fix integer overflow in S_study_chunk().

It was adding SSize_t_MAX to data->last_start_max when
data->last_start_max was already SSize_t_MAX.

This triggered it: /(x+y)+/.

Found by -fsanitize=undefined.

1 files changed, 5 insertions, 2 deletions

diff --git a/regcomp.c b/regcomp.c
index e1872b402a..2664be4644 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -4888,8 +4888,11 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
 			} else {
 			    /* start offset must point into the last copy */
 			    data->last_start_min += minnext * (mincount - 1);
-			    data->last_start_max += is_inf ? SSize_t_MAX
-				: (maxcount - 1) * (minnext + data->pos_delta);
+			    data->last_start_max =
+                              is_inf
+                               ? SSize_t_MAX
+			       : data->last_start_max +
+                                 (maxcount - 1) * (minnext + data->pos_delta);
 			}
 		    }
 		    /* It is counted once already... */