Complete incomplete fix for UTF-8 caseless references of different lengths.

git-svn-id: svn://vcs.exim.org/pcre/code/trunk@597 2f5784b3-3f2a-0410-8824-cb99058d5e15

1 files changed, 10 insertions, 4 deletions

diff --git a/pcre_exec.c b/pcre_exec.c
index 0dff1af..caf5fc3 100644
--- a/pcre_exec.c
+++ b/pcre_exec.c
@@ -193,6 +193,7 @@ if ((ims & PCRE_CASELESS) != 0)
     while (p < endptr)
       {
       int c, d;
+      if (eptr >= md->end_subject) return -1;
       GETCHARINC(c, eptr);
       GETCHARINC(d, p);
       if (c != d && c != UCD_OTHERCASE(d)) return -1;
@@ -204,16 +205,21 @@ if ((ims & PCRE_CASELESS) != 0)
 
   /* The same code works when not in UTF-8 mode and in UTF-8 mode when there
   is no UCP support. */
-
-  while (length-- > 0)
-    { if (md->lcc[*p++] != md->lcc[*eptr++]) return -1; }
+    {
+    if (eptr + length > md->end_subject) return -1; 
+    while (length-- > 0)
+      { if (md->lcc[*p++] != md->lcc[*eptr++]) return -1; }
+    }   
   }
 
 /* In the caseful case, we can just compare the bytes, whether or not we
 are in UTF-8 mode. */
 
 else
-  { while (length-- > 0) if (*p++ != *eptr++) return -1; }
+  { 
+  if (eptr + length > md->end_subject) return -1; 
+  while (length-- > 0) if (*p++ != *eptr++) return -1; 
+  }
 
 return eptr - eptr_start;
 }