Fix a crash when doing an extended substitution for \p, \P, or \X

pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch

@@ -0,0 +1,83 @@
+From d8fd0a6ed323e5abaaa7e8f26ed1f74ab3a54007 Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
+Date: Fri, 9 Dec 2016 16:57:51 +0000
+Subject: [PATCH] Fix NULL defer in extended substition for \p, \P, or \X.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Petr Pisar: Ported to 10.22:
+
+commit 83a8a8c6d01e4a39830704a4270821b390f20488
+Author: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
+Date:   Fri Dec 9 16:57:51 2016 +0000
+
+    Fix NULL defer in extended substition for \p, \P, or \X.
+
+    git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@615 6239d852-aaf2-0410-a92c-79f79f948069
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ src/pcre2_compile.c  | 10 +++++-----
+ testdata/testinput2  |  3 +++
+ testdata/testoutput2 |  4 ++++
+ 3 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c
+index ed81639..ae6b5e1 100644
+--- a/src/pcre2_compile.c
++++ b/src/pcre2_compile.c
+@@ -1793,10 +1793,10 @@ entry, ptr is pointing at the \. On exit, it points the final code unit of the
+ escape sequence.
+ 
+ This function is also called from pcre2_substitute() to handle escape sequences
+-in replacement strings. In this case, the cb argument is NULL, and only
+-sequences that define a data character are recognised. The isclass argument is
+-not relevant, but the options argument is the final value of the compiled
+-pattern's options.
++in replacement strings. In this case, the cb argument is NULL, and in the case 
++of escapes that have further processing, only sequences that define a data
++character are recognised. The isclass argument is not relevant; the options
++argument is the final value of the compiled pattern's options.
+ 
+ There is one "trick" case: when a sequence such as [[:>:]] or \s in UCP mode is
+ processed, it is replaced by a nested alternative sequence. If this contains a
+@@ -1858,7 +1858,7 @@ else if ((i = escapes[c - ESCAPES_FIRST]) != 0)
+   if (i > 0) c = (uint32_t)i; else  /* Positive is a data character */
+     {
+     escape = -i;                    /* Else return a special escape */
+-    if (escape == ESC_P || escape == ESC_p || escape == ESC_X)
++    if (cb != NULL && (escape == ESC_P || escape == ESC_p || escape == ESC_X))
+       cb->external_flags |= PCRE2_HASBKPORX;   /* Note \P, \p, or \X */
+     }
+   }
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index 3218cfe..a7c1ab3 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4828,4 +4828,7 @@ a)"xI
+ /./newline=crlf
+ \=ph
+ 
++/(\x0e00\000000\xc)/replace=\P,substitute_extended
++\x0e00\000000\xc
++
+ # End of testinput2 
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 1776d0d..9c478bb 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -15231,6 +15231,10 @@ Subject length lower bound = 0
+ \=ph
+ No match
+ 
++/(\x0e00\000000\xc)/replace=\P,substitute_extended
++\x0e00\000000\xc
++Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string
++
+ # End of testinput2 
+ Error -63: PCRE2_ERROR_BADDATA (unknown error number)
+ Error -62: bad serialized data
+-- 
+2.7.4
+

pcre2.spec

@@ -2,7 +2,7 @@
 #%%global rcversion RC1
 Name:       pcre2
 Version:    10.22
-Release:    %{?rcversion:0.}7%{?rcversion:.%rcversion}%{?dist}
+Release:    %{?rcversion:0.}8%{?rcversion:.%rcversion}%{?dist}
 %global     myversion %{version}%{?rcversion:-%rcversion}
 Summary:    Perl-compatible regular expression library
 Group:      System Environment/Libraries
@@ -67,6 +67,9 @@ Patch14:    pcre2-10.22-Fix-buffer-overflow-in-partial-match-test-for-CRLF-i.pat
 # Fix a crash in pcre2test when displaying a wide character with a set locate,
 # in upstream after 10.22, upstream bug #1976
 Patch15:    pcre2-10.22-Fix-crash-in-pcre2test-when-displaying-a-wide-charac.patch
+# Fix a crash when doing an extended substitution for \p, \P, or \X,
+# in upstream after 10.22, upstream bug #1977
+Patch16:    pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch
 # New libtool to get rid of RPATH and to use distribution autotools
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -159,6 +162,7 @@ Utilities demonstrating PCRE2 capabilities like pcre2grep or pcre2test.
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16 -p1
 # Because of multilib patch
 libtoolize --copy --force
 autoreconf -vif
@@ -255,6 +259,10 @@ make %{?_smp_mflags} check VERBOSE=yes
 %{_mandir}/man1/pcre2test.*
 
 %changelog
+* Fri Dec 16 2016 Petr Pisar <ppisar@redhat.com> - 10.22-8
+- Fix a crash when doing an extended substitution for \p, \P, or \X
+  (upstream bug #1977)
+
 * Fri Dec 09 2016 Petr Pisar <ppisar@redhat.com> - 10.22-7
 - Fix pcre2-config --libs-posix output (upstream bug #1924)
 - Fix a memory leak and a typo in a documentation (upstream bug #1973)