From 35486e8506cfdf26c94a50e277251c33fba45d2d Mon Sep 17 00:00:00 2001
From: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
Date: Fri, 9 Dec 2016 16:57:51 +0000
Subject: [PATCH] Fix NULL defer in extended substition for \p, \P, or \X.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Petr Pisar: Ported to 10.21:

commit 83a8a8c6d01e4a39830704a4270821b390f20488
Author: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
Date:   Fri Dec 9 16:57:51 2016 +0000

    Fix NULL defer in extended substition for \p, \P, or \X.

    git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@615 6239d852-aaf2-0410-a92c-79f79f948069

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 src/pcre2_compile.c  | 10 +++++-----
 testdata/testinput2  |  3 +++
 testdata/testoutput2 |  4 ++++
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c
index abe7332..1f8bfda 100644
--- a/src/pcre2_compile.c
+++ b/src/pcre2_compile.c
@@ -1752,10 +1752,10 @@ entry, ptr is pointing at the \. On exit, it points the final code unit of the
 escape sequence.
 
 This function is also called from pcre2_substitute() to handle escape sequences
-in replacement strings. In this case, the cb argument is NULL, and only
-sequences that define a data character are recognised. The isclass argument is
-not relevant, but the options argument is the final value of the compiled
-pattern's options.
+in replacement strings. In this case, the cb argument is NULL, and in the case 
+of escapes that have further processing, only sequences that define a data
+character are recognised. The isclass argument is not relevant; the options
+argument is the final value of the compiled pattern's options.
 
 There is one "trick" case: when a sequence such as [[:>:]] or \s in UCP mode is
 processed, it is replaced by a nested alternative sequence. If this contains a
@@ -1817,7 +1817,7 @@ else if ((i = escapes[c - ESCAPES_FIRST]) != 0)
   if (i > 0) c = (uint32_t)i; else  /* Positive is a data character */
     {
     escape = -i;                    /* Else return a special escape */
-    if (escape == ESC_P || escape == ESC_p || escape == ESC_X)
+    if (cb != NULL && (escape == ESC_P || escape == ESC_p || escape == ESC_X))
       cb->external_flags |= PCRE2_HASBKPORX;   /* Note \P, \p, or \X */
     }
   }
diff --git a/testdata/testinput2 b/testdata/testinput2
index cf463c9..0efc125 100644
--- a/testdata/testinput2
+++ b/testdata/testinput2
@@ -4816,4 +4816,7 @@ a)"xI
 /./newline=crlf
 \=ph
 
+/(\x0e00\000000\xc)/replace=\P,substitute_extended
+\x0e00\000000\xc
+
 # End of testinput2 
diff --git a/testdata/testoutput2 b/testdata/testoutput2
index 8674698..22e88a3 100644
--- a/testdata/testoutput2
+++ b/testdata/testoutput2
@@ -15212,4 +15212,8 @@ Subject length lower bound = 0
 \=ph
 No match
 
+/(\x0e00\000000\xc)/replace=\P,substitute_extended
+\x0e00\000000\xc
+Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string
+
 # End of testinput2 
-- 
2.7.4