHE)?
8046           CHAR_APOSTROPHE : CHAR_RIGHT_CURLY_BRACKET;
8047         goto NAMED_REF_OR_RECURSE;
8048         }
8049 
8050       /* Back references are handled specially; must disable firstchar if
8051       not set to cope with cases like (?=(\w+))\1: which would otherwise set
8052       ':' later. */
8053 
8054       if (escape < 0)
8055         {
8056         open_capitem *oc;
8057         recno = -escape;
8058 
8059         /* Come here from named backref handling when the reference is to a
8060         single group (i.e. not to a duplicated name. */
8061 
8062         HANDLE_REFERENCE:
8063         if (firstcharflags == REQ_UNSET) firstcharflags = REQ_NONE;
8064         previous = code;
8065         item_hwm_offset = cd->hwm - cd->start_workspace;
8066         *code++ = ((options & PCRE_CASELESS) != 0)? OP_REFI : OP_REF;
8067         PUT2INC(code, 0, recno);
8068         cd->backref_map |= (recno < 32)? (1 << recno) : 1;
8069         if (recno > cd->top_backref) cd->top_backref = recno;
8070 
8071         /* Check to see if this back reference is recursive, that it, it
8072         is inside the group that it references. A flag is set so that the
8073         group can be made atomic. */
8074 
8075         for (oc = cd->open_caps; oc != NULL; oc = oc->next)
8076           {
8077           if (oc->number == recno)
8078             {
8079             oc->flag = TRUE;
8080             break;
8081             }
8082           }
8083         }
8084 
8085       /* So are Unicode property matches, if supported. */
8086 
8087 #ifdef SUPPORT_UCP
8088       else if (escape == ESC_P || escape == ESC_p)
8089         {
8090         BOOL negated;
8091         unsigned int ptype = 0, pdata = 0;
8092         if (!get_ucp(&ptr, &negated, &ptype, &pdata, errorcodeptr))
8093           goto FAILED;
8094         previous = code;
8095         item_hwm_offset = cd->hwm - cd->start_workspace;
8096         *code++ = ((escape == ESC_p) != negated)? OP_PROP : OP_NOTPROP;
8097         *code++ = ptype;
8098         *code++ = pdata;
8099         }
8100 #else
8101 
8102       /* If Unicode properties are not supported, \X, \P, and \p are not
8103       allowed. */
8104 
8105       else if (escape == ESC_X || escape == ESC_P || escape == ESC_p)
8106         {
8107         *errorcodeptr = ERR45;
8108         goto FAILED;
8109         }
8110 #endif
8111 
8112       /* For the rest (including \X when Unicode properties are supported), we
8113       can obtain the OP value by negating the escape value in the default
8114       situation when PCRE_UCP is not set. When it *is* set, we substitute
8115       Unicode property tests. Note that \b and \B do a one-character
8116       lookbehind, and \A also behaves as if it does. */
8117 
8118       else
8119         {
8120         if ((escape == ESC_b || escape == ESC_B || escape == ESC_A) &&
8121              cd->max_lookbehind == 0)
8122           cd->max_lookbehind = 1;
8123 #ifdef SUPPORT_UCP
8124         if (escape >= ESC_DU && escape <= ESC_wu)
8125           {
8126           nestptr = ptr + 1;                   /* Where to resume */
8127           ptr = substitutes[escape - ESC_DU] - 1;  /* Just before substitute */
8128           }
8129         else
8130 #endif
8131         /* In non-UTF-8 mode, we turn \C into OP_ALLANY instead of OP_ANYBYTE
8132         so that it works in DFA mode and in lookbehinds. */
8133 
8134           {
8135           previous = (escape > ESC_b && escape < ESC_Z)? code : NULL;
8136           item_hwm_offset = cd->hwm - cd->start_workspace;
8137           *code++ = (!utf && escape == ESC_C)? OP_ALLANY : escape;
8138           }
8139         }
8140       continue;
8141       }
8142 
8143     /* We have a data character whose value is in c. In UTF-8 mode it may have
8144     a value > 127. We set its representation in the length/buffer, and then
8145     handle it as a data character. */
8146 
8147 #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
8148     if (utf && c > MAX_VALUE_FOR_SINGLE_CHAR)
8149       mclength = PRIV(ord2utf)(c, mcbuffer);
8150     else
8151 #endif
8152 
8153      {
8154      mcbuffer[0] = c;
8155      mclength = 1;
8156      }
8157     goto ONE_CHAR;
8158 
8159 
8160     /* ===================================================================*/
8161     /* Handle a literal character. It is guaranteed not to be whitespace or #
8162     when the extended flag is set. If we are in a UTF mode, it may be a
8163     multi-unit literal character. */
8164 
8165     default:
8166     NORMAL_CHAR:
8167     mclength = 1;
8168     mcbuffer[0] = c;
8169 
8170 #ifdef SUPPORT_UTF
8171     if (utf && HAS_EXTRALEN(c))
8172       ACROSSCHAR(TRUE, ptr[1], mcbuffer[mclength++] = *(++ptr));
8173 #endif
8174 
8175     /* At this point we have the character's bytes in mcbuffer, and the length
8176     in mclength. When not in UTF-8 mode, the length is always 1. */
8177 
8178     ONE_CHAR:
8179     previous = code;
8180     item_hwm_offset = cd->hwm - cd->start_workspace;
8181 
8182     /* For caseless UTF-8 mode when UCP support is available, check whether
8183     this character has more than one other case. If so, generate a special
8184     OP_PROP item instead of OP_CHARI. */
8185 
8186 #ifdef SUPPORT_UCP
8187     if (utf && (options & PCRE_CASELESS) != 0)
8188       {
8189       GETCHAR(c, mcbuffer);
8190       if ((c = UCD_CASESET(c)) != 0)
8191         {
8192         *code++ = OP_PROP;
8193         *code++ = PT_CLIST;
8194         *code++ = c;
8195         if (firstcharflags == REQ_UNSET)
8196           firstcharflags = zerofirstcharflags = REQ_NONE;
8197         break;
8198         }
8199       }
8200 #endif
8201 
8202     /* Caseful matches, or not one of the multicase characters. */
8203 
8204     *code++ = ((options & PCRE_CASELESS) != 0)? OP_CHARI : OP_CHAR;
8205     for (c = 0; c < mclength; c++) *code++ = mcbuffer[c];
8206 
8207     /* Remember if \r or \n were seen */
8208 
8209     if (mcbuffer[0] == CHAR_CR || mcbuffer[0] == CHAR_NL)
8210       cd->external_flags |= PCRE_HASCRORLF;
8211 
8212     /* Set the first and required bytes appropriately. If no previous first
8213     byte, set it from this character, but revert to none on a zero repeat.
8214     Otherwise, leave the firstchar value alone, and don't change it on a zero
8215     repeat. */
8216 
8217     if (firstcharflags == REQ_UNSET)
8218       {
8219       zerofirstcharflags = REQ_NONE;
8220       zeroreqchar = reqchar;
8221       zeroreqcharflags = reqcharflags;
8222 
8223       /* If the character is more than one byte long, we can set firstchar
8224       only if it is not to be matched caselessly. */
8225 
8226       if (mclength == 1 || req_caseopt == 0)
8227         {
8228         firstchar = mcbuffer[0];
8229         firstcharflags = req_caseopt;
8230 
8231         if (mclength != 1)
8232           {
8233           reqchar = code[-1];
8234           reqcharflags = cd->req_varyopt;
8235           }
8236         }
8237       else firstcharflags = reqcharflags = REQ_NONE;
8238       }
8239 
8240     /* firstchar was previously set; we can set reqchar only if the length is
8241     1 or the matching is caseful. */
8242 
8243     else
8244       {
8245       zerofirstchar = firstchar;
8246       zerofirstcharflags = firstcharflags;
8247       zeroreqchar = reqchar;
8248       zeroreqcharflags = reqcharflags;
8249       if (mclength == 1 || req_caseopt == 0)
8250         {
8251         reqchar = code[-1];
8252         reqcharflags = req_caseopt | cd->req_varyopt;
8253         }
8254       }
8255 
8256     break;            /* End of literal character handling */
8257     }
8258   }                   /* end of big loop */
8259 
8260 
8261 /* Control never reaches here by falling through, only by a goto for all the
8262 error states. Pass back the position in the pattern so that it can be displayed
8263 to the user for diagnosing the error. */
8264 
8265 FAILED:
8266 *ptrptr = ptr;
8267 return FALSE;
8268 }
8269 
8270 
8271 
8272 /*************************************************
8273 *     Compile sequence of alternatives           *
8274 *************************************************/
8275 
8276 /* On entry, ptr is pointing past the bracket character, but on return it
8277 points to the closing bracket, or vertical bar, or end of string. The code
8278 variable is pointing at the byte into which the BRA operator has been stored.
8279 This function is used during the pre-compile phase when we are trying to find
8280 out the amount of memory needed, as well as during the real compile phase. The
8281 value of lengthptr distinguishes the two phases.
8282 
8283 Arguments:
8284   options           option bits, including any changes for this subpattern
8285   codeptr           -> the address of the current code pointer
8286   ptrptr            -> the address of the current pattern pointer
8287   errorcodeptr      -> pointer to error code variable
8288   lookbehind        TRUE if this is a lookbehind assertion
8289   reset_bracount    TRUE to reset the count for each branch
8290   skipbytes         skip this many bytes at start (for brackets and OP_COND)
8291   cond_depth        depth of nesting for conditional subpatterns
8292   firstcharptr      place to put the first required character
8293   firstcharflagsptr place to put the first character flags, or a negative number
8294   reqcharptr        place to put the last required character
8295   reqcharflagsptr   place to put the last required character flags, or a negative number
8296   bcptr             pointer to the chain of currently open branches
8297   cd                points to the data block with tables pointers etc.
8298   lengthptr         NULL during the real compile phase
8299                     points to length accumulator during pre-compile phase
8300 
8301 Returns:            TRUE on success
8302 */
8303 
8304 static BOOL
compile_regex(int options,pcre_uchar ** codeptr,const pcre_uchar ** ptrptr,int * errorcodeptr,BOOL lookbehind,BOOL reset_bracount,int skipbytes,int cond_depth,pcre_uint32 * firstcharptr,pcre_int32 * firstcharflagsptr,pcre_uint32 * reqcharptr,pcre_int32 * reqcharflagsptr,branch_chain * bcptr,compile_data * cd,int * lengthptr)8305 compile_regex(int options, pcre_uchar **codeptr, const pcre_uchar **ptrptr,
8306   int *errorcodeptr, BOOL lookbehind, BOOL reset_bracount, int skipbytes,
8307   int cond_depth,
8308   pcre_uint32 *firstcharptr, pcre_int32 *firstcharflagsptr,
8309   pcre_uint32 *reqcharptr, pcre_int32 *reqcharflagsptr,
8310   branch_chain *bcptr, compile_data *cd, int *lengthptr)
8311 {
8312 const pcre_uchar *ptr = *ptrptr;
8313 pcre_uchar *code = *codeptr;
8314 pcre_uchar *last_branch = code;
8315 pcre_uchar *start_bracket = code;
8316 pcre_uchar *reverse_count = NULL;
8317 open_capitem capitem;
8318 int capnumber = 0;
8319 pcre_uint32 firstchar, reqchar;
8320 pcre_int32 firstcharflags, reqcharflags;
8321 pcre_uint32 branchfirstchar, branchreqchar;
8322 pcre_int32 branchfirstcharflags, branchreqcharflags;
8323 int length;
8324 unsigned int orig_bracount;
8325 unsigned int max_bracount;
8326 branch_chain bc;
8327 size_t save_hwm_offset;
8328 
8329 /* If set, call the external function that checks for stack availability. */
8330 
8331 if (PUBL(stack_guard) != NULL && PUBL(stack_guard)())
8332   {
8333   *errorcodeptr= ERR85;
8334   return FALSE;
8335   }
8336 
8337 /* Miscellaneous initialization */
8338 
8339 bc.outer = bcptr;
8340 bc.current_branch = code;
8341 
8342 firstchar = reqchar = 0;
8343 firstcharflags = reqcharflags = REQ_UNSET;
8344 
8345 save_hwm_offset = cd->hwm - cd->start_workspace;
8346 
8347 /* Accumulate the length for use in the pre-compile phase. Start with the
8348 length of the BRA and KET and any extra bytes that are required at the
8349 beginning. We accumulate in a local variable to save frequent testing of
8350 lenthptr for NULL. We cannot do this by looking at the value of code at the
8351 start and end of each alternative, because compiled items are discarded during
8352 the pre-compile phase so that the work space is not exceeded. */
8353 
8354 length = 2 + 2*LINK_SIZE + skipbytes;
8355 
8356 /* WARNING: If the above line is changed for any reason, you must also change
8357 the code that abstracts option settings at the start of the pattern and makes
8358 them global. It tests the value of length for (2 + 2*LINK_SIZE) in the
8359 pre-compile phase to find out whether anything has yet been compiled or not. */
8360 
8361 /* If this is a capturing subpattern, add to the chain of open capturing items
8362 so that we can detect them if (*ACCEPT) is encountered. This is also used to
8363 detect groups that contain recursive back references to themselves. Note that
8364 only OP_CBRA need be tested here; changing this opcode to one of its variants,
8365 e.g. OP_SCBRAPOS, happens later, after the group has been compiled. */
8366 
8367 if (*code == OP_CBRA)
8368   {
8369   capnumber = GET2(code, 1 + LINK_SIZE);
8370   capitem.number = capnumber;
8371   capitem.next = cd->open_caps;
8372   capitem.flag = FALSE;
8373   cd->open_caps = &capitem;
8374   }
8375 
8376 /* Offset is set zero to mark that this bracket is still open */
8377 
8378 PUT(code, 1, 0);
8379 code += 1 + LINK_SIZE + skipbytes;
8380 
8381 /* Loop for each alternative branch */
8382 
8383 orig_bracount = max_bracount = cd->bracount;
8384 for (;;)
8385   {
8386   /* For a (?| group, reset the capturing bracket count so that each branch
8387   uses the same numbers. */
8388 
8389   if (reset_bracount) cd->bracount = orig_bracount;
8390 
8391   /* Set up dummy OP_REVERSE if lookbehind assertion */
8392 
8393   if (lookbehind)
8394     {
8395     *code++ = OP_REVERSE;
8396     reverse_count = code;
8397     PUTINC(code, 0, 0);
8398     length += 1 + LINK_SIZE;
8399     }
8400 
8401   /* Now compile the branch; in the pre-compile phase its length gets added
8402   into the length. */
8403 
8404   if (!compile_branch(&options, &code, &ptr, errorcodeptr, &branchfirstchar,
8405         &branchfirstcharflags, &branchreqchar, &branchreqcharflags, &bc,
8406         cond_depth, cd, (lengthptr == NULL)? NULL : &length))
8407     {
8408     *ptrptr = ptr;
8409     return FALSE;
8410     }
8411 
8412   /* Keep the highest bracket count in case (?| was used and some branch
8413   has fewer than the rest. */
8414 
8415   if (cd->bracount > max_bracount) max_bracount = cd->bracount;
8416 
8417   /* In the real compile phase, there is some post-processing to be done. */
8418 
8419   if (lengthptr == NULL)
8420     {
8421     /* If this is the first branch, the firstchar and reqchar values for the
8422     branch become the values for the regex. */
8423 
8424     if (*last_branch != OP_ALT)
8425       {
8426       firstchar = branchfirstchar;
8427       firstcharflags = branchfirstcharflags;
8428       reqchar = branchreqchar;
8429       reqcharflags = branchreqcharflags;
8430       }
8431 
8432     /* If this is not the first branch, the first char and reqchar have to
8433     match the values from all the previous branches, except that if the
8434     previous value for reqchar didn't have REQ_VARY set, it can still match,
8435     and we set REQ_VARY for the regex. */
8436 
8437     else
8438       {
8439       /* If we previously had a firstchar, but it doesn't match the new branch,
8440       we have to abandon the firstchar for the regex, but if there was
8441       previously no reqchar, it takes on the value of the old firstchar. */
8442 
8443       if (firstcharflags >= 0 &&
8444           (firstcharflags != branchfirstcharflags || firstchar != branchfirstchar))
8445         {
8446         if (reqcharflags < 0)
8447           {
8448           reqchar = firstchar;
8449           reqcharflags = firstcharflags;
8450           }
8451         firstcharflags = REQ_NONE;
8452         }
8453 
8454       /* If we (now or from before) have no firstchar, a firstchar from the
8455       branch becomes a reqchar if there isn't a branch reqchar. */
8456 
8457       if (firstcharflags < 0 && branchfirstcharflags >= 0 && branchreqcharflags < 0)
8458         {
8459         branchreqchar = branchfirstchar;
8460         branchreqcharflags = branchfirstcharflags;
8461         }
8462 
8463       /* Now ensure that the reqchars match */
8464 
8465       if (((reqcharflags & ~REQ_VARY) != (branchreqcharflags & ~REQ_VARY)) ||
8466           reqchar != branchreqchar)
8467         reqcharflags = REQ_NONE;
8468       else
8469         {
8470         reqchar = branchreqchar;
8471         reqcharflags |= branchreqcharflags; /* To "or" REQ_VARY */
8472         }
8473       }
8474 
8475     /* If lookbehind, check that this branch matches a fixed-length string, and
8476     put the length into the OP_REVERSE item. Temporarily mark the end of the
8477     branch with OP_END. If the branch contains OP_RECURSE, the result is -3
8478     because there may be forward references that we can't check here. Set a
8479     flag to cause another lookbehind check at the end. Why not do it all at the
8480     end? Because common, erroneous checks are picked up here and the offset of
8481     the problem can be shown. */
8482 
8483     if (lookbehind)
8484       {
8485       int fixed_length;
8486       *code = OP_END;
8487       fixed_length = find_fixedlength(last_branch,  (options & PCRE_UTF8) != 0,
8488         FALSE, cd, NULL);
8489       DPRINTF(("fixed length = %d\n", fixed_length));
8490       if (fixed_length == -3)
8491         {
8492         cd->check_lookbehind = TRUE;
8493         }
8494       else if (fixed_length < 0)
8495         {
8496         *errorcodeptr = (fixed_length == -2)? ERR36 :
8497                         (fixed_length == -4)? ERR70: ERR25;
8498         *ptrptr = ptr;
8499         return FALSE;
8500         }
8501       else
8502         {
8503         if (fixed_length > cd->max_lookbehind)
8504           cd->max_lookbehind = fixed_length;
8505         PUT(reverse_count, 0, fixed_length);
8506         }
8507       }
8508     }
8509 
8510   /* Reached end of expression, either ')' or end of pattern. In the real
8511   compile phase, go back through the alternative branches and reverse the chain
8512   of offsets, with the field in the BRA item now becoming an offset to the
8513   first alternative. If there are no alternatives, it points to the end of the
8514   group. The length in the terminating ket is always the length of the whole
8515   bracketed item. Return leaving the pointer at the terminating char. */
8516 
8517   if (*ptr != CHAR_VERTICAL_LINE)
8518     {
8519     if (lengthptr == NULL)
8520       {
8521       int branch_length = (int)(code - last_branch);
8522       do
8523         {
8524         int prev_length = GET(last_branch, 1);
8525         PUT(last_branch, 1, branch_length);
8526         branch_length = prev_length;
8527         last_branch -= branch_length;
8528         }
8529       while (branch_length > 0);
8530       }
8531 
8532     /* Fill in the ket */
8533 
8534     *code = OP_KET;
8535     PUT(code, 1, (int)(code - start_bracket));
8536     code += 1 + LINK_SIZE;
8537 
8538     /* If it was a capturing subpattern, check to see if it contained any
8539     recursive back references. If so, we must wrap it in atomic brackets.
8540     Because we are moving code along, we must ensure that any pending recursive
8541     references are updated. In any event, remove the block from the chain. */
8542 
8543     if (capnumber > 0)
8544       {
8545       if (cd->open_caps->flag)
8546         {
8547         *code = OP_END;
8548         adjust_recurse(start_bracket, 1 + LINK_SIZE,
8549           (options & PCRE_UTF8) != 0, cd, save_hwm_offset);
8550         memmove(start_bracket + 1 + LINK_SIZE, start_bracket,
8551           IN_UCHARS(code - start_bracket));
8552         *start_bracket = OP_ONCE;
8553         code += 1 + LINK_SIZE;
8554         PUT(start_bracket, 1, (int)(code - start_bracket));
8555         *code = OP_KET;
8556         PUT(code, 1, (int)(code - start_bracket));
8557         code += 1 + LINK_SIZE;
8558         length += 2 + 2*LINK_SIZE;
8559         }
8560       cd->open_caps = cd->open_caps->next;
8561       }
8562 
8563     /* Retain the highest bracket number, in case resetting was used. */
8564 
8565     cd->bracount = max_bracount;
8566 
8567     /* Set values to pass back */
8568 
8569     *codeptr = code;
8570     *ptrptr = ptr;
8571     *firstcharptr = firstchar;
8572     *firstcharflagsptr = firstcharflags;
8573     *reqcharptr = reqchar;
8574     *reqcharflagsptr = reqcharflags;
8575     if (lengthptr != NULL)
8576       {
8577       if (OFLOW_MAX - *lengthptr < length)
8578         {
8579         *errorcodeptr = ERR20;
8580         return FALSE;
8581         }
8582       *lengthptr += length;
8583       }
8584     return TRUE;
8585     }
8586 
8587   /* Another branch follows. In the pre-compile phase, we can move the code
8588   pointer back to where it was for the start of the first branch. (That is,
8589   pretend that each branch is the only one.)
8590 
8591   In the real compile phase, insert an ALT node. Its length field points back
8592   to the previous branch while the bracket remains open. At the end the chain
8593   is reversed. It's done like this so that the start of the bracket has a
8594   zero offset until it is closed, making it possible to detect recursion. */
8595 
8596   if (lengthptr != NULL)
8597     {
8598     code = *codeptr + 1 + LINK_SIZE + skipbytes;
8599     length += 1 + LINK_SIZE;
8600     }
8601   else
8602     {
8603     *code = OP_ALT;
8604     PUT(code, 1, (int)(code - last_branch));
8605     bc.current_branch = last_branch = code;
8606     code += 1 + LINK_SIZE;
8607     }
8608 
8609   ptr++;
8610   }
8611 /* Control never reaches here */
8612 }
8613 
8614 
8615 
8616 
8617 /*************************************************
8618 *          Check for anchored expression         *
8619 *************************************************/
8620 
8621 /* Try to find out if this is an anchored regular expression. Consider each
8622 alternative branch. If they all start with OP_SOD or OP_CIRC, or with a bracket
8623 all of whose alternatives start with OP_SOD or OP_CIRC (recurse ad lib), then
8624 it's anchored. However, if this is a multiline pattern, then only OP_SOD will
8625 be found, because ^ generates OP_CIRCM in that mode.
8626 
8627 We can also consider a regex to be anchored if OP_SOM starts all its branches.
8628 This is the code for \G, which means "match at start of match position, taking
8629 into account the match offset".
8630 
8631 A branch is also implicitly anchored if it starts with .* and DOTALL is set,
8632 because that will try the rest of the pattern at all possible matching points,
8633 so there is no point trying again.... er ....
8634 
8635 .... except when the .* appears inside capturing parentheses, and there is a
8636 subsequent back reference to those parentheses. We haven't enough information
8637 to catch that case precisely.
8638 
8639 At first, the best we could do was to detect when .* was in capturing brackets
8640 and the highest back reference was greater than or equal to that level.
8641 However, by keeping a bitmap of the first 31 back references, we can catch some
8642 of the more common cases more precisely.
8643 
8644 ... A second exception is when the .* appears inside an atomic group, because
8645 this prevents the number of characters it matches from being adjusted.
8646 
8647 Arguments:
8648   code           points to start of expression (the bracket)
8649   bracket_map    a bitmap of which brackets we are inside while testing; this
8650                   handles up to substring 31; after that we just have to take
8651                   the less precise approach
8652   cd             points to the compile data block
8653   atomcount      atomic group level
8654 
8655 Returns:     TRUE or FALSE
8656 */
8657 
8658 static BOOL
is_anchored(register const pcre_uchar * code,unsigned int bracket_map,compile_data * cd,int atomcount)8659 is_anchored(register const pcre_uchar *code, unsigned int bracket_map,
8660   compile_data *cd, int atomcount)
8661 {
8662 do {
8663    const pcre_uchar *scode = first_significant_code(
8664      code + PRIV(OP_lengths)[*code], FALSE);
8665    register int op = *scode;
8666 
8667    /* Non-capturing brackets */
8668 
8669    if (op == OP_BRA  || op == OP_BRAPOS ||
8670        op == OP_SBRA || op == OP_SBRAPOS)
8671      {
8672      if (!is_anchored(scode, bracket_map, cd, atomcount)) return FALSE;
8673      }
8674 
8675    /* Capturing brackets */
8676 
8677    else if (op == OP_CBRA  || op == OP_CBRAPOS ||
8678             op == OP_SCBRA || op == OP_SCBRAPOS)
8679      {
8680      int n = GET2(scode, 1+LINK_SIZE);
8681      int new_map = bracket_map | ((n < 32)? (1 << n) : 1);
8682      if (!is_anchored(scode, new_map, cd, atomcount)) return FALSE;
8683      }
8684 
8685    /* Positive forward assertions and conditions */
8686 
8687    else if (op == OP_ASSERT || op == OP_COND)
8688      {
8689      if (!is_anchored(scode, bracket_map, cd, atomcount)) return FALSE;
8690      }
8691 
8692    /* Atomic groups */
8693 
8694    else if (op == OP_ONCE || op == OP_ONCE_NC)
8695      {
8696      if (!is_anchored(scode, bracket_map, cd, atomcount + 1))
8697        return FALSE;
8698      }
8699 
8700    /* .* is not anchored unless DOTALL is set (which generates OP_ALLANY) and
8701    it isn't in brackets that are or may be referenced or inside an atomic
8702    group. */
8703 
8704    else if ((op == OP_TYPESTAR || op == OP_TYPEMINSTAR ||
8705              op == OP_TYPEPOSSTAR))
8706      {
8707      if (scode[1] != OP_ALLANY || (bracket_map & cd->backref_map) != 0 ||
8708          atomcount > 0 || cd->had_pruneorskip)
8709        return FALSE;
8710      }
8711 
8712    /* Check for explicit anchoring */
8713 
8714    else if (op != OP_SOD && op != OP_SOM && op != OP_CIRC) return FALSE;
8715 
8716    code += GET(code, 1);
8717    }
8718 while (*code == OP_ALT);   /* Loop for each alternative */
8719 return TRUE;
8720 }
8721 
8722 
8723 
8724 /*************************************************
8725 *         Check for starting with ^ or .*        *
8726 *************************************************/
8727 
8728 /* This is called to find out if every branch starts with ^ or .* so that
8729 "first char" processing can be done to speed things up in multiline
8730 matching and for non-DOTALL patterns that start with .* (which must start at
8731 the beginning or after \n). As in the case of is_anchored() (see above), we
8732 have to take account of back references to capturing brackets that contain .*
8733 because in that case we can't make the assumption. Also, the appearance of .*
8734 inside atomic brackets or in an assertion, or in a pattern that contains *PRUNE
8735 or *SKIP does not count, because once again the assumption no longer holds.
8736 
8737 Arguments:
8738   code           points to start of expression (the bracket)
8739   bracket_map    a bitmap of which brackets we are inside while testing; this
8740                   handles up to substring 31; after that we just have to take
8741                   the less precise approach
8742   cd             points to the compile data
8743   atomcount      atomic group level
8744   inassert       TRUE if in an assertion
8745 
8746 Returns:         TRUE or FALSE
8747 */
8748 
8749 static BOOL
is_startline(const pcre_uchar * code,unsigned int bracket_map,compile_data * cd,int atomcount,BOOL inassert)8750 is_startline(const pcre_uchar *code, unsigned int bracket_map,
8751   compile_data *cd, int atomcount, BOOL inassert)
8752 {
8753 do {
8754    const pcre_uchar *scode = first_significant_code(
8755      code + PRIV(OP_lengths)[*code], FALSE);
8756    register int op = *scode;
8757 
8758    /* If we are at the start of a conditional assertion group, *both* the
8759    conditional assertion *and* what follows the condition must satisfy the test
8760    for start of line. Other kinds of condition fail. Note that there may be an
8761    auto-callout at the start of a condition. */
8762 
8763    if (op == OP_COND)
8764      {
8765      scode += 1 + LINK_SIZE;
8766      if (*scode == OP_CALLOUT) scode += PRIV(OP_lengths)[OP_CALLOUT];
8767      switch (*scode)
8768        {
8769        case OP_CREF:
8770        case OP_DNCREF:
8771        case OP_RREF:
8772        case OP_DNRREF:
8773        case OP_DEF:
8774        case OP_FAIL:
8775        return FALSE;
8776 
8777        default:     /* Assertion */
8778        if (!is_startline(scode, bracket_map, cd, atomcount, TRUE)) return FALSE;
8779        do scode += GET(scode, 1); while (*scode == OP_ALT);
8780        scode += 1 + LINK_SIZE;
8781        break;
8782        }
8783      scode = first_significant_code(scode, FALSE);
8784      op = *scode;
8785      }
8786 
8787    /* Non-capturing brackets */
8788 
8789    if (op == OP_BRA  || op == OP_BRAPOS ||
8790        op == OP_SBRA || op == OP_SBRAPOS)
8791      {
8792      if (!is_startline(scode, bracket_map, cd, atomcount, inassert)) return FALSE;
8793      }
8794 
8795    /* Capturing brackets */
8796 
8797    else if (op == OP_CBRA  || op == OP_CBRAPOS ||
8798             op == OP_SCBRA || op == OP_SCBRAPOS)
8799      {
8800      int n = GET2(scode, 1+LINK_SIZE);
8801      int new_map = bracket_map | ((n < 32)? (1 << n) : 1);
8802      if (!is_startline(scode, new_map, cd, atomcount, inassert)) return FALSE;
8803      }
8804 
8805    /* Positive forward assertions */
8806 
8807    else if (op == OP_ASSERT)
8808      {
8809      if (!is_startline(scode, bracket_map, cd, atomcount, TRUE)) return FALSE;
8810      }
8811 
8812    /* Atomic brackets */
8813 
8814    else if (op == OP_ONCE || op == OP_ONCE_NC)
8815      {
8816      if (!is_startline(scode, bracket_map, cd, atomcount + 1, inassert)) return FALSE;
8817      }
8818 
8819    /* .* means "start at start or after \n" if it isn't in atomic brackets or
8820    brackets that may be referenced or an assertion, as long as the pattern does
8821    not contain *PRUNE or *SKIP, because these break the feature. Consider, for
8822    example, /.*?a(*PRUNE)b/ with the subject "aab", which matches "ab", i.e.
8823    not at the start of a line. */
8824 
8825    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR || op == OP_TYPEPOSSTAR)
8826      {
8827      if (scode[1] != OP_ANY || (bracket_map & cd->backref_map) != 0 ||
8828          atomcount > 0 || cd->had_pruneorskip || inassert)
8829        return FALSE;
8830      }
8831 
8832    /* Check for explicit circumflex; anything else gives a FALSE result. Note
8833    in particular that this includes atomic brackets OP_ONCE and OP_ONCE_NC
8834    because the number of characters matched by .* cannot be adjusted inside
8835    them. */
8836 
8837    else if (op != OP_CIRC && op != OP_CIRCM) return FALSE;
8838 
8839    /* Move on to the next alternative */
8840 
8841    code += GET(code, 1);
8842    }
8843 while (*code == OP_ALT);  /* Loop for each alternative */
8844 return TRUE;
8845 }
8846 
8847 
8848 
8849 /*************************************************
8850 *       Check for asserted fixed first char      *
8851 *************************************************/
8852 
8853 /* During compilation, the "first char" settings from forward assertions are
8854 discarded, because they can cause conflicts with actual literals that follow.
8855 However, if we end up without a first char setting for an unanchored pattern,
8856 it is worth scanning the regex to see if there is an initial asserted first
8857 char. If all branches start with the same asserted char, or with a
8858 non-conditional bracket all of whose alternatives start with the same asserted
8859 char (recurse ad lib), then we return that char, with the flags set to zero or
8860 REQ_CASELESS; otherwise return zero with REQ_NONE in the flags.
8861 
8862 Arguments:
8863   code       points to start of expression (the bracket)
8864   flags      points to the first char flags, or to REQ_NONE
8865   inassert   TRUE if in an assertion
8866 
8867 Returns:     the fixed first char, or 0 with REQ_NONE in flags
8868 */
8869 
8870 static pcre_uint32
find_firstassertedchar(const pcre_uchar * code,pcre_int32 * flags,BOOL inassert)8871 find_firstassertedchar(const pcre_uchar *code, pcre_int32 *flags,
8872   BOOL inassert)
8873 {
8874 register pcre_uint32 c = 0;
8875 int cflags = REQ_NONE;
8876 
8877 *flags = REQ_NONE;
8878 do {
8879    pcre_uint32 d;
8880    int dflags;
8881    int xl = (*code == OP_CBRA || *code == OP_SCBRA ||
8882              *code == OP_CBRAPOS || *code == OP_SCBRAPOS)? IMM2_SIZE:0;
8883    const pcre_uchar *scode = first_significant_code(code + 1+LINK_SIZE + xl,
8884      TRUE);
8885    register pcre_uchar op = *scode;
8886 
8887    switch(op)
8888      {
8889      default:
8890      return 0;
8891 
8892      case OP_BRA:
8893      case OP_BRAPOS:
8894      case OP_CBRA:
8895      case OP_SCBRA:
8896      case OP_CBRAPOS:
8897      case OP_SCBRAPOS:
8898      case OP_ASSERT:
8899      case OP_ONCE:
8900      case OP_ONCE_NC:
8901      d = find_firstassertedchar(scode, &dflags, op == OP_ASSERT);
8902      if (dflags < 0)
8903        return 0;
8904      if (cflags < 0) { c = d; cflags = dflags; } else if (c != d || cflags != dflags) return 0;
8905      break;
8906 
8907      case OP_EXACT:
8908      scode += IMM2_SIZE;
8909      /* Fall through */
8910 
8911      case OP_CHAR:
8912      case OP_PLUS:
8913      case OP_MINPLUS:
8914      case OP_POSPLUS:
8915      if (!inassert) return 0;
8916      if (cflags < 0) { c = scode[1]; cflags = 0; }
8917        else if (c != scode[1]) return 0;
8918      break;
8919 
8920      case OP_EXACTI:
8921      scode += IMM2_SIZE;
8922      /* Fall through */
8923 
8924      case OP_CHARI:
8925      case OP_PLUSI:
8926      case OP_MINPLUSI:
8927      case OP_POSPLUSI:
8928      if (!inassert) return 0;
8929      if (cflags < 0) { c = scode[1]; cflags = REQ_CASELESS; }
8930        else if (c != scode[1]) return 0;
8931      break;
8932      }
8933 
8934    code += GET(code, 1);
8935    }
8936 while (*code == OP_ALT);
8937 
8938 *flags = cflags;
8939 return c;
8940 }
8941 
8942 
8943 
8944 /*************************************************
8945 *     Add an entry to the name/number table      *
8946 *************************************************/
8947 
8948 /* This function is called between compiling passes to add an entry to the
8949 name/number table, maintaining alphabetical order. Checking for permitted
8950 and forbidden duplicates has already been done.
8951 
8952 Arguments:
8953   cd           the compile data block
8954   name         the name to add
8955   length       the length of the name
8956   groupno      the group number
8957 
8958 Returns:       nothing
8959 */
8960 
8961 static void
add_name(compile_data * cd,const pcre_uchar * name,int length,unsigned int groupno)8962 add_name(compile_data *cd, const pcre_uchar *name, int length,
8963   unsigned int groupno)
8964 {
8965 int i;
8966 pcre_uchar *slot = cd->name_table;
8967 
8968 for (i = 0; i < cd->names_found; i++)
8969   {
8970   int crc = memcmp(name, slot+IMM2_SIZE, IN_UCHARS(length));
8971   if (crc == 0 && slot[IMM2_SIZE+length] != 0)
8972     crc = -1; /* Current name is a substring */
8973 
8974   /* Make space in the table and break the loop for an earlier name. For a
8975   duplicate or later name, carry on. We do this for duplicates so that in the
8976   simple case (when ?(| is not used) they are in order of their numbers. In all
8977   cases they are in the order in which they appear in the pattern. */
8978 
8979   if (crc < 0)
8980     {
8981     memmove(slot + cd->name_entry_size, slot,
8982       IN_UCHARS((cd->names_found - i) * cd->name_entry_size));
8983     break;
8984     }
8985 
8986   /* Continue the loop for a later or duplicate name */
8987 
8988   slot += cd->name_entry_size;
8989   }
8990 
8991 PUT2(slot, 0, groupno);
8992 memcpy(slot + IMM2_SIZE, name, IN_UCHARS(length));
8993 slot[IMM2_SIZE + length] = 0;
8994 cd->names_found++;
8995 }
8996 
8997 
8998 
8999 /*************************************************
9000 *        Compile a Regular Expression            *
9001 *************************************************/
9002 
9003 /* This function takes a string and returns a pointer to a block of store
9004 holding a compiled version of the expression. The original API for this
9005 function had no error code return variable; it is retained for backwards
9006 compatibility. The new function is given a new name.
9007 
9008 Arguments:
9009   pattern       the regular expression
9010   options       various option bits
9011   errorcodeptr  pointer to error code variable (pcre_compile2() only)
9012                   can be NULL if you don't want a code value
9013   errorptr      pointer to pointer to error text
9014   erroroffset   ptr offset in pattern where error was detected
9015   tables        pointer to character tables or NULL
9016 
9017 Returns:        pointer to compiled data block, or NULL on error,
9018                 with errorptr and erroroffset set
9019 */
9020 
9021 #if defined COMPILE_PCRE8
9022 PCRE_EXP_DEFN pcre * PCRE_CALL_CONVENTION
pcre_compile(const char * pattern,int options,const char ** errorptr,int * erroroffset,const unsigned char * tables)9023 pcre_compile(const char *pattern, int options, const char **errorptr,
9024   int *erroroffset, const unsigned char *tables)
9025 #elif defined COMPILE_PCRE16
9026 PCRE_EXP_DEFN pcre16 * PCRE_CALL_CONVENTION
9027 pcre16_compile(PCRE_SPTR16 pattern, int options, const char **errorptr,
9028   int *erroroffset, const unsigned char *tables)
9029 #elif defined COMPILE_PCRE32
9030 PCRE_EXP_DEFN pcre32 * PCRE_CALL_CONVENTION
9031 pcre32_compile(PCRE_SPTR32 pattern, int options, const char **errorptr,
9032   int *erroroffset, const unsigned char *tables)
9033 #endif
9034 {
9035 #if defined COMPILE_PCRE8
9036 return pcre_compile2(pattern, options, NULL, errorptr, erroroffset, tables);
9037 #elif defined COMPILE_PCRE16
9038 return pcre16_compile2(pattern, options, NULL, errorptr, erroroffset, tables);
9039 #elif defined COMPILE_PCRE32
9040 return pcre32_compile2(pattern, options, NULL, errorptr, erroroffset, tables);
9041 #endif
9042 }
9043 
9044 
9045 #if defined COMPILE_PCRE8
9046 PCRE_EXP_DEFN pcre * PCRE_CALL_CONVENTION
pcre_compile2(const char * pattern,int options,int * errorcodeptr,const char ** errorptr,int * erroroffset,const unsigned char * tables)9047 pcre_compile2(const char *pattern, int options, int *errorcodeptr,
9048   const char **errorptr, int *erroroffset, const unsigned char *tables)
9049 #elif defined COMPILE_PCRE16
9050 PCRE_EXP_DEFN pcre16 * PCRE_CALL_CONVENTION
9051 pcre16_compile2(PCRE_SPTR16 pattern, int options, int *errorcodeptr,
9052   const char **errorptr, int *erroroffset, const unsigned char *tables)
9053 #elif defined COMPILE_PCRE32
9054 PCRE_EXP_DEFN pcre32 * PCRE_CALL_CONVENTION
9055 pcre32_compile2(PCRE_SPTR32 pattern, int options, int *errorcodeptr,
9056   const char **errorptr, int *erroroffset, const unsigned char *tables)
9057 #endif
9058 {
9059 REAL_PCRE *re;
9060 int length = 1;  /* For final END opcode */
9061 pcre_int32 firstcharflags, reqcharflags;
9062 pcre_uint32 firstchar, reqchar;
9063 pcre_uint32 limit_match = PCRE_UINT32_MAX;
9064 pcre_uint32 limit_recursion = PCRE_UINT32_MAX;
9065 int newline;
9066 int errorcode = 0;
9067 int skipatstart = 0;
9068 BOOL utf;
9069 BOOL never_utf = FALSE;
9070 size_t size;
9071 pcre_uchar *code;
9072 const pcre_uchar *codestart;
9073 const pcre_uchar *ptr;
9074 compile_data compile_block;
9075 compile_data *cd = &compile_block;
9076 
9077 /* This space is used for "compiling" into during the first phase, when we are
9078 computing the amount of memory that is needed. Compiled items are thrown away
9079 as soon as possible, so that a fairly large buffer should be sufficient for
9080 this purpose. The same space is used in the second phase for remembering where
9081 to fill in forward references to subpatterns. That may overflow, in which case
9082 new memory is obtained from malloc(). */
9083 
9084 pcre_uchar cworkspace[COMPILE_WORK_SIZE];
9085 
9086 /* This vector is used for remembering name groups during the pre-compile. In a
9087 similar way to cworkspace, it can be expanded using malloc() if necessary. */
9088 
9089 named_group named_groups[NAMED_GROUP_LIST_SIZE];
9090 
9091 /* Set this early so that early errors get offset 0. */
9092 
9093 ptr = (const pcre_uchar *)pattern;
9094 
9095 /* We can't pass back an error message if errorptr is NULL; I guess the best we
9096 can do is just return NULL, but we can set a code value if there is a code
9097 pointer. */
9098 
9099 if (errorptr == NULL)
9100   {
9101   if (errorcodeptr != NULL) *errorcodeptr = 99;
9102   return NULL;
9103   }
9104 
9105 *errorptr = NULL;
9106 if (errorcodeptr != NULL) *errorcodeptr = ERR0;
9107 
9108 /* However, we can give a message for this error */
9109 
9110 if (erroroffset == NULL)
9111   {
9112   errorcode = ERR16;
9113   goto PCRE_EARLY_ERROR_RETURN2;
9114   }
9115 
9116 *erroroffset = 0;
9117 
9118 /* Set up pointers to the individual character tables */
9119 
9120 if (tables == NULL) tables = PRIV(default_tables);
9121 cd->lcc = tables + lcc_offset;
9122 cd->fcc = tables + fcc_offset;
9123 cd->cbits = tables + cbits_offset;
9124 cd->ctypes = tables + ctypes_offset;
9125 
9126 /* Check that all undefined public option bits are zero */
9127 
9128 if ((options & ~PUBLIC_COMPILE_OPTIONS) != 0)
9129   {
9130   errorcode = ERR17;
9131   goto PCRE_EARLY_ERROR_RETURN;
9132   }
9133 
9134 /* If PCRE_NEVER_UTF is set, remember it. */
9135 
9136 if ((options & PCRE_NEVER_UTF) != 0) never_utf = TRUE;
9137 
9138 /* Check for global one-time settings at the start of the pattern, and remember
9139 the offset for later. */
9140 
9141 cd->external_flags = 0;   /* Initialize here for LIMIT_MATCH/RECURSION */
9142 
9143 while (ptr[skipatstart] == CHAR_LEFT_PARENTHESIS &&
9144        ptr[skipatstart+1] == CHAR_ASTERISK)
9145   {
9146   int newnl = 0;
9147   int newbsr = 0;
9148 
9149 /* For completeness and backward compatibility, (*UTFn) is supported in the
9150 relevant libraries, but (*UTF) is generic and always supported. Note that
9151 PCRE_UTF8 == PCRE_UTF16 == PCRE_UTF32. */
9152 
9153 #ifdef COMPILE_PCRE8
9154   if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_UTF8_RIGHTPAR, 5) == 0)
9155     { skipatstart += 7; options |= PCRE_UTF8; continue; }
9156 #endif
9157 #ifdef COMPILE_PCRE16
9158   if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_UTF16_RIGHTPAR, 6) == 0)
9159     { skipatstart += 8; options |= PCRE_UTF16; continue; }
9160 #endif
9161 #ifdef COMPILE_PCRE32
9162   if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_UTF32_RIGHTPAR, 6) == 0)
9163     { skipatstart += 8; options |= PCRE_UTF32; continue; }
9164 #endif
9165 
9166   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_UTF_RIGHTPAR, 4) == 0)
9167     { skipatstart += 6; options |= PCRE_UTF8; continue; }
9168   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_UCP_RIGHTPAR, 4) == 0)
9169     { skipatstart += 6; options |= PCRE_UCP; continue; }
9170   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_NO_AUTO_POSSESS_RIGHTPAR, 16) == 0)
9171     { skipatstart += 18; options |= PCRE_NO_AUTO_POSSESS; continue; }
9172   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_NO_START_OPT_RIGHTPAR, 13) == 0)
9173     { skipatstart += 15; options |= PCRE_NO_START_OPTIMIZE; continue; }
9174 
9175   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_LIMIT_MATCH_EQ, 12) == 0)
9176     {
9177     pcre_uint32 c = 0;
9178     int p = skipatstart + 14;
9179     while (isdigit(ptr[p]))
9180       {
9181       if (c > PCRE_UINT32_MAX / 10 - 1) break;   /* Integer overflow */
9182       c = c*10 + ptr[p++] - CHAR_0;
9183       }
9184     if (ptr[p++] != CHAR_RIGHT_PARENTHESIS) break;
9185     if (c < limit_match)
9186       {
9187       limit_match = c;
9188       cd->external_flags |= PCRE_MLSET;
9189       }
9190     skipatstart = p;
9191     continue;
9192     }
9193 
9194   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_LIMIT_RECURSION_EQ, 16) == 0)
9195     {
9196     pcre_uint32 c = 0;
9197     int p = skipatstart + 18;
9198     while (isdigit(ptr[p]))
9199       {
9200       if (c > PCRE_UINT32_MAX / 10 - 1) break;   /* Integer overflow check */
9201       c = c*10 + ptr[p++] - CHAR_0;
9202       }
9203     if (ptr[p++] != CHAR_RIGHT_PARENTHESIS) break;
9204     if (c < limit_recursion)
9205       {
9206       limit_recursion = c;
9207       cd->external_flags |= PCRE_RLSET;
9208       }
9209     skipatstart = p;
9210     continue;
9211     }
9212 
9213   if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_CR_RIGHTPAR, 3) == 0)
9214     { skipatstart += 5; newnl = PCRE_NEWLINE_CR; }
9215   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_LF_RIGHTPAR, 3)  == 0)
9216     { skipatstart += 5; newnl = PCRE_NEWLINE_LF; }
9217   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_CRLF_RIGHTPAR, 5)  == 0)
9218     { skipatstart += 7; newnl = PCRE_NEWLINE_CR + PCRE_NEWLINE_LF; }
9219   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_ANY_RIGHTPAR, 4) == 0)
9220     { skipatstart += 6; newnl = PCRE_NEWLINE_ANY; }
9221   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_ANYCRLF_RIGHTPAR, 8) == 0)
9222     { skipatstart += 10; newnl = PCRE_NEWLINE_ANYCRLF; }
9223 
9224   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_BSR_ANYCRLF_RIGHTPAR, 12) == 0)
9225     { skipatstart += 14; newbsr = PCRE_BSR_ANYCRLF; }
9226   else if (STRNCMP_UC_C8(ptr+skipatstart+2, STRING_BSR_UNICODE_RIGHTPAR, 12) == 0)
9227     { skipatstart += 14; newbsr = PCRE_BSR_UNICODE; }
9228 
9229   if (newnl != 0)
9230     options = (options & ~PCRE_NEWLINE_BITS) | newnl;
9231   else if (newbsr != 0)
9232     options = (options & ~(PCRE_BSR_ANYCRLF|PCRE_BSR_UNICODE)) | newbsr;
9233   else break;
9234   }
9235 
9236 /* PCRE_UTF(16|32) have the same value as PCRE_UTF8. */
9237 utf = (options & PCRE_UTF8) != 0;
9238 if (utf && never_utf)
9239   {
9240   errorcode = ERR78;
9241   goto PCRE_EARLY_ERROR_RETURN2;
9242   }
9243 
9244 /* Can't support UTF unless PCRE has been compiled to include the code. The
9245 return of an error code from PRIV(valid_utf)() is a new feature, introduced in
9246 release 8.13. It is passed back from pcre_[dfa_]exec(), but at the moment is
9247 not used here. */
9248 
9249 #ifdef SUPPORT_UTF
9250 if (utf && (options & PCRE_NO_UTF8_CHECK) == 0 &&
9251      (errorcode = PRIV(valid_utf)((PCRE_PUCHAR)pattern, -1, erroroffset)) != 0)
9252   {
9253 #if defined COMPILE_PCRE8
9254   errorcode = ERR44;
9255 #elif defined COMPILE_PCRE16
9256   errorcode = ERR74;
9257 #elif defined COMPILE_PCRE32
9258   errorcode = ERR77;
9259 #endif
9260   goto PCRE_EARLY_ERROR_RETURN2;
9261   }
9262 #else
9263 if (utf)
9264   {
9265   errorcode = ERR32;
9266   goto PCRE_EARLY_ERROR_RETURN;
9267   }
9268 #endif
9269 
9270 /* Can't support UCP unless PCRE has been compiled to include the code. */
9271 
9272 #ifndef SUPPORT_UCP
9273 if ((options & PCRE_UCP) != 0)
9274   {
9275   errorcode = ERR67;
9276   goto PCRE_EARLY_ERROR_RETURN;
9277   }
9278 #endif
9279 
9280 /* Check validity of \R options. */
9281 
9282 if ((options & (PCRE_BSR_ANYCRLF|PCRE_BSR_UNICODE)) ==
9283      (PCRE_BSR_ANYCRLF|PCRE_BSR_UNICODE))
9284   {
9285   errorcode = ERR56;
9286   goto PCRE_EARLY_ERROR_RETURN;
9287   }
9288 
9289 /* Handle different types of newline. The three bits give seven cases. The
9290 current code allows for fixed one- or two-byte sequences, plus "any" and
9291 "anycrlf". */
9292 
9293 switch (options & PCRE_NEWLINE_BITS)
9294   {
9295   case 0: newline = NEWLINE; break;   /* Build-time default */
9296   case PCRE_NEWLINE_CR: newline = CHAR_CR; break;
9297   case PCRE_NEWLINE_LF: newline = CHAR_NL; break;
9298   case PCRE_NEWLINE_CR+
9299        PCRE_NEWLINE_LF: newline = (CHAR_CR << 8) | CHAR_NL; break;
9300   case PCRE_NEWLINE_ANY: newline = -1; break;
9301   case PCRE_NEWLINE_ANYCRLF: newline = -2; break;
9302   default: errorcode = ERR56; goto PCRE_EARLY_ERROR_RETURN;
9303   }
9304 
9305 if (newline == -2)
9306   {
9307   cd->nltype = NLTYPE_ANYCRLF;
9308   }
9309 else if (newline < 0)
9310   {
9311   cd->nltype = NLTYPE_ANY;
9312   }
9313 else
9314   {
9315   cd->nltype = NLTYPE_FIXED;
9316   if (newline > 255)
9317     {
9318     cd->nllen = 2;
9319     cd->nl[0] = (newline >> 8) & 255;
9320     cd->nl[1] = newline & 255;
9321     }
9322   else
9323     {
9324     cd->nllen = 1;
9325     cd->nl[0] = newline;
9326     }
9327   }
9328 
9329 /* Maximum back reference and backref bitmap. The bitmap records up to 31 back
9330 references to help in deciding whether (.*) can be treated as anchored or not.
9331 */
9332 
9333 cd->top_backref = 0;
9334 cd->backref_map = 0;
9335 
9336 /* Reflect pattern for debugging output */
9337 
9338 DPRINTF(("------------------------------------------------------------------\n"));
9339 #ifdef PCRE_DEBUG
9340 print_puchar(stdout, (PCRE_PUCHAR)pattern);
9341 #endif
9342 DPRINTF(("\n"));
9343 
9344 /* Pretend to compile the pattern while actually just accumulating the length
9345 of memory required. This behaviour is triggered by passing a non-NULL final
9346 argument to compile_regex(). We pass a block of workspace (cworkspace) for it
9347 to compile parts of the pattern into; the compiled code is discarded when it is
9348 no longer needed, so hopefully this workspace will never overflow, though there
9349 is a test for its doing so. */
9350 
9351 cd->bracount = cd->final_bracount = 0;
9352 cd->names_found = 0;
9353 cd->name_entry_size = 0;
9354 cd->name_table = NULL;
9355 cd->dupnames = FALSE;
9356 cd->dupgroups = FALSE;
9357 cd->namedrefcount = 0;
9358 cd->start_code = cworkspace;
9359 cd->hwm = cworkspace;
9360 cd->iscondassert = FALSE;
9361 cd->start_workspace = cworkspace;
9362 cd->workspace_size = COMPILE_WORK_SIZE;
9363 cd->named_groups = named_groups;
9364 cd->named_group_list_size = NAMED_GROUP_LIST_SIZE;
9365 cd->start_pattern = (const pcre_uchar *)pattern;
9366 cd->end_pattern = (const pcre_uchar *)(pattern + STRLEN_UC((const pcre_uchar *)pattern));
9367 cd->req_varyopt = 0;
9368 cd->parens_depth = 0;
9369 cd->assert_depth = 0;
9370 cd->max_lookbehind = 0;
9371 cd->external_options = options;
9372 cd->open_caps = NULL;
9373 
9374 /* Now do the pre-compile. On error, errorcode will be set non-zero, so we
9375 don't need to look at the result of the function here. The initial options have
9376 been put into the cd block so that they can be changed if an option setting is
9377 found within the regex right at the beginning. Bringing initial option settings
9378 outside can help speed up starting point checks. */
9379 
9380 ptr += skipatstart;
9381 code = cworkspace;
9382 *code = OP_BRA;
9383 
9384 (void)compile_regex(cd->external_options, &code, &ptr, &errorcode, FALSE,
9385   FALSE, 0, 0, &firstchar, &firstcharflags, &reqchar, &reqcharflags, NULL,
9386   cd, &length);
9387 if (errorcode != 0) goto PCRE_EARLY_ERROR_RETURN;
9388 
9389 DPRINTF(("end pre-compile: length=%d workspace=%d\n", length,
9390   (int)(cd->hwm - cworkspace)));
9391 
9392 if (length > MAX_PATTERN_SIZE)
9393   {
9394   errorcode = ERR20;
9395   goto PCRE_EARLY_ERROR_RETURN;
9396   }
9397 
9398 /* Compute the size of the data block for storing the compiled pattern. Integer
9399 overflow should no longer be possible because nowadays we limit the maximum
9400 value of cd->names_found and cd->name_entry_size. */
9401 
9402 size = sizeof(REAL_PCRE) +
9403   (length + cd->names_found * cd->name_entry_size) * sizeof(pcre_uchar);
9404 
9405 /* Get the memory. */
9406 
9407 re = (REAL_PCRE *)(PUBL(malloc))(size);
9408 if (re == NULL)
9409   {
9410   errorcode = ERR21;
9411   goto PCRE_EARLY_ERROR_RETURN;
9412   }
9413 
9414 /* Put in the magic number, and save the sizes, initial options, internal
9415 flags, and character table pointer. NULL is used for the default character
9416 tables. The nullpad field is at the end; it's there to help in the case when a
9417 regex compiled on a system with 4-byte pointers is run on another with 8-byte
9418 pointers. */
9419 
9420 re->magic_number = MAGIC_NUMBER;
9421 re->size = (int)size;
9422 re->options = cd->external_options;
9423 re->flags = cd->external_flags;
9424 re->limit_match = limit_match;
9425 re->limit_recursion = limit_recursion;
9426 re->first_char = 0;
9427 re->req_char = 0;
9428 re->name_table_offset = sizeof(REAL_PCRE) / sizeof(pcre_uchar);
9429 re->name_entry_size = cd->name_entry_size;
9430 re->name_count = cd->names_found;
9431 re->ref_count = 0;
9432 re->tables = (tables == PRIV(default_tables))? NULL : tables;
9433 re->nullpad = NULL;
9434 #ifdef COMPILE_PCRE32
9435 re->dummy = 0;
9436 #else
9437 re->dummy1 = re->dummy2 = re->dummy3 = 0;
9438 #endif
9439 
9440 /* The starting points of the name/number translation table and of the code are
9441 passed around in the compile data block. The start/end pattern and initial
9442 options are already set from the pre-compile phase, as is the name_entry_size
9443 field. Reset the bracket count and the names_found field. Also reset the hwm
9444 field; this time it's used for remembering forward references to subpatterns.
9445 */
9446 
9447 cd->final_bracount = cd->bracount;  /* Save for checking forward references */
9448 cd->parens_depth = 0;
9449 cd->assert_depth = 0;
9450 cd->bracount = 0;
9451 cd->max_lookbehind = 0;
9452 cd->name_table = (pcre_uchar *)re + re->name_table_offset;
9453 codestart = cd->name_table + re->name_entry_size * re->name_count;
9454 cd->start_code = codestart;
9455 cd->hwm = (pcre_uchar *)(cd->start_workspace);
9456 cd->iscondassert = FALSE;
9457 cd->req_varyopt = 0;
9458 cd->had_accept = FALSE;
9459 cd->had_pruneorskip = FALSE;
9460 cd->check_lookbehind = FALSE;
9461 cd->open_caps = NULL;
9462 
9463 /* If any named groups were found, create the name/number table from the list
9464 created in the first pass. */
9465 
9466 if (cd->names_found > 0)
9467   {
9468   int i = cd->names_found;
9469   named_group *ng = cd->named_groups;
9470   cd->names_found = 0;
9471   for (; i > 0; i--, ng++)
9472     add_name(cd, ng->name, ng->length, ng->number);
9473   if (cd->named_group_list_size > NAMED_GROUP_LIST_SIZE)
9474     (PUBL(free))((void *)cd->named_groups);
9475   }
9476 
9477 /* Set up a starting, non-extracting bracket, then compile the expression. On
9478 error, errorcode will be set non-zero, so we don't need to look at the result
9479 of the function here. */
9480 
9481 ptr = (const pcre_uchar *)pattern + skipatstart;
9482 code = (pcre_uchar *)codestart;
9483 *code = OP_BRA;
9484 (void)compile_regex(re->options, &code, &ptr, &errorcode, FALSE, FALSE, 0, 0,
9485   &firstchar, &firstcharflags, &reqchar, &reqcharflags, NULL, cd, NULL);
9486 re->top_bracket = cd->bracount;
9487 re->top_backref = cd->top_backref;
9488 re->max_lookbehind = cd->max_lookbehind;
9489 re->flags = cd->external_flags | PCRE_MODE;
9490 
9491 if (cd->had_accept)
9492   {
9493   reqchar = 0;              /* Must disable after (*ACCEPT) */
9494   reqcharflags = REQ_NONE;
9495   }
9496 
9497 /* If not reached end of pattern on success, there's an excess bracket. */
9498 
9499 if (errorcode == 0 && *ptr != CHAR_NULL) errorcode = ERR22;
9500 
9501 /* Fill in the terminating state and check for disastrous overflow, but
9502 if debugging, leave the test till after things are printed out. */
9503 
9504 *code++ = OP_END;
9505 
9506 #ifndef PCRE_DEBUG
9507 if (code - codestart > length) errorcode = ERR23;
9508 #endif
9509 
9510 #ifdef SUPPORT_VALGRIND
9511 /* If the estimated length exceeds the really used length, mark the extra
9512 allocated memory as unaddressable, so that any out-of-bound reads can be
9513 detected. */
9514 VALGRIND_MAKE_MEM_NOACCESS(code, (length - (code - codestart)) * sizeof(pcre_uchar));
9515 #endif
9516 
9517 /* Fill in any forward references that are required. There may be repeated
9518 references; optimize for them, as searching a large regex takes time. */
9519 
9520 if (cd->hwm > cd->start_workspace)
9521   {
9522   int prev_recno = -1;
9523   const pcre_uchar *groupptr = NULL;
9524   while (errorcode == 0 && cd->hwm > cd->start_workspace)
9525     {
9526     int offset, recno;
9527     cd->hwm -= LINK_SIZE;
9528     offset = GET(cd->hwm, 0);
9529 
9530     /* Check that the hwm handling hasn't gone wrong. This whole area is
9531     rewritten in PCRE2 because there are some obscure cases. */
9532 
9533     if (offset == 0 || codestart[offset-1] != OP_RECURSE)
9534       {
9535       errorcode = ERR10;
9536       break;
9537       }
9538 
9539     recno = GET(codestart, offset);
9540     if (recno != prev_recno)
9541       {
9542       groupptr = PRIV(find_bracket)(codestart, utf, recno);
9543       prev_recno = recno;
9544       }
9545     if (groupptr == NULL) errorcode = ERR53;
9546       else PUT(((pcre_uchar *)codestart), offset, (int)(groupptr - codestart));
9547     }
9548   }
9549 
9550 /* If the workspace had to be expanded, free the new memory. Set the pointer to
9551 NULL to indicate that forward references have been filled in. */
9552 
9553 if (cd->workspace_size > COMPILE_WORK_SIZE)
9554   (PUBL(free))((void *)cd->start_workspace);
9555 cd->start_workspace = NULL;
9556 
9557 /* Give an error if there's back reference to a non-existent capturing
9558 subpattern. */
9559 
9560 if (errorcode == 0 && re->top_backref > re->top_bracket) errorcode = ERR15;
9561 
9562 /* Unless disabled, check whether any single character iterators can be
9563 auto-possessified. The function overwrites the appropriate opcode values, so
9564 the type of the pointer must be cast. NOTE: the intermediate variable "temp" is
9565 used in this code because at least one compiler gives a warning about loss of
9566 "const" attribute if the cast (pcre_uchar *)codestart is used directly in the
9567 function call. */
9568 
9569 if (errorcode == 0 && (options & PCRE_NO_AUTO_POSSESS) == 0)
9570   {
9571   pcre_uchar *temp = (pcre_uchar *)codestart;
9572   auto_possessify(temp, utf, cd);
9573   }
9574 
9575 /* If there were any lookbehind assertions that contained OP_RECURSE
9576 (recursions or subroutine calls), a flag is set for them to be checked here,
9577 because they may contain forward references. Actual recursions cannot be fixed
9578 length, but subroutine calls can. It is done like this so that those without
9579 OP_RECURSE that are not fixed length get a diagnosic with a useful offset. The
9580 exceptional ones forgo this. We scan the pattern to check that they are fixed
9581 length, and set their lengths. */
9582 
9583 if (errorcode == 0 && cd->check_lookbehind)
9584   {
9585   pcre_uchar *cc = (pcre_uchar *)codestart;
9586 
9587   /* Loop, searching for OP_REVERSE items, and process those that do not have
9588   their length set. (Actually, it will also re-process any that have a length
9589   of zero, but that is a pathological case, and it does no harm.) When we find
9590   one, we temporarily terminate the branch it is in while we scan it. */
9591 
9592   for (cc = (pcre_uchar *)PRIV(find_bracket)(codestart, utf, -1);
9593        cc != NULL;
9594        cc = (pcre_uchar *)PRIV(find_bracket)(cc, utf, -1))
9595     {
9596     if (GET(cc, 1) == 0)
9597       {
9598       int fixed_length;
9599       pcre_uchar *be = cc - 1 - LINK_SIZE + GET(cc, -LINK_SIZE);
9600       int end_op = *be;
9601       *be = OP_END;
9602       fixed_length = find_fixedlength(cc, (re->options & PCRE_UTF8) != 0, TRUE,
9603         cd, NULL);
9604       *be = end_op;
9605       DPRINTF(("fixed length = %d\n", fixed_length));
9606       if (fixed_length < 0)
9607         {
9608         errorcode = (fixed_length == -2)? ERR36 :
9609                     (fixed_length == -4)? ERR70 : ERR25;
9610         break;
9611         }
9612       if (fixed_length > cd->max_lookbehind) cd->max_lookbehind = fixed_length;
9613       PUT(cc, 1, fixed_length);
9614       }
9615     cc += 1 + LINK_SIZE;
9616     }
9617   }
9618 
9619 /* Failed to compile, or error while post-processing */
9620 
9621 if (errorcode != 0)
9622   {
9623   (PUBL(free))(re);
9624   PCRE_EARLY_ERROR_RETURN:
9625   *erroroffset = (int)(ptr - (const pcre_uchar *)pattern);
9626   PCRE_EARLY_ERROR_RETURN2:
9627   *errorptr = find_error_text(errorcode);
9628   if (errorcodeptr != NULL) *errorcodeptr = errorcode;
9629   return NULL;
9630   }
9631 
9632 /* If the anchored option was not passed, set the flag if we can determine that
9633 the pattern is anchored by virtue of ^ characters or \A or anything else, such
9634 as starting with non-atomic .* when DOTALL is set and there are no occurrences
9635 of *PRUNE or *SKIP.
9636 
9637 Otherwise, if we know what the first byte has to be, save it, because that
9638 speeds up unanchored matches no end. If not, see if we can set the
9639 PCRE_STARTLINE flag. This is helpful for multiline matches when all branches
9640 start with ^. and also when all branches start with non-atomic .* for
9641 non-DOTALL matches when *PRUNE and SKIP are not present. */
9642 
9643 if ((re->options & PCRE_ANCHORED) == 0)
9644   {
9645   if (is_anchored(codestart, 0, cd, 0)) re->options |= PCRE_ANCHORED;
9646   else
9647     {
9648     if (firstcharflags < 0)
9649       firstchar = find_firstassertedchar(codestart, &firstcharflags, FALSE);
9650     if (firstcharflags >= 0)   /* Remove caseless flag for non-caseable chars */
9651       {
9652 #if defined COMPILE_PCRE8
9653       re->first_char = firstchar & 0xff;
9654 #elif defined COMPILE_PCRE16
9655       re->first_char = firstchar & 0xffff;
9656 #elif defined COMPILE_PCRE32
9657       re->first_char = firstchar;
9658 #endif
9659       if ((firstcharflags & REQ_CASELESS) != 0)
9660         {
9661 #if defined SUPPORT_UCP && !(defined COMPILE_PCRE8)
9662         /* We ignore non-ASCII first chars in 8 bit mode. */
9663         if (utf)
9664           {
9665           if (re->first_char < 128)
9666             {
9667             if (cd->fcc[re->first_char] != re->first_char)
9668               re->flags |= PCRE_FCH_CASELESS;
9669             }
9670           else if (UCD_OTHERCASE(re->first_char) != re->first_char)
9671             re->flags |= PCRE_FCH_CASELESS;
9672           }
9673         else
9674 #endif
9675         if (MAX_255(re->first_char)
9676             && cd->fcc[re->first_char] != re->first_char)
9677           re->flags |= PCRE_FCH_CASELESS;
9678         }
9679 
9680       re->flags |= PCRE_FIRSTSET;
9681       }
9682 
9683     else if (is_startline(codestart, 0, cd, 0, FALSE)) re->flags |= PCRE_STARTLINE;
9684     }
9685   }
9686 
9687 /* For an anchored pattern, we use the "required byte" only if it follows a
9688 variable length item in the regex. Remove the caseless flag for non-caseable
9689 bytes. */
9690 
9691 if (reqcharflags >= 0 &&
9692      ((re->options & PCRE_ANCHORED) == 0 || (reqcharflags & REQ_VARY) != 0))
9693   {
9694 #if defined COMPILE_PCRE8
9695   re->req_char = reqchar & 0xff;
9696 #elif defined COMPILE_PCRE16
9697   re->req_char = reqchar & 0xffff;
9698 #elif defined COMPILE_PCRE32
9699   re->req_char = reqchar;
9700 #endif
9701   if ((reqcharflags & REQ_CASELESS) != 0)
9702     {
9703 #if defined SUPPORT_UCP && !(defined COMPILE_PCRE8)
9704     /* We ignore non-ASCII first chars in 8 bit mode. */
9705     if (utf)
9706       {
9707       if (re->req_char < 128)
9708         {
9709         if (cd->fcc[re->req_char] != re->req_char)
9710           re->flags |= PCRE_RCH_CASELESS;
9711         }
9712       else if (UCD_OTHERCASE(re->req_char) != re->req_char)
9713         re->flags |= PCRE_RCH_CASELESS;
9714       }
9715     else
9716 #endif
9717     if (MAX_255(re->req_char) && cd->fcc[re->req_char] != re->req_char)
9718       re->flags |= PCRE_RCH_CASELESS;
9719     }
9720 
9721   re->flags |= PCRE_REQCHSET;
9722   }
9723 
9724 /* Print out the compiled data if debugging is enabled. This is never the
9725 case when building a production library. */
9726 
9727 #ifdef PCRE_DEBUG
9728 printf("Length = %d top_bracket = %d top_backref = %d\n",
9729   length, re->top_bracket, re->top_backref);
9730 
9731 printf("Options=%08x\n", re->options);
9732 
9733 if ((re->flags & PCRE_FIRSTSET) != 0)
9734   {
9735   pcre_uchar ch = re->first_char;
9736   const char *caseless =
9737     ((re->flags & PCRE_FCH_CASELESS) == 0)? "" : " (caseless)";
9738   if (PRINTABLE(ch)) printf("First char = %c%s\n", ch, caseless);
9739     else printf("First char = \\x%02x%s\n", ch, caseless);
9740   }
9741 
9742 if ((re->flags & PCRE_REQCHSET) != 0)
9743   {
9744   pcre_uchar ch = re->req_char;
9745   const char *caseless =
9746     ((re->flags & PCRE_RCH_CASELESS) == 0)? "" : " (caseless)";
9747   if (PRINTABLE(ch)) printf("Req char = %c%s\n", ch, caseless);
9748     else printf("Req char = \\x%02x%s\n", ch, caseless);
9749   }
9750 
9751 #if defined COMPILE_PCRE8
9752 pcre_printint((pcre *)re, stdout, TRUE);
9753 #elif defined COMPILE_PCRE16
9754 pcre16_printint((pcre *)re, stdout, TRUE);
9755 #elif defined COMPILE_PCRE32
9756 pcre32_printint((pcre *)re, stdout, TRUE);
9757 #endif
9758 
9759 /* This check is done here in the debugging case so that the code that
9760 was compiled can be seen. */
9761 
9762 if (code - codestart > length)
9763   {
9764   (PUBL(free))(re);
9765   *errorptr = find_error_text(ERR23);
9766   *erroroffset = ptr - (pcre_uchar *)pattern;
9767   if (errorcodeptr != NULL) *errorcodeptr = ERR23;
9768   return NULL;
9769   }
9770 #endif   /* PCRE_DEBUG */
9771 
9772 /* Check for a pattern than can match an empty string, so that this information
9773 can be provided to applications. */
9774 
9775 do
9776   {
9777   if (could_be_empty_branch(codestart, code, utf, cd, NULL))
9778     {
9779     re->flags |= PCRE_MATCH_EMPTY;
9780     break;
9781     }
9782   codestart += GET(codestart, 1);
9783   }
9784 while (*codestart == OP_ALT);
9785 
9786 #if defined COMPILE_PCRE8
9787 return (pcre *)re;
9788 #elif defined COMPILE_PCRE16
9789 return (pcre16 *)re;
9790 #elif defined COMPILE_PCRE32
9791 return (pcre32 *)re;
9792 #endif
9793 }
9794 
9795 /* End of pcre_compile.c */
9796