"Can't happen" - yes, it can, with buggy UTF-8/EBCDIC.

Stepping backward in the string would be majorly bad.

p4raw-id: //depot/perl@14633

1 files changed, 24 insertions, 12 deletions

diff --git a/regcomp.c b/regcomp.c
index 7850492497..7e1e6bd6d5 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -3188,16 +3188,22 @@ tryagain:
 				   foldlen;
 				   foldlen -= numlen) {
 				   ender = utf8_to_uvchr(foldbuf, &numlen);
-				   reguni(pRExC_state, ender, s, &numlen);
-				   s       += numlen;
-				   len     += numlen;
-				   foldbuf += numlen;
+				   if (numlen > 0) {
+					reguni(pRExC_state, ender, s, &numlen);
+					s       += numlen;
+					len     += numlen;
+					foldbuf += numlen;
+				   }
+				   else
+					break; /* "Can't happen." */
 			      }
 			 }
 			 else {
 			      reguni(pRExC_state, ender, s, &numlen);
-			      s   += numlen;
-			      len += numlen;
+			      if (numlen > 0) {
+				   s   += numlen;
+				   len += numlen;
+			      }
 			 }
 		    }
 		    else {
@@ -3213,16 +3219,22 @@ tryagain:
 			       foldlen;
 			       foldlen -= numlen) {
 			       ender = utf8_to_uvchr(foldbuf, &numlen);
-			       reguni(pRExC_state, ender, s, &numlen);
-			       s       += numlen;
-			       len     += numlen;
-			       foldbuf += numlen;
+			       if (numlen > 0) {
+				    reguni(pRExC_state, ender, s, &numlen);
+				    s       += numlen;
+				    len     += numlen;
+				    foldbuf += numlen;
+			       }
+			       else
+				    break;
 			  }
 		     }
 		     else {
 			  reguni(pRExC_state, ender, s, &numlen);
-			  s   += numlen;
-			  len += numlen;
+			  if (numlen > 0) {
+			       s   += numlen;
+			       len += numlen;
+			  }
 		     }
 		     len--;
 		}