Fixed overrun for missing ] with a forward reference, e.g. /(?1)\c[/.

git-svn-id: svn://vcs.exim.org/pcre/code/trunk@215 2f5784b3-3f2a-0410-8824-cb99058d5e15

4 files changed, 9 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 5d1a563..5238040 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -105,6 +105,9 @@ Version 7.3 09-Aug-07
     
 17. Fixed another case of looking too far back in non-UTF-8 mode (cf 12 above)
     for patterns like [\PPP\x8a]{1,}\x80 with the subject "A\x80". 
+    
+18. An unterminated class in a pattern like (?1)\c[ with a "forward reference"
+    caused an overrun.
 
 
 Version 7.2 19-Jun-07
diff --git a/pcre_compile.c b/pcre_compile.c
index 4938b1c..b92f6bb 100644
--- a/pcre_compile.c
+++ b/pcre_compile.c
@@ -950,6 +950,7 @@ for (; *ptr != 0; ptr++)
     {
     while (*(++ptr) != ']')
       {
+      if (*ptr == 0) return -1; 
       if (*ptr == '\\')
         {
         if (*(++ptr) == 0) return -1;
diff --git a/testdata/testinput2 b/testdata/testinput2
index 612aa7e..52847ea 100644
--- a/testdata/testinput2
+++ b/testdata/testinput2
@@ -2414,4 +2414,6 @@ a random value. /Ix
 
 /[\g6666666666]/
 
+/(?1)\c[/
+
 / End of testinput2 /
diff --git a/testdata/testoutput2 b/testdata/testoutput2
index ee00528..c6ec398 100644
--- a/testdata/testoutput2
+++ b/testdata/testoutput2
@@ -9044,4 +9044,7 @@ Failed: number is too big at offset 11
 /[\g6666666666]/
 Failed: number is too big at offset 12
 
+/(?1)\c[/
+Failed: reference to non-existent subpattern at offset 3
+
 / End of testinput2 /