"Can't happen" - yes, it can, with buggy UTF-8/EBCDIC.

Stepping backward in the string would be majorly bad.

p4raw-id: //depot/perl@14633

diff --git a/regcomp.c b/regcomp.c
index 7850492..7e1e6bd 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -3188,16 +3188,22 @@ tryagain:
                                   foldlen;
                                   foldlen -= numlen) {
                                   ender = utf8_to_uvchr(foldbuf, &numlen);
-                                  reguni(pRExC_state, ender, s, &numlen);
-                                  s       += numlen;
-                                  len     += numlen;
-                                  foldbuf += numlen;
+                                  if (numlen > 0) {
+                                       reguni(pRExC_state, ender, s, &numlen);
+                                       s       += numlen;
+                                       len     += numlen;
+                                       foldbuf += numlen;
+                                  }
+                                  else
+                                       break; /* "Can't happen." */
                              }
                         }
                         else {
                              reguni(pRExC_state, ender, s, &numlen);
-                             s   += numlen;
-                             len += numlen;
+                             if (numlen > 0) {
+                                  s   += numlen;
+                                  len += numlen;
+                             }
                         }
                    }
                    else {
@@ -3213,16 +3219,22 @@ tryagain:
                               foldlen;
                               foldlen -= numlen) {
                               ender = utf8_to_uvchr(foldbuf, &numlen);
-                              reguni(pRExC_state, ender, s, &numlen);
-                              s       += numlen;
-                              len     += numlen;
-                              foldbuf += numlen;
+                              if (numlen > 0) {
+                                   reguni(pRExC_state, ender, s, &numlen);
+                                   s       += numlen;
+                                   len     += numlen;
+                                   foldbuf += numlen;
+                              }
+                              else
+                                   break;
                          }
                     }
                     else {
                          reguni(pRExC_state, ender, s, &numlen);
-                         s   += numlen;
-                         len += numlen;
+                         if (numlen > 0) {
+                              s   += numlen;
+                              len += numlen;
+                         }
                     }
                     len--;
                }