/[pcre]/code/trunk/pcre.c

Diff of /code/trunk/pcre.c

Parent Directory | Revision Log | View Patch Patch

-revision 13 by nigel,
Sat Feb 24 21:38:21 2007 UTC
+revision 47 by nigel,
Sat Feb 24 21:39:29 2007 UTC
 Line 9 
 the file Tech.Notes for some information
  Written by: Philip Hazel <ph10@cam.ac.uk>
-            Copyright (c) 1997 University of Cambridge
+            Copyright (c) 1997-2000 University of Cambridge
  -----------------------------------------------------------------------------
  Permission is granted to anyone to use this software for any purpose on any
 Line 25 
 restrictions:
 . Altered versions must be plainly marked as such, and must not be
     misrepresented as being the original software.
+. If PCRE is embedded in any software that is released under the GNU
+    General Purpose Licence (GPL), then the terms of that licence shall
+    supersede any condition above with which it is incompatible.
  -----------------------------------------------------------------------------
  */
-Line 33 
 restrictions:
+Line 37 
 restrictions:
  /* #define DEBUG */
- /* Use a macro for debugging printing, 'cause that eliminates the the use
+ /* Use a macro for debugging printing, 'cause that eliminates the use of #ifdef
- of #ifdef inline, and there are *still* stupid compilers about that don't like
+ inline, and there are *still* stupid compilers about that don't like indented
- indented pre-processor statements. I suppose it's only been 10 years... */
+ pre-processor statements. I suppose it's only been 10 years... */
  #ifdef DEBUG
  #define DPRINTF(p) printf p
-Line 49 
 the external pcre header. */
+Line 53 
 the external pcre header. */
  #include "internal.h"
+ /* Allow compilation as C++ source code, should anybody want to do that. */
+ #ifdef __cplusplus
+ #define class pcre_class
+ #endif
+ /* Number of items on the nested bracket stacks at compile time. This should
+ not be set greater than 200. */
+ #define BRASTACK_SIZE 200
  /* Min and max values for the common repeats; for the maxima, 0 => infinity */
- static char rep_min[] = { 0, 0, 1, 1, 0, 0 };
+ static const char rep_min[] = { 0, 0, 1, 1, 0, 0 };
- static char rep_max[] = { 0, 0, 0, 0, 1, 1 };
+ static const char rep_max[] = { 0, 0, 0, 0, 1, 1 };
  /* Text forms of OP_ values and things, for debugging (not all used) */
  #ifdef DEBUG
  static const char *OP_names[] = {
    "End", "\\A", "\\B", "\\b", "\\D", "\\d",
-   "\\S", "\\s", "\\W", "\\w", "Cut", "\\Z", "^", "$", "Any", "chars",
+   "\\S", "\\s", "\\W", "\\w", "\\Z", "\\z",
-   "not",
+   "Opt", "^", "$", "Any", "chars", "not",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{",
-   "class", "negclass", "Ref",
+   "class", "Ref", "Recurse",
-   "Alt", "Ket", "KetRmax", "KetRmin", "Assert", "Assert not", "Once",
+   "Alt", "Ket", "KetRmax", "KetRmin", "Assert", "Assert not",
+   "AssertB", "AssertB not", "Reverse", "Once", "Cond", "Cref",
    "Brazero", "Braminzero", "Bra"
  };
  #endif
-Line 76 
 are simple data values; negative values
+Line 94 
 are simple data values; negative values
  on. Zero means further processing is needed (for things like \x), or the escape
  is invalid. */
- static short int escapes[] = {
+ static const short int escapes[] = {
 ,      0,      0,      0,      0,      0,      0,      0,   /* 0 - 7 */
 ,      0,    ':',    ';',    '<',    '=',    '>',    '?',   /* 8 - ? */
    '@', -ESC_A, -ESC_B,      0, -ESC_D,      0,      0,      0,   /* @ - G */
-Line 86 
 static short int escapes[] = {
+Line 104 
 static short int escapes[] = {
    '`',      7, -ESC_b,      0, -ESC_d,     27,   '\f',      0,   /* ` - g */
 ,      0,      0,      0,      0,      0,   '\n',      0,   /* h - o */
 ,      0,   '\r', -ESC_s,   '\t',      0,      0, -ESC_w,   /* p - w */
-,      0,      0                                            /* x - z */
+,      0, -ESC_z                                            /* x - z */
+ };
+ /* Tables of names of POSIX character classes and their lengths. The list is
+ terminated by a zero length entry. The first three must be alpha, upper, lower,
+ as this is assumed for handling case independence. */
+ static const char *posix_names[] = {
+   "alpha", "lower", "upper",
+   "alnum", "ascii", "cntrl", "digit", "graph",
+   "print", "punct", "space", "word",  "xdigit" };
+ static const uschar posix_name_lengths[] = {
+, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
+ /* Table of class bit maps for each POSIX class; up to three may be combined
+ to form the class. */
+ static const int posix_class_maps[] = {
+   cbit_lower, cbit_upper, -1,             /* alpha */
+   cbit_lower, -1,         -1,             /* lower */
+   cbit_upper, -1,         -1,             /* upper */
+   cbit_digit, cbit_lower, cbit_upper,     /* alnum */
+   cbit_print, cbit_cntrl, -1,             /* ascii */
+   cbit_cntrl, -1,         -1,             /* cntrl */
+   cbit_digit, -1,         -1,             /* digit */
+   cbit_graph, -1,         -1,             /* graph */
+   cbit_print, -1,         -1,             /* print */
+   cbit_punct, -1,         -1,             /* punct */
+   cbit_space, -1,         -1,             /* space */
+   cbit_word,  -1,         -1,             /* word */
+   cbit_xdigit,-1,         -1              /* xdigit */
  };
  /* Definition to allow mutual recursion */
  static BOOL
-   compile_regex(int, int *, uschar **, const uschar **, const char **);
+   compile_regex(int, int, int *, uschar **, const uschar **, const char **,
+     BOOL, int, int *, int *, compile_data *);
+ /* Structure for building a chain of data that actually lives on the
+ stack, for holding the values of the subject pointer at the start of each
+ subpattern, so as to detect when an empty string has been matched by a
+ subpattern - to break infinite loops. */
+ typedef struct eptrblock {
+   struct eptrblock *prev;
+   const uschar *saved_eptr;
+ } eptrblock;
- /* Structure for passing "static" information around between the functions
+ /* Flag bits for the match() function */
- doing the matching, so that they are thread-safe. */
- typedef struct match_data {
+ #define match_condassert   0x01    /* Called to check a condition assertion */
-   int    errorcode;             /* As it says */
+ #define match_isgroup      0x02    /* Set if start of bracketed group */
-   int   *offset_vector;         /* Offset vector */
-   int    offset_end;            /* One past the end */
-   BOOL   offset_overflow;       /* Set if too many extractions */
-   BOOL   caseless;              /* Case-independent flag */
-   BOOL   runtime_caseless;      /* Caseless forced at run time */
-   BOOL   multiline;             /* Multiline flag */
-   BOOL   notbol;                /* NOTBOL flag */
-   BOOL   noteol;                /* NOTEOL flag */
-   BOOL   dotall;                /* Dot matches any char */
-   BOOL   endonly;               /* Dollar not before final \n */
-   const uschar *start_subject;  /* Start of the subject string */
-   const uschar *end_subject;    /* End of the subject string */
-   jmp_buf fail_env;             /* Environment for longjump() break out */
-   const uschar *end_match_ptr;  /* Subject position at end match */
-   int     end_offset_top;       /* Highwater mark at end of match */
- } match_data;
-Line 134 
 void  (*pcre_free)(void *) = free;
+Line 178 
 void  (*pcre_free)(void *) = free;
  /*************************************************
+ *             Default character tables           *
+ *************************************************/
+ /* A default set of character tables is included in the PCRE binary. Its source
+ is built by the maketables auxiliary program, which uses the default C ctypes
+ functions, and put in the file chartables.c. These tables are used by PCRE
+ whenever the caller of pcre_compile() does not provide an alternate set of
+ tables. */
+ #include "chartables.c"
+ /*************************************************
  *          Return version string                 *
  *************************************************/
+ #define STRING(a)  # a
+ #define XSTRING(s) STRING(s)
  const char *
  pcre_version(void)
  {
- return PCRE_VERSION;
+ return XSTRING(PCRE_MAJOR) "." XSTRING(PCRE_MINOR) " " XSTRING(PCRE_DATE);
  }
  /*************************************************
- *       Return info about a compiled pattern     *
+ * (Obsolete) Return info about compiled pattern  *
  *************************************************/
- /* This function picks potentially useful data out of the private
+ /* This is the original "info" function. It picks potentially useful data out
- structure.
+ of the private structure, but its interface was too rigid. It remains for
+ backwards compatibility. The public options are passed back in an int - though
+ the re->options field has been expanded to a long int, all the public options
+ at the low end of it, and so even on 16-bit systems this will still be OK.
+ Therefore, I haven't changed the API for pcre_info().
  Arguments:
    external_re   points to compiled code
-Line 160 
 Arguments:
+Line 225 
 Arguments:
                  or -1 if multiline and all branches start ^,
                  or -2 otherwise
- Returns:        number of identifying extraction brackets
+ Returns:        number of capturing subpatterns
                  or negative values on error
  */
-Line 170 
 pcre_info(const pcre *external_re, int *
+Line 235 
 pcre_info(const pcre *external_re, int *
  const real_pcre *re = (const real_pcre *)external_re;
  if (re == NULL) return PCRE_ERROR_NULL;
  if (re->magic_number != MAGIC_NUMBER) return PCRE_ERROR_BADMAGIC;
- if (optptr != NULL) *optptr = (re->options & PUBLIC_OPTIONS);
+ if (optptr != NULL) *optptr = (int)(re->options & PUBLIC_OPTIONS);
  if (first_char != NULL)
    *first_char = ((re->options & PCRE_FIRSTSET) != 0)? re->first_char :
       ((re->options & PCRE_STARTLINE) != 0)? -1 : -2;
-Line 179 
 return re->top_bracket;
+Line 244 
 return re->top_bracket;
+ /*************************************************
+ *        Return info about compiled pattern      *
+ *************************************************/
+ /* This is a newer "info" function which has an extensible interface so
+ that additional items can be added compatibly.
+ Arguments:
+   external_re      points to compiled code
+   external_study   points to study data, or NULL
+   what             what information is required
+   where            where to put the information
+ Returns:           0 if data returned, negative on error
+ */
+ int
+ pcre_fullinfo(const pcre *external_re, const pcre_extra *study_data, int what,
+   void *where)
+ {
+ const real_pcre *re = (const real_pcre *)external_re;
+ const real_pcre_extra *study = (const real_pcre_extra *)study_data;
+ if (re == NULL || where == NULL) return PCRE_ERROR_NULL;
+ if (re->magic_number != MAGIC_NUMBER) return PCRE_ERROR_BADMAGIC;
+ switch (what)
+   {
+   case PCRE_INFO_OPTIONS:
+   *((unsigned long int *)where) = re->options & PUBLIC_OPTIONS;
+   break;
+   case PCRE_INFO_SIZE:
+   *((size_t *)where) = re->size;
+   break;
+   case PCRE_INFO_CAPTURECOUNT:
+   *((int *)where) = re->top_bracket;
+   break;
+   case PCRE_INFO_BACKREFMAX:
+   *((int *)where) = re->top_backref;
+   break;
+   case PCRE_INFO_FIRSTCHAR:
+   *((int *)where) =
+     ((re->options & PCRE_FIRSTSET) != 0)? re->first_char :
+     ((re->options & PCRE_STARTLINE) != 0)? -1 : -2;
+   break;
+   case PCRE_INFO_FIRSTTABLE:
+   *((const uschar **)where) =
+     (study != NULL && (study->options & PCRE_STUDY_MAPPED) != 0)?
+       study->start_bits : NULL;
+   break;
+   case PCRE_INFO_LASTLITERAL:
+   *((int *)where) =
+     ((re->options & PCRE_REQCHSET) != 0)? re->req_char : -1;
+   break;
+   default: return PCRE_ERROR_BADOPTION;
+   }
+ return 0;
+ }
  #ifdef DEBUG
  /*************************************************
-Line 211 
 while (length-- > 0)
+Line 344 
 while (length-- > 0)
  /*************************************************
- *         Check subpattern for empty operand     *
- *************************************************/
- /* This function checks a bracketed subpattern to see if any of the paths
- through it could match an empty string. This is used to diagnose an error if
- such a subpattern is followed by a quantifier with an unlimited upper bound.
- Argument:
-   code      points to the opening bracket
- Returns:    TRUE or FALSE
- */
- static BOOL
- could_be_empty(uschar *code)
- {
- do {
-   uschar *cc = code + 3;
-   /* Scan along the opcodes for this branch; as soon as we find something
-   that matches a non-empty string, break out and advance to test the next
-   branch. If we get to the end of the branch, return TRUE for the whole
-   sub-expression. */
-   for (;;)
-     {
-     /* Test an embedded subpattern; if it could not be empty, break the
-     loop. Otherwise carry on in the branch. */
-     if ((int)(*cc) >= OP_BRA || (int)(*cc) == OP_ONCE)
-       {
-       if (!could_be_empty(cc)) break;
-       do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-       cc += 3;
-       }
-     else switch (*cc)
-       {
-       /* Reached end of a branch: the subpattern may match the empty string */
-       case OP_ALT:
-       case OP_KET:
-       case OP_KETRMAX:
-       case OP_KETRMIN:
-       return TRUE;
-       /* Skip over assertive subpatterns */
-       case OP_ASSERT:
-       case OP_ASSERT_NOT:
-       do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-       cc += 3;
-       break;
-       /* Skip over things that don't match chars */
-       case OP_SOD:
-       case OP_EOD:
-       case OP_CIRC:
-       case OP_DOLL:
-       case OP_BRAZERO:
-       case OP_BRAMINZERO:
-       case OP_NOT_WORD_BOUNDARY:
-       case OP_WORD_BOUNDARY:
-       cc++;
-       break;
-       /* Skip over simple repeats with zero lower bound */
-       case OP_STAR:
-       case OP_MINSTAR:
-       case OP_QUERY:
-       case OP_MINQUERY:
-       case OP_NOTSTAR:
-       case OP_NOTMINSTAR:
-       case OP_NOTQUERY:
-       case OP_NOTMINQUERY:
-       case OP_TYPESTAR:
-       case OP_TYPEMINSTAR:
-       case OP_TYPEQUERY:
-       case OP_TYPEMINQUERY:
-       cc += 2;
-       break;
-       /* Skip over UPTOs (lower bound is zero) */
-       case OP_UPTO:
-       case OP_MINUPTO:
-       case OP_TYPEUPTO:
-       case OP_TYPEMINUPTO:
-       cc += 4;
-       break;
-       /* Check a class or a back reference for a zero minimum */
-       case OP_CLASS:
-       case OP_NEGCLASS:
-       case OP_REF:
-       cc += (*cc == OP_REF)? 2 : 33;
-       switch (*cc)
-         {
-         case OP_CRSTAR:
-         case OP_CRMINSTAR:
-         case OP_CRQUERY:
-         case OP_CRMINQUERY:
-         cc++;
-         break;
-         case OP_CRRANGE:
-         case OP_CRMINRANGE:
-         if ((cc[1] << 8) + cc[2] != 0) goto NEXT_BRANCH;
-         cc += 3;
-         break;
-         default:
-         goto NEXT_BRANCH;
-         }
-       break;
-       /* Anything else matches at least one character */
-       default:
-       goto NEXT_BRANCH;
-       }
-     }
-   NEXT_BRANCH:
-   code += (code[1] << 8) + code[2];
-   }
- while (*code == OP_ALT);
- /* No branches match the empty string */
- return FALSE;
- }
- /*************************************************
  *            Handle escapes                      *
  *************************************************/
-Line 366 
 Arguments:
+Line 359 
 Arguments:
    bracount   number of previous extracting brackets
    options    the options bits
    isclass    TRUE if inside a character class
+   cd         pointer to char tables block
  Returns:     zero or positive => a data character
               negative => a special escape sequence
-Line 374 
 Returns:     zero or positive => a data
+Line 368 
 Returns:     zero or positive => a data
  static int
  check_escape(const uschar **ptrptr, const char **errorptr, int bracount,
-   int options, BOOL isclass)
+   int options, BOOL isclass, compile_data *cd)
  {
  const uschar *ptr = *ptrptr;
- int c = *(++ptr) & 255;   /* Ensure > 0 on signed-char systems */
+ int c, i;
- int i;
+ c = *(++ptr) & 255;   /* Ensure > 0 on signed-char systems */
  if (c == 0) *errorptr = ERR1;
  /* Digits or letters may have special meaning; all others are literals. */
-Line 417 
 else
+Line 411 
 else
        {
        oldptr = ptr;
        c -= '0';
-       while ((pcre_ctypes[ptr[1]] & ctype_digit) != 0)
+       while ((cd->ctypes[ptr[1]] & ctype_digit) != 0)
          c = c * 10 + *(++ptr) - '0';
        if (c < 10 || c <= bracount)
          {
-Line 443 
 else
+Line 437 
 else
      case '0':
      c -= '0';
-     while(i++ < 2 && (pcre_ctypes[ptr[1]] & ctype_digit) != 0 &&
+     while(i++ < 2 && (cd->ctypes[ptr[1]] & ctype_digit) != 0 &&
        ptr[1] != '8' && ptr[1] != '9')
          c = c * 8 + *(++ptr) - '0';
      break;
-Line 452 
 else
+Line 446 
 else
      case 'x':
      c = 0;
-     while (i++ < 2 && (pcre_ctypes[ptr[1]] & ctype_xdigit) != 0)
+     while (i++ < 2 && (cd->ctypes[ptr[1]] & ctype_xdigit) != 0)
        {
        ptr++;
-       c = c * 16 + pcre_lcc[*ptr] -
+       c = c * 16 + cd->lcc[*ptr] -
-         (((pcre_ctypes[*ptr] & ctype_digit) != 0)? '0' : 'W');
+         (((cd->ctypes[*ptr] & ctype_digit) != 0)? '0' : 'W');
        }
      break;
-Line 470 
 else
+Line 464 
 else
      /* A letter is upper-cased; then the 0x40 bit is flipped */
-     if (c >= 'a' && c <= 'z') c = pcre_fcc[c];
+     if (c >= 'a' && c <= 'z') c = cd->fcc[c];
      c ^= 0x40;
      break;
      /* PCRE_EXTRA enables extensions to Perl in the matter of escapes. Any
      other alphameric following \ is an error if PCRE_EXTRA was set; otherwise,
-     for Perl compatibility, it is a literal. */
+     for Perl compatibility, it is a literal. This code looks a bit odd, but
+     there used to be some cases other than the default, and there may be again
+     in future, so I haven't "optimized" it. */
      default:
      if ((options & PCRE_EXTRA) != 0) switch(c)
        {
-       case 'X':
-       c = -ESC_X;      /* This could be a lookup if it ever got into Perl */
-       break;
        default:
        *errorptr = ERR3;
        break;
-Line 510 
 where the ddds are digits.
+Line 502 
 where the ddds are digits.
  Arguments:
    p         pointer to the first char after '{'
+   cd        pointer to char tables block
  Returns:    TRUE or FALSE
  */
  static BOOL
- is_counted_repeat(const uschar *p)
+ is_counted_repeat(const uschar *p, compile_data *cd)
  {
- if ((pcre_ctypes[*p++] & ctype_digit) == 0) return FALSE;
+ if ((cd->ctypes[*p++] & ctype_digit) == 0) return FALSE;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) p++;
+ while ((cd->ctypes[*p] & ctype_digit) != 0) p++;
  if (*p == '}') return TRUE;
  if (*p++ != ',') return FALSE;
  if (*p == '}') return TRUE;
- if ((pcre_ctypes[*p++] & ctype_digit) == 0) return FALSE;
+ if ((cd->ctypes[*p++] & ctype_digit) == 0) return FALSE;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) p++;
+ while ((cd->ctypes[*p] & ctype_digit) != 0) p++;
  return (*p == '}');
  }
-Line 545 
 Arguments:
+Line 538 
 Arguments:
    maxp       pointer to int for max
               returned as -1 if no max
    errorptr   points to pointer to error message
+   cd         pointer to character tables clock
  Returns:     pointer to '}' on success;
               current ptr on error, with errorptr set
  */
  static const uschar *
- read_repeat_counts(const uschar *p, int *minp, int *maxp, const char **errorptr)
+ read_repeat_counts(const uschar *p, int *minp, int *maxp,
+   const char **errorptr, compile_data *cd)
  {
  int min = 0;
  int max = -1;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
+ while ((cd->ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
  if (*p == '}') max = min; else
    {
    if (*(++p) != '}')
      {
      max = 0;
-     while((pcre_ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
+     while((cd->ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
      if (max < min)
        {
        *errorptr = ERR4;
-Line 588 
 return p;
+Line 583 
 return p;
  /*************************************************
+ *        Find the fixed length of a pattern      *
+ *************************************************/
+ /* Scan a pattern and compute the fixed length of subject that will match it,
+ if the length is fixed. This is needed for dealing with backward assertions.
+ Arguments:
+   code     points to the start of the pattern (the bracket)
+ Returns:   the fixed length, or -1 if there is no fixed length
+ */
+ static int
+ find_fixedlength(uschar *code)
+ {
+ int length = -1;
+ register int branchlength = 0;
+ register uschar *cc = code + 3;
+ /* Scan along the opcodes for this branch. If we get to the end of the
+ branch, check the length against that of the other branches. */
+ for (;;)
+   {
+   int d;
+   register int op = *cc;
+   if (op >= OP_BRA) op = OP_BRA;
+   switch (op)
+     {
+     case OP_BRA:
+     case OP_ONCE:
+     case OP_COND:
+     d = find_fixedlength(cc);
+     if (d < 0) return -1;
+     branchlength += d;
+     do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
+     cc += 3;
+     break;
+     /* Reached end of a branch; if it's a ket it is the end of a nested
+     call. If it's ALT it is an alternation in a nested call. If it is
+     END it's the end of the outer call. All can be handled by the same code. */
+     case OP_ALT:
+     case OP_KET:
+     case OP_KETRMAX:
+     case OP_KETRMIN:
+     case OP_END:
+     if (length < 0) length = branchlength;
+       else if (length != branchlength) return -1;
+     if (*cc != OP_ALT) return length;
+     cc += 3;
+     branchlength = 0;
+     break;
+     /* Skip over assertive subpatterns */
+     case OP_ASSERT:
+     case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
+     do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
+     cc += 3;
+     break;
+     /* Skip over things that don't match chars */
+     case OP_REVERSE:
+     cc++;
+     /* Fall through */
+     case OP_CREF:
+     case OP_OPT:
+     cc++;
+     /* Fall through */
+     case OP_SOD:
+     case OP_EOD:
+     case OP_EODN:
+     case OP_CIRC:
+     case OP_DOLL:
+     case OP_NOT_WORD_BOUNDARY:
+     case OP_WORD_BOUNDARY:
+     cc++;
+     break;
+     /* Handle char strings */
+     case OP_CHARS:
+     branchlength += *(++cc);
+     cc += *cc + 1;
+     break;
+     /* Handle exact repetitions */
+     case OP_EXACT:
+     case OP_TYPEEXACT:
+     branchlength += (cc[1] << 8) + cc[2];
+     cc += 4;
+     break;
+     /* Handle single-char matchers */
+     case OP_NOT_DIGIT:
+     case OP_DIGIT:
+     case OP_NOT_WHITESPACE:
+     case OP_WHITESPACE:
+     case OP_NOT_WORDCHAR:
+     case OP_WORDCHAR:
+     case OP_ANY:
+     branchlength++;
+     cc++;
+     break;
+     /* Check a class for variable quantification */
+     case OP_CLASS:
+     cc += (*cc == OP_REF)? 2 : 33;
+     switch (*cc)
+       {
+       case OP_CRSTAR:
+       case OP_CRMINSTAR:
+       case OP_CRQUERY:
+       case OP_CRMINQUERY:
+       return -1;
+       case OP_CRRANGE:
+       case OP_CRMINRANGE:
+       if ((cc[1] << 8) + cc[2] != (cc[3] << 8) + cc[4]) return -1;
+       branchlength += (cc[1] << 8) + cc[2];
+       cc += 5;
+       break;
+       default:
+       branchlength++;
+       }
+     break;
+     /* Anything else is variable length */
+     default:
+     return -1;
+     }
+   }
+ /* Control never gets here */
+ }
+ /*************************************************
+ *           Check for POSIX class syntax         *
+ *************************************************/
+ /* This function is called when the sequence "[:" or "[." or "[=" is
+ encountered in a character class. It checks whether this is followed by an
+ optional ^ and then a sequence of letters, terminated by a matching ":]" or
+ ".]" or "=]".
+ Argument:
+   ptr      pointer to the initial [
+   endptr   where to return the end pointer
+   cd       pointer to compile data
+ Returns:   TRUE or FALSE
+ */
+ static BOOL
+ check_posix_syntax(const uschar *ptr, const uschar **endptr, compile_data *cd)
+ {
+ int terminator;          /* Don't combine these lines; the Solaris cc */
+ terminator = *(++ptr);   /* compiler warns about "non-constant" initializer. */
+ if (*(++ptr) == '^') ptr++;
+ while ((cd->ctypes[*ptr] & ctype_letter) != 0) ptr++;
+ if (*ptr == terminator && ptr[1] == ']')
+   {
+   *endptr = ptr;
+   return TRUE;
+   }
+ return FALSE;
+ }
+ /*************************************************
+ *          Check POSIX class name                *
+ *************************************************/
+ /* This function is called to check the name given in a POSIX-style class entry
+ such as [:alnum:].
+ Arguments:
+   ptr        points to the first letter
+   len        the length of the name
+ Returns:     a value representing the name, or -1 if unknown
+ */
+ static int
+ check_posix_name(const uschar *ptr, int len)
+ {
+ register int yield = 0;
+ while (posix_name_lengths[yield] != 0)
+   {
+   if (len == posix_name_lengths[yield] &&
+     strncmp((const char *)ptr, posix_names[yield], len) == 0) return yield;
+   yield++;
+   }
+ return -1;
+ }
+ /*************************************************
  *           Compile one branch                   *
  *************************************************/
  /* Scan the pattern, compiling it into the code vector.
  Arguments:
-   options    the option bits
+   options      the option bits
-   bracket    points to number of brackets used
+   brackets     points to number of brackets used
-   code       points to the pointer to the current code point
+   code         points to the pointer to the current code point
-   ptrptr     points to the current pattern pointer
+   ptrptr       points to the current pattern pointer
-   errorptr   points to pointer to error message
+   errorptr     points to pointer to error message
+   optchanged   set to the value of the last OP_OPT item compiled
+   reqchar      set to the last literal character required, else -1
+   countlits    set to count of mandatory literal characters
+   cd           contains pointers to tables
- Returns:     TRUE on success
+ Returns:       TRUE on success
-              FALSE, with *errorptr set on error
+                FALSE, with *errorptr set on error
  */
  static BOOL
  compile_branch(int options, int *brackets, uschar **codeptr,
-   const uschar **ptrptr, const char **errorptr)
+   const uschar **ptrptr, const char **errorptr, int *optchanged,
+   int *reqchar, int *countlits, compile_data *cd)
  {
  int repeat_type, op_type;
  int repeat_min, repeat_max;
  int bravalue, length;
+ int greedy_default, greedy_non_default;
+ int prevreqchar;
+ int condcount = 0;
+ int subcountlits = 0;
  register int c;
  register uschar *code = *codeptr;
+ uschar *tempcode;
  const uschar *ptr = *ptrptr;
- const uschar *oldptr;
+ const uschar *tempptr;
  uschar *previous = NULL;
  uschar class[32];
+ /* Set up the default and non-default settings for greediness */
+ greedy_default = ((options & PCRE_UNGREEDY) != 0);
+ greedy_non_default = greedy_default ^ 1;
+ /* Initialize no required char, and count of literals */
+ *reqchar = prevreqchar = -1;
+ *countlits = 0;
  /* Switch on next character until the end of the branch */
  for (;; ptr++)
    {
    BOOL negate_class;
-   int  class_charcount;
+   int class_charcount;
-   int  class_lastchar;
+   int class_lastchar;
+   int newoptions;
+   int condref;
+   int subreqchar;
    c = *ptr;
    if ((options & PCRE_EXTENDED) != 0)
      {
-     if ((pcre_ctypes[c] & ctype_space) != 0) continue;
+     if ((cd->ctypes[c] & ctype_space) != 0) continue;
      if (c == '#')
        {
-       while ((c = *(++ptr)) != 0 && c != '\n');
+       /* The space before the ; is to avoid a warning on a silly compiler
+       on the Macintosh. */
+       while ((c = *(++ptr)) != 0 && c != '\n') ;
        continue;
        }
      }
-Line 672 
 for (;; ptr++)
+Line 912 
 for (;; ptr++)
      case '[':
      previous = code;
+     *code++ = OP_CLASS;
-     /* If the first character is '^', set the negation flag, and use a
+     /* If the first character is '^', set the negation flag and skip it. */
-     different opcode. This only matters if caseless matching is specified at
-     runtime. */
      if ((c = *(++ptr)) == '^')
        {
        negate_class = TRUE;
-       *code++ = OP_NEGCLASS;
        c = *(++ptr);
        }
-     else
+     else negate_class = FALSE;
-       {
-       negate_class = FALSE;
-       *code++ = OP_CLASS;
-       }
      /* Keep a count of chars so that we can optimize the case of just a single
      character. */
-Line 713 
 for (;; ptr++)
+Line 947 
 for (;; ptr++)
          goto FAILED;
          }
+       /* Handle POSIX class names. Perl allows a negation extension of the
+       form [:^name]. A square bracket that doesn't match the syntax is
+       treated as a literal. We also recognize the POSIX constructions
+       [.ch.] and [=ch=] ("collating elements") and fault them, as Perl
+.6 does. */
+       if (c == '[' &&
+           (ptr[1] == ':' || ptr[1] == '.' || ptr[1] == '=') &&
+           check_posix_syntax(ptr, &tempptr, cd))
+         {
+         BOOL local_negate = FALSE;
+         int posix_class, i;
+         register const uschar *cbits = cd->cbits;
+         if (ptr[1] != ':')
+           {
+           *errorptr = ERR31;
+           goto FAILED;
+           }
+         ptr += 2;
+         if (*ptr == '^')
+           {
+           local_negate = TRUE;
+           ptr++;
+           }
+         posix_class = check_posix_name(ptr, tempptr - ptr);
+         if (posix_class < 0)
+           {
+           *errorptr = ERR30;
+           goto FAILED;
+           }
+         /* If matching is caseless, upper and lower are converted to
+         alpha. This relies on the fact that the class table starts with
+         alpha, lower, upper as the first 3 entries. */
+         if ((options & PCRE_CASELESS) != 0 && posix_class <= 2)
+           posix_class = 0;
+         /* Or into the map we are building up to 3 of the static class
+         tables, or their negations. */
+         posix_class *= 3;
+         for (i = 0; i < 3; i++)
+           {
+           int taboffset = posix_class_maps[posix_class + i];
+           if (taboffset < 0) break;
+           if (local_negate)
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+taboffset];
+           else
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+taboffset];
+           }
+         ptr = tempptr + 1;
+         class_charcount = 10;  /* Set > 1; assumes more than 1 per class */
+         continue;
+         }
        /* Backslash may introduce a single character, or it may introduce one
        of the specials, which just set a flag. Escaped items are checked for
        validity in the pre-compiling pass. The sequence \b is a special case.
-Line 723 
 for (;; ptr++)
+Line 1017 
 for (;; ptr++)
        if (c == '\\')
          {
-         c = check_escape(&ptr, errorptr, *brackets, options, TRUE);
+         c = check_escape(&ptr, errorptr, *brackets, options, TRUE, cd);
          if (-c == ESC_b) c = '\b';
          else if (c < 0)
            {
+           register const uschar *cbits = cd->cbits;
            class_charcount = 10;
            switch (-c)
              {
              case ESC_d:
-             for (c = 0; c < 32; c++) class[c] |= pcre_cbits[c+cbit_digit];
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_digit];
              continue;
              case ESC_D:
-             for (c = 0; c < 32; c++) class[c] |= ~pcre_cbits[c+cbit_digit];
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_digit];
              continue;
              case ESC_w:
-             for (c = 0; c < 32; c++)
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_word];
-               class[c] |= (pcre_cbits[c] | pcre_cbits[c+cbit_word]);
              continue;
              case ESC_W:
-             for (c = 0; c < 32; c++)
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_word];
-               class[c] |= ~(pcre_cbits[c] | pcre_cbits[c+cbit_word]);
              continue;
              case ESC_s:
-             for (c = 0; c < 32; c++) class[c] |= pcre_cbits[c+cbit_space];
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_space];
              continue;
              case ESC_S:
-             for (c = 0; c < 32; c++) class[c] |= ~pcre_cbits[c+cbit_space];
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_space];
              continue;
              default:
-Line 785 
 for (;; ptr++)
+Line 1078 
 for (;; ptr++)
          if (d == '\\')
            {
-           d = check_escape(&ptr, errorptr, *brackets, options, TRUE);
+           d = check_escape(&ptr, errorptr, *brackets, options, TRUE, cd);
            if (d < 0)
              {
              if (d == -ESC_b) d = '\b'; else
-Line 807 
 for (;; ptr++)
+Line 1100 
 for (;; ptr++)
            class[c/8] |= (1 << (c&7));
            if ((options & PCRE_CASELESS) != 0)
              {
-             int uc = pcre_fcc[c];           /* flip case */
+             int uc = cd->fcc[c];           /* flip case */
              class[uc/8] |= (1 << (uc&7));
              }
            class_charcount++;                /* in case a one-char range */
-Line 822 
 for (;; ptr++)
+Line 1115 
 for (;; ptr++)
        class [c/8] |= (1 << (c&7));
        if ((options & PCRE_CASELESS) != 0)
          {
-         c = pcre_fcc[c];   /* flip case */
+         c = cd->fcc[c];   /* flip case */
          class[c/8] |= (1 << (c&7));
          }
        class_charcount++;
-Line 869 
 for (;; ptr++)
+Line 1162 
 for (;; ptr++)
      /* Various kinds of repeat */
      case '{':
-     if (!is_counted_repeat(ptr+1)) goto NORMAL_CHAR;
+     if (!is_counted_repeat(ptr+1, cd)) goto NORMAL_CHAR;
-     ptr = read_repeat_counts(ptr+1, &repeat_min, &repeat_max, errorptr);
+     ptr = read_repeat_counts(ptr+1, &repeat_min, &repeat_max, errorptr, cd);
      if (*errorptr != NULL) goto FAILED;
      goto REPEAT;
-Line 895 
 for (;; ptr++)
+Line 1188 
 for (;; ptr++)
        goto FAILED;
        }
-     /* If the next character is '?' this is a minimizing repeat. Advance to the
+     /* If the next character is '?' this is a minimizing repeat, by default,
+     but if PCRE_UNGREEDY is set, it works the other way round. Advance to the
      next character. */
-     if (ptr[1] == '?') { repeat_type = 1; ptr++; } else repeat_type = 0;
+     if (ptr[1] == '?')
+       { repeat_type = greedy_non_default; ptr++; }
-     /* If the maximum is zero then the minimum must also be zero; Perl allows
+     else repeat_type = greedy_default;
-     this case, so we do too - by simply omitting the item altogether. */
-     if (repeat_max == 0) code = previous;
      /* If previous was a string of characters, chop off the last one and use it
      as the subject of the repeat. If there was only one character, we can
-     abolish the previous item altogether. */
+     abolish the previous item altogether. A repeat with a zero minimum wipes
+     out any reqchar setting, backing up to the previous value. We must also
+     adjust the countlits value. */
-     else if (*previous == OP_CHARS)
+     if (*previous == OP_CHARS)
        {
        int len = previous[1];
+       if (repeat_min == 0) *reqchar = prevreqchar;
+       *countlits += repeat_min - 1;
        if (len == 1)
          {
          c = previous[2];
-Line 943 
 for (;; ptr++)
+Line 1240 
 for (;; ptr++)
      create a suitable repeat item. The code is shared with single-character
      repeats by adding a suitable offset into repeat_type. */
-     else if ((int)*previous < OP_EOD || *previous == OP_ANY)
+     else if ((int)*previous < OP_EODN || *previous == OP_ANY)
        {
        op_type = OP_TYPESTAR - OP_STAR;  /* Use type opcodes */
        c = *previous;
        code = previous;
        OUTPUT_SINGLE_REPEAT:
-       repeat_type += op_type;      /* Combine both values for many cases */
+       /* If the maximum is zero then the minimum must also be zero; Perl allows
+       this case, so we do too - by simply omitting the item altogether. */
+       if (repeat_max == 0) goto END_REPEAT;
+       /* Combine the op_type with the repeat_type */
+       repeat_type += op_type;
        /* A minimum of zero is handled either as the special case * or ?, or as
        an UPTO, with the maximum given. */
-Line 987 
 for (;; ptr++)
+Line 1292 
 for (;; ptr++)
          /* If the mininum is 1 and the previous item was a character string,
          we either have to put back the item that got cancelled if the string
          length was 1, or add the character back onto the end of a longer
-         string. For a character type nothing need be done; it will just get put
+         string. For a character type nothing need be done; it will just get
-         back naturally. */
+         put back naturally. Note that the final character is always going to
+         get added below. */
          else if (*previous == OP_CHARS)
            {
            if (code == previous) code += 2; else previous[1]++;
            }
+         /*  For a single negated character we also have to put back the
+         item that got cancelled. */
+         else if (*previous == OP_NOT) code++;
          /* If the maximum is unlimited, insert an OP_STAR. */
          if (repeat_max < 0)
-Line 1021 
 for (;; ptr++)
+Line 1332 
 for (;; ptr++)
        }
      /* If previous was a character class or a back reference, we put the repeat
-     stuff after it. */
+     stuff after it, but just skip the item if the repeat was {0,0}. */
-     else if (*previous == OP_CLASS || *previous == OP_NEGCLASS ||
+     else if (*previous == OP_CLASS || *previous == OP_REF)
-              *previous == OP_REF)
        {
+       if (repeat_max == 0)
+         {
+         code = previous;
+         goto END_REPEAT;
+         }
        if (repeat_min == 0 && repeat_max == -1)
          *code++ = OP_CRSTAR + repeat_type;
        else if (repeat_min == 1 && repeat_max == -1)
-Line 1044 
 for (;; ptr++)
+Line 1359 
 for (;; ptr++)
        }
      /* If previous was a bracket group, we may have to replicate it in certain
-     cases. If the maximum repeat count is unlimited, check that the bracket
+     cases. */
-     group cannot match the empty string, and diagnose an error if it can. */
-     else if ((int)*previous >= OP_BRA)
+     else if ((int)*previous >= OP_BRA || (int)*previous == OP_ONCE ||
+              (int)*previous == OP_COND)
        {
-       int i;
+       register int i;
+       int ketoffset = 0;
        int len = code - previous;
+       uschar *bralink = NULL;
+       /* If the maximum repeat count is unlimited, find the end of the bracket
+       by scanning through from the start, and compute the offset back to it
+       from the current code pointer. There may be an OP_OPT setting following
+       the final KET, so we can't find the end just by going back from the code
+       pointer. */
+       if (repeat_max == -1)
+         {
+         register uschar *ket = previous;
+         do ket += (ket[1] << 8) + ket[2]; while (*ket != OP_KET);
+         ketoffset = code - ket;
+         }
+       /* The case of a zero minimum is special because of the need to stick
+       OP_BRAZERO in front of it, and because the group appears once in the
+       data, whereas in other cases it appears the minimum number of times. For
+       this reason, it is simplest to treat this case separately, as otherwise
+       the code gets far too mess. There are several special subcases when the
+       minimum is zero. */
-       if (repeat_max == -1 && could_be_empty(previous))
+       if (repeat_min == 0)
          {
-         *errorptr = ERR10;
+         /* If we set up a required char from the bracket, we must back off
-         goto FAILED;
+         to the previous value and reset the countlits value too. */
-         }
-       /* If the minimum is greater than zero, and the maximum is unlimited or
+         if (subcountlits > 0)
-       equal to the minimum, the first copy remains where it is, and is
+           {
-       replicated up to the minimum number of times. This case includes the +
+           *reqchar = prevreqchar;
-       repeat, but of course no replication is needed in that case. */
+           *countlits -= subcountlits;
+           }
-       if (repeat_min > 0 && (repeat_max == -1 || repeat_max == repeat_min))
+         /* If the maximum is also zero, we just omit the group from the output
-         {
+         altogether. */
-         for (i = 1; i < repeat_min; i++)
+         if (repeat_max == 0)
            {
-           memcpy(code, previous, len);
+           code = previous;
-           code += len;
+           goto END_REPEAT;
            }
-         }
-       /* If the minimum is zero, stick BRAZERO in front of the first copy.
+         /* If the maximum is 1 or unlimited, we just have to stick in the
-       Then, if there is a fixed upper limit, replicated up to that many times,
+         BRAZERO and do no more at this point. */
-       sticking BRAZERO in front of all the optional ones. */
-       else
+         if (repeat_max <= 1)
-         {
-         if (repeat_min == 0)
            {
            memmove(previous+1, previous, len);
            code++;
            *previous++ = OP_BRAZERO + repeat_type;
            }
+         /* If the maximum is greater than 1 and limited, we have to replicate
+         in a nested fashion, sticking OP_BRAZERO before each set of brackets.
+         The first one has to be handled carefully because it's the original
+         copy, which has to be moved up. The remainder can be handled by code
+         that is common with the non-zero minimum case below. We just have to
+         adjust the value or repeat_max, since one less copy is required. */
+         else
+           {
+           int offset;
+           memmove(previous+4, previous, len);
+           code += 4;
+           *previous++ = OP_BRAZERO + repeat_type;
+           *previous++ = OP_BRA;
+           /* We chain together the bracket offset fields that have to be
+           filled in later when the ends of the brackets are reached. */
+           offset = (bralink == NULL)? 0 : previous - bralink;
+           bralink = previous;
+           *previous++ = offset >> 8;
+           *previous++ = offset & 255;
+           }
+         repeat_max--;
+         }
+       /* If the minimum is greater than zero, replicate the group as many
+       times as necessary, and adjust the maximum to the number of subsequent
+       copies that we need. */
+       else
+         {
          for (i = 1; i < repeat_min; i++)
            {
            memcpy(code, previous, len);
            code += len;
            }
+         if (repeat_max > 0) repeat_max -= repeat_min;
+         }
-         for (i = (repeat_min > 0)? repeat_min : 1; i < repeat_max; i++)
+       /* This code is common to both the zero and non-zero minimum cases. If
+       the maximum is limited, it replicates the group in a nested fashion,
+       remembering the bracket starts on a stack. In the case of a zero minimum,
+       the first one was set up above. In all cases the repeat_max now specifies
+       the number of additional copies needed. */
+       if (repeat_max >= 0)
+         {
+         for (i = repeat_max - 1; i >= 0; i--)
            {
            *code++ = OP_BRAZERO + repeat_type;
+           /* All but the final copy start a new nesting, maintaining the
+           chain of brackets outstanding. */
+           if (i != 0)
+             {
+             int offset;
+             *code++ = OP_BRA;
+             offset = (bralink == NULL)? 0 : code - bralink;
+             bralink = code;
+             *code++ = offset >> 8;
+             *code++ = offset & 255;
+             }
            memcpy(code, previous, len);
            code += len;
            }
+         /* Now chain through the pending brackets, and fill in their length
+         fields (which are holding the chain links pro tem). */
+         while (bralink != NULL)
+           {
+           int oldlinkoffset;
+           int offset = code - bralink + 1;
+           uschar *bra = code - offset;
+           oldlinkoffset = (bra[1] << 8) + bra[2];
+           bralink = (oldlinkoffset == 0)? NULL : bralink - oldlinkoffset;
+           *code++ = OP_KET;
+           *code++ = bra[1] = offset >> 8;
+           *code++ = bra[2] = (offset & 255);
+           }
          }
-       /* If the maximum is unlimited, set a repeater in the final copy. */
+       /* If the maximum is unlimited, set a repeater in the final copy. We
+       can't just offset backwards from the current code point, because we
+       don't know if there's been an options resetting after the ket. The
+       correct offset was computed above. */
-       if (repeat_max == -1) code[-3] = OP_KETRMAX + repeat_type;
+       else code[-ketoffset] = OP_KETRMAX + repeat_type;
        }
      /* Else there's some kind of shambles */
-Line 1114 
 for (;; ptr++)
+Line 1523 
 for (;; ptr++)
      /* In all case we no longer have a previous item. */
+     END_REPEAT:
      previous = NULL;
      break;
-     /* Start of nested bracket sub-expression, or comment or lookahead.
+     /* Start of nested bracket sub-expression, or comment or lookahead or
-     First deal with special things that can come after a bracket; all are
+     lookbehind or option setting or condition. First deal with special things
-     introduced by ?, and the appearance of any of them means that this is not a
+     that can come after a bracket; all are introduced by ?, and the appearance
-     referencing group. They were checked for validity in the first pass over
+     of any of them means that this is not a referencing group. They were
-     the string, so we don't have to check for syntax errors here.  */
+     checked for validity in the first pass over the string, so we don't have to
+     check for syntax errors here.  */
      case '(':
-     previous = code;              /* Only real brackets can be repeated */
+     newoptions = options;
+     condref = -1;
      if (*(++ptr) == '?')
        {
-       bravalue = OP_BRA;
+       int set, unset;
+       int *optset;
        switch (*(++ptr))
          {
-         case '#':
+         case '#':                 /* Comment; skip to ket */
-         case 'i':
-         case 'm':
-         case 's':
-         case 'x':
          ptr++;
          while (*ptr != ')') ptr++;
-         previous = NULL;
          continue;
          case ':':                 /* Non-extracting bracket */
+         bravalue = OP_BRA;
          ptr++;
          break;
-         case '=':                 /* Assertions can't be repeated */
+         case '(':
+         bravalue = OP_COND;       /* Conditional group */
+         if ((cd->ctypes[*(++ptr)] & ctype_digit) != 0)
+           {
+           condref = *ptr - '0';
+           while (*(++ptr) != ')') condref = condref*10 + *ptr - '0';
+           ptr++;
+           }
+         else ptr--;
+         break;
+         case '=':                 /* Positive lookahead */
          bravalue = OP_ASSERT;
          ptr++;
-         previous = NULL;
          break;
-         case '!':
+         case '!':                 /* Negative lookahead */
          bravalue = OP_ASSERT_NOT;
          ptr++;
-         previous = NULL;
          break;
-         case '>':                         /* "Match once" brackets */
+         case '<':                 /* Lookbehinds */
-         if ((options & PCRE_EXTRA) != 0)  /* Not yet standard */
+         switch (*(++ptr))
            {
-           bravalue = OP_ONCE;
+           case '=':               /* Positive lookbehind */
+           bravalue = OP_ASSERTBACK;
+           ptr++;
+           break;
+           case '!':               /* Negative lookbehind */
+           bravalue = OP_ASSERTBACK_NOT;
            ptr++;
-           previous = NULL;
            break;
+           default:                /* Syntax error */
+           *errorptr = ERR24;
+           goto FAILED;
            }
-         /* Else fall through */
+         break;
-         default:
+         case '>':                 /* One-time brackets */
-         *errorptr = ERR12;
+         bravalue = OP_ONCE;
-         goto FAILED;
+         ptr++;
+         break;
+         case 'R':                 /* Pattern recursion */
+         *code++ = OP_RECURSE;
+         ptr++;
+         continue;
+         default:                  /* Option setting */
+         set = unset = 0;
+         optset = &set;
+         while (*ptr != ')' && *ptr != ':')
+           {
+           switch (*ptr++)
+             {
+             case '-': optset = &unset; break;
+             case 'i': *optset |= PCRE_CASELESS; break;
+             case 'm': *optset |= PCRE_MULTILINE; break;
+             case 's': *optset |= PCRE_DOTALL; break;
+             case 'x': *optset |= PCRE_EXTENDED; break;
+             case 'U': *optset |= PCRE_UNGREEDY; break;
+             case 'X': *optset |= PCRE_EXTRA; break;
+             default:
+             *errorptr = ERR12;
+             goto FAILED;
+             }
+           }
+         /* Set up the changed option bits, but don't change anything yet. */
+         newoptions = (options | set) & (~unset);
+         /* If the options ended with ')' this is not the start of a nested
+         group with option changes, so the options change at this level. At top
+         level there is nothing else to be done (the options will in fact have
+         been set from the start of compiling as a result of the first pass) but
+         at an inner level we must compile code to change the ims options if
+         necessary, and pass the new setting back so that it can be put at the
+         start of any following branches, and when this group ends, a resetting
+         item can be compiled. */
+         if (*ptr == ')')
+           {
+           if ((options & PCRE_INGROUP) != 0 &&
+               (options & PCRE_IMS) != (newoptions & PCRE_IMS))
+             {
+             *code++ = OP_OPT;
+             *code++ = *optchanged = newoptions & PCRE_IMS;
+             }
+           options = newoptions;  /* Change options at this level */
+           previous = NULL;       /* This item can't be repeated */
+           continue;              /* It is complete */
+           }
+         /* If the options ended with ':' we are heading into a nested group
+         with possible change of options. Such groups are non-capturing and are
+         not assertions of any kind. All we need to do is skip over the ':';
+         the newoptions value is handled below. */
+         bravalue = OP_BRA;
+         ptr++;
          }
        }
-     /* Else we have a referencing group */
+     /* Else we have a referencing group; adjust the opcode. */
      else
        {
-Line 1186 
 for (;; ptr++)
+Line 1677 
 for (;; ptr++)
        bravalue = OP_BRA + *brackets;
        }
-     /* Process nested bracketed re; at end pointer is on the bracket. We copy
+     /* Process nested bracketed re. Assertions may not be repeated, but other
-     code into a non-register variable in order to be able to pass its address
+     kinds can be. We copy code into a non-register variable in order to be able
-     because some compilers complain otherwise. */
+     to pass its address because some compilers complain otherwise. Pass in a
+     new setting for the ims options if they have changed. */
+     previous = (bravalue >= OP_ONCE)? code : NULL;
      *code = bravalue;
+     tempcode = code;
+     if (!compile_regex(
+          options | PCRE_INGROUP,       /* Set for all nested groups */
+          ((options & PCRE_IMS) != (newoptions & PCRE_IMS))?
+            newoptions & PCRE_IMS : -1, /* Pass ims options if changed */
+          brackets,                     /* Bracket level */
+          &tempcode,                    /* Where to put code (updated) */
+          &ptr,                         /* Input pointer (updated) */
+          errorptr,                     /* Where to put an error message */
+          (bravalue == OP_ASSERTBACK ||
+           bravalue == OP_ASSERTBACK_NOT), /* TRUE if back assert */
+          condref,                      /* Condition reference number */
+          &subreqchar,                  /* For possible last char */
+          &subcountlits,                /* For literal count */
+          cd))                          /* Tables block */
+       goto FAILED;
+     /* At the end of compiling, code is still pointing to the start of the
+     group, while tempcode has been updated to point past the end of the group
+     and any option resetting that may follow it. The pattern pointer (ptr)
+     is on the bracket. */
+     /* If this is a conditional bracket, check that there are no more than
+     two branches in the group. */
+     if (bravalue == OP_COND)
        {
-       uschar *mcode = code;
+       uschar *tc = code;
-       if (!compile_regex(options, brackets, &mcode, &ptr, errorptr))
+       condcount = 0;
+       do {
+          condcount++;
+          tc += (tc[1] << 8) | tc[2];
+          }
+       while (*tc != OP_KET);
+       if (condcount > 2)
+         {
+         *errorptr = ERR27;
          goto FAILED;
-       code = mcode;
+         }
        }
+     /* Handle updating of the required character. If the subpattern didn't
+     set one, leave it as it was. Otherwise, update it for normal brackets of
+     all kinds, forward assertions, and conditions with two branches. Don't
+     update the literal count for forward assertions, however. If the bracket
+     is followed by a quantifier with zero repeat, we have to back off. Hence
+     the definition of prevreqchar and subcountlits outside the main loop so
+     that they can be accessed for the back off. */
+     if (subreqchar > 0 &&
+          (bravalue >= OP_BRA || bravalue == OP_ONCE || bravalue == OP_ASSERT ||
+          (bravalue == OP_COND && condcount == 2)))
+       {
+       prevreqchar = *reqchar;
+       *reqchar = subreqchar;
+       if (bravalue != OP_ASSERT) *countlits += subcountlits;
+       }
+     /* Now update the main code pointer to the end of the group. */
+     code = tempcode;
+     /* Error if hit end of pattern */
      if (*ptr != ')')
        {
        *errorptr = ERR14;
-Line 1210 
 for (;; ptr++)
+Line 1763 
 for (;; ptr++)
      for validity in the pre-compiling pass. */
      case '\\':
-     oldptr = ptr;
+     tempptr = ptr;
-     c = check_escape(&ptr, errorptr, *brackets, options, FALSE);
+     c = check_escape(&ptr, errorptr, *brackets, options, FALSE, cd);
      /* Handle metacharacters introduced by \. For ones like \d, the ESC_ values
      are arranged to be the negation of the corresponding OP_values. For the
-Line 1224 
 for (;; ptr++)
+Line 1777 
 for (;; ptr++)
        {
        if (-c >= ESC_REF)
          {
-         int refnum = -c - ESC_REF;
-         if (*brackets < refnum)
-           {
-           *errorptr = ERR15;
-           goto FAILED;
-           }
          previous = code;
          *code++ = OP_REF;
-         *code++ = refnum;
+         *code++ = -c - ESC_REF;
          }
        else
          {
-         previous = (-c > ESC_b && -c < ESC_X)? code : NULL;
+         previous = (-c > ESC_b && -c < ESC_Z)? code : NULL;
          *code++ = -c;
          }
        continue;
-Line 1244 
 for (;; ptr++)
+Line 1791 
 for (;; ptr++)
      /* Data character: reset and fall through */
-     ptr = oldptr;
+     ptr = tempptr;
      c = '\\';
      /* Handle a run of data characters until a metacharacter is encountered.
-Line 1262 
 for (;; ptr++)
+Line 1809 
 for (;; ptr++)
        {
        if ((options & PCRE_EXTENDED) != 0)
          {
-         if ((pcre_ctypes[c] & ctype_space) != 0) continue;
+         if ((cd->ctypes[c] & ctype_space) != 0) continue;
          if (c == '#')
            {
-           while ((c = *(++ptr)) != 0 && c != '\n');
+           /* The space before the ; is to avoid a warning on a silly compiler
+           on the Macintosh. */
+           while ((c = *(++ptr)) != 0 && c != '\n') ;
            if (c == 0) break;
            continue;
            }
-Line 1277 
 for (;; ptr++)
+Line 1826 
 for (;; ptr++)
        if (c == '\\')
          {
-         oldptr = ptr;
+         tempptr = ptr;
-         c = check_escape(&ptr, errorptr, *brackets, options, FALSE);
+         c = check_escape(&ptr, errorptr, *brackets, options, FALSE, cd);
-         if (c < 0) { ptr = oldptr; break; }
+         if (c < 0) { ptr = tempptr; break; }
          }
        /* Ordinary character or single-char escape */
-Line 1290 
 for (;; ptr++)
+Line 1839 
 for (;; ptr++)
      /* This "while" is the end of the "do" above. */
-     while (length < 255 && (pcre_ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     while (length < 255 && (cd->ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     /* Update the last character and the count of literals */
+     prevreqchar = (length > 1)? code[-2] : *reqchar;
+     *reqchar = code[-1];
+     *countlits += length;
      /* Compute the length and set it in the data vector, and advance to
      the next state. */
      previous[1] = length;
-     ptr--;
+     if (length < 255) ptr--;
      break;
      }
    }                   /* end of big loop */
-Line 1320 
 return FALSE;
+Line 1875 
 return FALSE;
  /* On entry, ptr is pointing past the bracket character, but on return
  it points to the closing bracket, or vertical bar, or end of string.
  The code variable is pointing at the byte into which the BRA operator has been
- stored.
+ stored. If the ims options are changed at the start (for a (?ims: group) or
+ during any branch, we need to insert an OP_OPT item at the start of every
+ following branch to ensure they get set correctly at run time, and also pass
+ the new options into every subsequent branch compile.
  Argument:
-   options   the option bits
+   options     the option bits
-   brackets  -> int containing the number of extracting brackets used
+   optchanged  new ims options to set as if (?ims) were at the start, or -1
-   codeptr   -> the address of the current code pointer
+                for no change
-   ptrptr    -> the address of the current pattern pointer
+   brackets    -> int containing the number of extracting brackets used
-   errorptr  -> pointer to error message
+   codeptr     -> the address of the current code pointer
+   ptrptr      -> the address of the current pattern pointer
+   errorptr    -> pointer to error message
+   lookbehind  TRUE if this is a lookbehind assertion
+   condref     > 0 for OPT_CREF setting at start of conditional group
+   reqchar     -> place to put the last required character, or a negative number
+   countlits   -> place to put the shortest literal count of any branch
+   cd          points to the data block with tables pointers
- Returns:    TRUE on success
+ Returns:      TRUE on success
  */
  static BOOL
- compile_regex(int options, int *brackets, uschar **codeptr,
+ compile_regex(int options, int optchanged, int *brackets, uschar **codeptr,
-   const uschar **ptrptr, const char **errorptr)
+   const uschar **ptrptr, const char **errorptr, BOOL lookbehind, int condref,
+   int *reqchar, int *countlits, compile_data *cd)
  {
  const uschar *ptr = *ptrptr;
  uschar *code = *codeptr;
+ uschar *last_branch = code;
  uschar *start_bracket = code;
+ uschar *reverse_count = NULL;
+ int oldoptions = options & PCRE_IMS;
+ int branchreqchar, branchcountlits;
+ *reqchar = -1;
+ *countlits = INT_MAX;
+ code += 3;
+ /* At the start of a reference-based conditional group, insert the reference
+ number as an OP_CREF item. */
+ if (condref > 0)
+   {
+   *code++ = OP_CREF;
+   *code++ = condref;
+   }
+ /* Loop for each alternative branch */
  for (;;)
    {
    int length;
-   uschar *last_branch = code;
-   code += 3;
+   /* Handle change of options */
-   if (!compile_branch(options, brackets, &code, &ptr, errorptr))
+   if (optchanged >= 0)
+     {
+     *code++ = OP_OPT;
+     *code++ = optchanged;
+     options = (options & ~PCRE_IMS) | optchanged;
+     }
+   /* Set up dummy OP_REVERSE if lookbehind assertion */
+   if (lookbehind)
+     {
+     *code++ = OP_REVERSE;
+     reverse_count = code;
+     *code++ = 0;
+     *code++ = 0;
+     }
+   /* Now compile the branch */
+   if (!compile_branch(options, brackets, &code, &ptr, errorptr, &optchanged,
+       &branchreqchar, &branchcountlits, cd))
      {
      *ptrptr = ptr;
      return FALSE;
-Line 1358 
 for (;;)
+Line 1963 
 for (;;)
    last_branch[1] = length >> 8;
    last_branch[2] = length & 255;
+   /* Save the last required character if all branches have the same; a current
+   value of -1 means unset, while -2 means "previous branch had no last required
+   char".  */
+   if (*reqchar != -2)
+     {
+     if (branchreqchar >= 0)
+       {
+       if (*reqchar == -1) *reqchar = branchreqchar;
+       else if (*reqchar != branchreqchar) *reqchar = -2;
+       }
+     else *reqchar = -2;
+     }
+   /* Keep the shortest literal count */
+   if (branchcountlits < *countlits) *countlits = branchcountlits;
+   DPRINTF(("literal count = %d min=%d\n", branchcountlits, *countlits));
+   /* If lookbehind, check that this branch matches a fixed-length string,
+   and put the length into the OP_REVERSE item. Temporarily mark the end of
+   the branch with OP_END. */
+   if (lookbehind)
+     {
+     *code = OP_END;
+     length = find_fixedlength(last_branch);
+     DPRINTF(("fixed length = %d\n", length));
+     if (length < 0)
+       {
+       *errorptr = ERR25;
+       *ptrptr = ptr;
+       return FALSE;
+       }
+     reverse_count[0] = (length >> 8);
+     reverse_count[1] = length & 255;
+     }
    /* Reached end of expression, either ')' or end of pattern. Insert a
    terminating ket and the length of the whole bracketed item, and return,
-   leaving the pointer at the terminating char. */
+   leaving the pointer at the terminating char. If any of the ims options
+   were changed inside the group, compile a resetting op-code following. */
    if (*ptr != '|')
      {
-Line 1368 
 for (;;)
+Line 2012 
 for (;;)
      *code++ = OP_KET;
      *code++ = length >> 8;
      *code++ = length & 255;
+     if (optchanged >= 0)
+       {
+       *code++ = OP_OPT;
+       *code++ = oldoptions;
+       }
      *codeptr = code;
      *ptrptr = ptr;
      return TRUE;
-Line 1376 
 for (;;)
+Line 2025 
 for (;;)
    /* Another branch follows; insert an "or" node and advance the pointer. */
    *code = OP_ALT;
+   last_branch = code;
+   code += 3;
    ptr++;
    }
  /* Control never reaches here */
-Line 1383 
 for (;;)
+Line 2034 
 for (;;)
+ /*************************************************
+ *      Find first significant op code            *
+ *************************************************/
+ /* This is called by several functions that scan a compiled expression looking
+ for a fixed first character, or an anchoring op code etc. It skips over things
+ that do not influence this. For one application, a change of caseless option is
+ important.
+ Arguments:
+   code       pointer to the start of the group
+   options    pointer to external options
+   optbit     the option bit whose changing is significant, or
+              zero if none are
+   optstop    TRUE to return on option change, otherwise change the options
+                value and continue
+ Returns:     pointer to the first significant opcode
+ */
+ static const uschar*
+ first_significant_code(const uschar *code, int *options, int optbit,
+   BOOL optstop)
+ {
+ for (;;)
+   {
+   switch ((int)*code)
+     {
+     case OP_OPT:
+     if (optbit > 0 && ((int)code[1] & optbit) != (*options & optbit))
+       {
+       if (optstop) return code;
+       *options = (int)code[1];
+       }
+     code += 2;
+     break;
+     case OP_CREF:
+     code += 2;
+     break;
+     case OP_WORD_BOUNDARY:
+     case OP_NOT_WORD_BOUNDARY:
+     code++;
+     break;
+     case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
+     do code += (code[1] << 8) + code[2]; while (*code == OP_ALT);
+     code += 3;
+     break;
+     default:
+     return code;
+     }
+   }
+ /* Control never reaches here */
+ }
  /*************************************************
  *          Check for anchored expression         *
  *************************************************/
-Line 1393 
 all of whose alternatives start with OP_
+Line 2108 
 all of whose alternatives start with OP_
  it's anchored. However, if this is a multiline pattern, then only OP_SOD
  counts, since OP_CIRC can match in the middle.
- A branch is also implicitly anchored if it starts with .* because that will try
+ A branch is also implicitly anchored if it starts with .* and DOTALL is set,
- the rest of the pattern at all possible matching points, so there is no point
+ because that will try the rest of the pattern at all possible matching points,
- trying them again.
+ so there is no point trying them again.
- Argument:  points to start of expression (the bracket)
+ Arguments:
- Returns:   TRUE or FALSE
+   code       points to start of expression (the bracket)
+   options    points to the options setting
+ Returns:     TRUE or FALSE
  */
  static BOOL
- is_anchored(register const uschar *code, BOOL multiline)
+ is_anchored(register const uschar *code, int *options)
  {
  do {
-    int op = (int)code[3];
+    const uschar *scode = first_significant_code(code + 3, options,
-    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE)
+      PCRE_MULTILINE, FALSE);
-      { if (!is_anchored(code+3, multiline)) return FALSE; }
+    register int op = *scode;
-    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
+    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
-      { if (code[4] != OP_ANY) return FALSE; }
+      { if (!is_anchored(scode, options)) return FALSE; }
-    else if (op != OP_SOD && (multiline || op != OP_CIRC)) return FALSE;
+    else if ((op == OP_TYPESTAR || op == OP_TYPEMINSTAR) &&
+             (*options & PCRE_DOTALL) != 0)
+      { if (scode[1] != OP_ANY) return FALSE; }
+    else if (op != OP_SOD &&
+            ((*options & PCRE_MULTILINE) != 0 || op != OP_CIRC))
+      return FALSE;
     code += (code[1] << 8) + code[2];
     }
  while (*code == OP_ALT);
-Line 1420 
 return TRUE;
+Line 2143 
 return TRUE;
  /*************************************************
- *     Check for start with \n line expression    *
+ *         Check for starting with ^ or .*        *
  *************************************************/
- /* This is called for multiline expressions to try to find out if every branch
+ /* This is called to find out if every branch starts with ^ or .* so that
- starts with ^ so that "first char" processing can be done to speed things up.
+ "first char" processing can be done to speed things up in multiline
+ matching and for non-DOTALL patterns that start with .* (which must start at
+ the beginning or after \n).
  Argument:  points to start of expression (the bracket)
  Returns:   TRUE or FALSE
-Line 1434 
 static BOOL
+Line 2159 
 static BOOL
  is_startline(const uschar *code)
  {
  do {
-    if ((int)code[3] >= OP_BRA || code[3] == OP_ASSERT)
+    const uschar *scode = first_significant_code(code + 3, NULL, 0, FALSE);
-      { if (!is_startline(code+3)) return FALSE; }
+    register int op = *scode;
-    else if (code[3] != OP_CIRC) return FALSE;
+    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
+      { if (!is_startline(scode)) return FALSE; }
+    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
+      { if (scode[1] != OP_ANY) return FALSE; }
+    else if (op != OP_CIRC) return FALSE;
     code += (code[1] << 8) + code[2];
     }
  while (*code == OP_ALT);
-Line 1455 
 Consider each alternative branch. If the
+Line 2184 
 Consider each alternative branch. If the
  a bracket all of whose alternatives start with the same char (recurse ad lib),
  then we return that char, otherwise -1.
- Argument:  points to start of expression (the bracket)
+ Arguments:
- Returns:   -1 or the fixed first char
+   code       points to start of expression (the bracket)
+   options    pointer to the options (used to check casing changes)
+ Returns:     -1 or the fixed first char
  */
  static int
- find_firstchar(uschar *code)
+ find_firstchar(const uschar *code, int *options)
  {
  register int c = -1;
- do
+ do {
-   {
+    int d;
-   register int charoffset = 4;
+    const uschar *scode = first_significant_code(code + 3, options,
+      PCRE_CASELESS, TRUE);
-   if ((int)code[3] >= OP_BRA || code[3] == OP_ASSERT)
+    register int op = *scode;
-     {
-     register int d;
+    if (op >= OP_BRA) op = OP_BRA;
-     if ((d = find_firstchar(code+3)) < 0) return -1;
-     if (c < 0) c = d; else if (c != d) return -1;
+    switch(op)
-     }
+      {
+      default:
-   else switch(code[3])
+      return -1;
-     {
-     default:
+      case OP_BRA:
-     return -1;
+      case OP_ASSERT:
+      case OP_ONCE:
-     case OP_EXACT:       /* Fall through */
+      case OP_COND:
-     charoffset++;
+      if ((d = find_firstchar(scode, options)) < 0) return -1;
+      if (c < 0) c = d; else if (c != d) return -1;
-     case OP_CHARS:       /* Fall through */
+      break;
-     charoffset++;
+      case OP_EXACT:       /* Fall through */
+      scode++;
+      case OP_CHARS:       /* Fall through */
+      scode++;
+      case OP_PLUS:
+      case OP_MINPLUS:
+      if (c < 0) c = scode[1]; else if (c != scode[1]) return -1;
+      break;
+      }
-     case OP_PLUS:
+    code += (code[1] << 8) + code[2];
-     case OP_MINPLUS:
+    }
-     if (c < 0) c = code[charoffset]; else if (c != code[charoffset]) return -1;
-     break;
-     }
-   code += (code[1] << 8) + code[2];
-   }
  while (*code == OP_ALT);
  return c;
  }
  /*************************************************
  *        Compile a Regular Expression            *
  *************************************************/
-Line 1510 
 Arguments:
+Line 2250 
 Arguments:
    options      various option bits
    errorptr     pointer to pointer to error text
    erroroffset  ptr offset in pattern where error was detected
+   tables       pointer to character tables or NULL
  Returns:       pointer to compiled data block, or NULL on error,
                 with errorptr and erroroffset set
-Line 1517 
 Returns:       pointer to compiled data
+Line 2258 
 Returns:       pointer to compiled data
  pcre *
  pcre_compile(const char *pattern, int options, const char **errorptr,
-   int *erroroffset)
+   int *erroroffset, const unsigned char *tables)
  {
  real_pcre *re;
- int spaces = 0;
  int length = 3;      /* For initial BRA plus length */
  int runlength;
- int c, size;
+ int c, reqchar, countlits;
  int bracount = 0;
- int brastack[200];
  int top_backref = 0;
+ int branch_extra = 0;
+ int branch_newextra;
  unsigned int brastackptr = 0;
+ size_t size;
  uschar *code;
  const uschar *ptr;
+ compile_data compile_block;
+ int brastack[BRASTACK_SIZE];
+ uschar bralenstack[BRASTACK_SIZE];
  #ifdef DEBUG
  uschar *code_base, *code_end;
-Line 1556 
 if ((options & ~PUBLIC_OPTIONS) != 0)
+Line 2301 
 if ((options & ~PUBLIC_OPTIONS) != 0)
    return NULL;
    }
+ /* Set up pointers to the individual character tables */
+ if (tables == NULL) tables = pcre_default_tables;
+ compile_block.lcc = tables + lcc_offset;
+ compile_block.fcc = tables + fcc_offset;
+ compile_block.cbits = tables + cbits_offset;
+ compile_block.ctypes = tables + ctypes_offset;
+ /* Reflect pattern for debugging output */
  DPRINTF(("------------------------------------------------------------------\n"));
  DPRINTF(("%s\n", pattern));
-Line 1572 
 while ((c = *(++ptr)) != 0)
+Line 2327 
 while ((c = *(++ptr)) != 0)
    int min, max;
    int class_charcount;
-   if ((pcre_ctypes[c] & ctype_space) != 0)
+   if ((options & PCRE_EXTENDED) != 0)
-     {
-     if ((options & PCRE_EXTENDED) != 0) continue;
-     spaces++;
-     }
-   if (c == '#' && (options & PCRE_EXTENDED) != 0)
      {
-     while ((c = *(++ptr)) != 0 && c != '\n');
+     if ((compile_block.ctypes[c] & ctype_space) != 0) continue;
-     continue;
+     if (c == '#')
+       {
+       /* The space before the ; is to avoid a warning on a silly compiler
+       on the Macintosh. */
+       while ((c = *(++ptr)) != 0 && c != '\n') ;
+       continue;
+       }
      }
    switch(c)
-Line 1594 
 while ((c = *(++ptr)) != 0)
+Line 2349 
 while ((c = *(++ptr)) != 0)
      case '\\':
        {
        const uschar *save_ptr = ptr;
-       c = check_escape(&ptr, errorptr, bracount, options, FALSE);
+       c = check_escape(&ptr, errorptr, bracount, options, FALSE, &compile_block);
        if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
        if (c >= 0)
          {
-Line 1614 
 while ((c = *(++ptr)) != 0)
+Line 2369 
 while ((c = *(++ptr)) != 0)
        int refnum = -c - ESC_REF;
        if (refnum > top_backref) top_backref = refnum;
        length++;   /* For single back reference */
-       if (ptr[1] == '{' && is_counted_repeat(ptr+2))
+       if (ptr[1] == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr);
+         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr, &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if ((min == 0 && (max == 1 || max == -1)) ||
            (min == 1 && max == -1))
-Line 1640 
 while ((c = *(++ptr)) != 0)
+Line 2395 
 while ((c = *(++ptr)) != 0)
      or back reference. */
      case '{':
-     if (!is_counted_repeat(ptr+1)) goto NORMAL_CHAR;
+     if (!is_counted_repeat(ptr+1, &compile_block)) goto NORMAL_CHAR;
-     ptr = read_repeat_counts(ptr+1, &min, &max, errorptr);
+     ptr = read_repeat_counts(ptr+1, &min, &max, errorptr, &compile_block);
      if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
      if ((min == 0 && (max == 1 || max == -1)) ||
        (min == 1 && max == -1))
-Line 1655 
 while ((c = *(++ptr)) != 0)
+Line 2410 
 while ((c = *(++ptr)) != 0)
      if (ptr[1] == '?') ptr++;
      continue;
-     /* An alternation contains an offset to the next branch or ket. */
+     /* An alternation contains an offset to the next branch or ket. If any ims
+     options changed in the previous branch(es), and/or if we are in a
+     lookbehind assertion, extra space will be needed at the start of the
+     branch. This is handled by branch_extra. */
      case '|':
-     length += 3;
+     length += 3 + branch_extra;
      continue;
      /* A character class uses 33 characters. Don't worry about character types
-Line 1672 
 while ((c = *(++ptr)) != 0)
+Line 2431 
 while ((c = *(++ptr)) != 0)
        {
        if (*ptr == '\\')
          {
-         int ch = check_escape(&ptr, errorptr, bracount, options, TRUE);
+         int ch = check_escape(&ptr, errorptr, bracount, options, TRUE,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if (-ch == ESC_b) class_charcount++; else class_charcount = 10;
          }
-Line 1689 
 while ((c = *(++ptr)) != 0)
+Line 2449 
 while ((c = *(++ptr)) != 0)
        /* A repeat needs either 1 or 5 bytes. */
-       if (*ptr != 0 && ptr[1] == '{' && is_counted_repeat(ptr+2))
+       if (*ptr != 0 && ptr[1] == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr);
+         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr, &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if ((min == 0 && (max == 1 || max == -1)) ||
            (min == 1 && max == -1))
-Line 1705 
 while ((c = *(++ptr)) != 0)
+Line 2465 
 while ((c = *(++ptr)) != 0)
      /* Brackets may be genuine groups or special things */
      case '(':
+     branch_newextra = 0;
      /* Handle special forms of bracket, which all start (? */
-     if (ptr[1] == '?') switch (c = ptr[2])
+     if (ptr[1] == '?')
        {
-       /* Skip over comments entirely */
+       int set, unset;
-       case '#':
+       int *optset;
-       ptr += 3;
-       while (*ptr != 0 && *ptr != ')') ptr++;
-       if (*ptr == 0)
-         {
-         *errorptr = ERR18;
-         goto PCRE_ERROR_RETURN;
-         }
-       continue;
-       /* Non-referencing groups and lookaheads just move the pointer on, and
+       switch (c = ptr[2])
-       then behave like a non-special bracket, except that they don't increment
+         {
-       the count of extracting brackets. */
+         /* Skip over comments entirely */
+         case '#':
-       case ':':
+         ptr += 3;
-       case '=':
+         while (*ptr != 0 && *ptr != ')') ptr++;
-       case '!':
+         if (*ptr == 0)
-       ptr += 2;
+           {
-       break;
+           *errorptr = ERR18;
+           goto PCRE_ERROR_RETURN;
+           }
+         continue;
-       /* Ditto for the "once only" bracket, allowed only if the extra bit
+         /* Non-referencing groups and lookaheads just move the pointer on, and
-       is set. */
+         then behave like a non-special bracket, except that they don't increment
+         the count of extracting brackets. Ditto for the "once only" bracket,
+         which is in Perl from version 5.005. */
-       case '>':
+         case ':':
-       if ((options & PCRE_EXTRA) != 0)
+         case '=':
-         {
+         case '!':
+         case '>':
          ptr += 2;
          break;
-         }
-       /* Else fall thourh */
-       /* Else loop setting valid options until ) is met. Anything else is an
+         /* A recursive call to the regex is an extension, to provide the
-       error. */
+         facility which can be obtained by $(?p{perl-code}) in Perl 5.6. */
-       default:
+         case 'R':
-       ptr += 2;
+         if (ptr[3] != ')')
-       for (;; ptr++)
-         {
-         if ((c = *ptr) == 'i')
            {
-           options |= PCRE_CASELESS;
+           *errorptr = ERR29;
-           continue;
+           goto PCRE_ERROR_RETURN;
            }
-         else if ((c = *ptr) == 'm')
+         ptr += 3;
+         length += 1;
+         break;
+         /* Lookbehinds are in Perl from version 5.005 */
+         case '<':
+         if (ptr[3] == '=' || ptr[3] == '!')
            {
-           options |= PCRE_MULTILINE;
+           ptr += 3;
-           continue;
+           branch_newextra = 3;
+           length += 3;         /* For the first branch */
+           break;
            }
-         else if (c == 's')
+         *errorptr = ERR24;
+         goto PCRE_ERROR_RETURN;
+         /* Conditionals are in Perl from version 5.005. The bracket must either
+         be followed by a number (for bracket reference) or by an assertion
+         group. */
+         case '(':
+         if ((compile_block.ctypes[ptr[3]] & ctype_digit) != 0)
+           {
+           ptr += 4;
+           length += 2;
+           while ((compile_block.ctypes[*ptr] & ctype_digit) != 0) ptr++;
+           if (*ptr != ')')
+             {
+             *errorptr = ERR26;
+             goto PCRE_ERROR_RETURN;
+             }
+           }
+         else   /* An assertion must follow */
            {
-           options |= PCRE_DOTALL;
+           ptr++;   /* Can treat like ':' as far as spacing is concerned */
-           continue;
+           if (ptr[2] != '?' ||
+              (ptr[3] != '=' && ptr[3] != '!' && ptr[3] != '<') )
+             {
+             ptr += 2;    /* To get right offset in message */
+             *errorptr = ERR28;
+             goto PCRE_ERROR_RETURN;
+             }
+           }
+         break;
+         /* Else loop checking valid options until ) is met. Anything else is an
+         error. If we are without any brackets, i.e. at top level, the settings
+         act as if specified in the options, so massage the options immediately.
+         This is for backward compatibility with Perl 5.004. */
+         default:
+         set = unset = 0;
+         optset = &set;
+         ptr += 2;
+         for (;; ptr++)
+           {
+           c = *ptr;
+           switch (c)
+             {
+             case 'i':
+             *optset |= PCRE_CASELESS;
+             continue;
+             case 'm':
+             *optset |= PCRE_MULTILINE;
+             continue;
+             case 's':
+             *optset |= PCRE_DOTALL;
+             continue;
+             case 'x':
+             *optset |= PCRE_EXTENDED;
+             continue;
+             case 'X':
+             *optset |= PCRE_EXTRA;
+             continue;
+             case 'U':
+             *optset |= PCRE_UNGREEDY;
+             continue;
+             case '-':
+             optset = &unset;
+             continue;
+             /* A termination by ')' indicates an options-setting-only item;
+             this is global at top level; otherwise nothing is done here and
+             it is handled during the compiling process on a per-bracket-group
+             basis. */
+             case ')':
+             if (brastackptr == 0)
+               {
+               options = (options | set) & (~unset);
+               set = unset = 0;     /* To save length */
+               }
+             /* Fall through */
+             /* A termination by ':' indicates the start of a nested group with
+             the given options set. This is again handled at compile time, but
+             we must allow for compiled space if any of the ims options are
+             set. We also have to allow for resetting space at the end of
+             the group, which is why 4 is added to the length and not just 2.
+             If there are several changes of options within the same group, this
+             will lead to an over-estimate on the length, but this shouldn't
+             matter very much. We also have to allow for resetting options at
+             the start of any alternations, which we do by setting
+             branch_newextra to 2. Finally, we record whether the case-dependent
+             flag ever changes within the regex. This is used by the "required
+             character" code. */
+             case ':':
+             if (((set|unset) & PCRE_IMS) != 0)
+               {
+               length += 4;
+               branch_newextra = 2;
+               if (((set|unset) & PCRE_CASELESS) != 0) options |= PCRE_ICHANGED;
+               }
+             goto END_OPTIONS;
+             /* Unrecognized option character */
+             default:
+             *errorptr = ERR12;
+             goto PCRE_ERROR_RETURN;
+             }
            }
-         else if (c == 'x')
+         /* If we hit a closing bracket, that's it - this is a freestanding
+         option-setting. We need to ensure that branch_extra is updated if
+         necessary. The only values branch_newextra can have here are 0 or 2.
+         If the value is 2, then branch_extra must either be 2 or 5, depending
+         on whether this is a lookbehind group or not. */
+         END_OPTIONS:
+         if (c == ')')
            {
-           options |= PCRE_EXTENDED;
+           if (branch_newextra == 2 && (branch_extra == 0 || branch_extra == 3))
-           length -= spaces;          /* Already counted spaces */
+             branch_extra += branch_newextra;
            continue;
            }
-         else if (c == ')') break;
-         *errorptr = ERR12;
+         /* If options were terminated by ':' control comes here. Fall through
-         goto PCRE_ERROR_RETURN;
+         to handle the group below. */
          }
-       continue;                      /* End of this bracket handling */
        }
      /* Extracting brackets must be counted so we can process escapes in a
-Line 1784 
 while ((c = *(++ptr)) != 0)
+Line 2665 
 while ((c = *(++ptr)) != 0)
      else bracount++;
      /* Non-special forms of bracket. Save length for computing whole length
-     at end if there's a repeat that requires duplication of the group. */
+     at end if there's a repeat that requires duplication of the group. Also
+     save the current value of branch_extra, and start the new group with
+     the new value. If non-zero, this will either be 2 for a (?imsx: group, or 3
+     for a lookbehind assertion. */
      if (brastackptr >= sizeof(brastack)/sizeof(int))
        {
-Line 1792 
 while ((c = *(++ptr)) != 0)
+Line 2676 
 while ((c = *(++ptr)) != 0)
        goto PCRE_ERROR_RETURN;
        }
+     bralenstack[brastackptr] = branch_extra;
+     branch_extra = branch_newextra;
      brastack[brastackptr++] = length;
      length += 3;
      continue;
-Line 1799 
 while ((c = *(++ptr)) != 0)
+Line 2686 
 while ((c = *(++ptr)) != 0)
      /* Handle ket. Look for subsequent max/min; for certain sets of values we
      have to replicate this bracket up to that many times. If brastackptr is
 this is an unmatched bracket which will generate an error, but take care
-     not to try to access brastack[-1]. */
+     not to try to access brastack[-1] when computing the length and restoring
+     the branch_extra value. */
      case ')':
      length += 3;
        {
        int minval = 1;
        int maxval = 1;
-       int duplength = (brastackptr > 0)? length - brastack[--brastackptr] : 0;
+       int duplength;
+       if (brastackptr > 0)
+         {
+         duplength = length - brastack[--brastackptr];
+         branch_extra = bralenstack[brastackptr];
+         }
+       else duplength = 0;
        /* Leave ptr at the final char; for read_repeat_counts this happens
        automatically; for the others we need an increment. */
-       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2))
+       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr);
+         ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          }
        else if (c == '*') { minval = 0; maxval = -1; ptr++; }
        else if (c == '+') { maxval = -1; ptr++; }
        else if (c == '?') { minval = 0; ptr++; }
-       /* If there is a minimum > 1 we have to replicate up to minval-1 times;
+       /* If the minimum is zero, we have to allow for an OP_BRAZERO before the
-       if there is a limited maximum we have to replicate up to maxval-1 times
+       group, and if the maximum is greater than zero, we have to replicate
-       and allow for a BRAZERO item before each optional copy, as we also have
+       maxval-1 times; each replication acquires an OP_BRAZERO plus a nesting
-       to do before the first copy if the minimum is zero. */
+       bracket set - hence the 7. */
-       if (minval == 0) length++;
+       if (minval == 0)
-         else if (minval > 1) length += (minval - 1) * duplength;
+         {
-       if (maxval > minval) length += (maxval - minval) * (duplength + 1);
+         length++;
+         if (maxval > 0) length += (maxval - 1) * (duplength + 7);
+         }
+       /* When the minimum is greater than zero, 1 we have to replicate up to
+       minval-1 times, with no additions required in the copies. Then, if
+       there is a limited maximum we have to replicate up to maxval-1 times
+       allowing for a BRAZERO item before each optional copy and nesting
+       brackets for all but one of the optional copies. */
+       else
+         {
+         length += (minval - 1) * duplength;
+         if (maxval > minval)   /* Need this test as maxval=-1 means no limit */
+           length += (maxval - minval) * (duplength + 7) - 6;
+         }
        }
      continue;
-Line 1842 
 while ((c = *(++ptr)) != 0)
+Line 2753 
 while ((c = *(++ptr)) != 0)
      runlength = 0;
      do
        {
-       if ((pcre_ctypes[c] & ctype_space) != 0)
+       if ((options & PCRE_EXTENDED) != 0)
-         {
-         if ((options & PCRE_EXTENDED) != 0) continue;
-         spaces++;
-         }
-       if (c == '#' && (options & PCRE_EXTENDED) != 0)
          {
-         while ((c = *(++ptr)) != 0 && c != '\n');
+         if ((compile_block.ctypes[c] & ctype_space) != 0) continue;
-         continue;
+         if (c == '#')
+           {
+           /* The space before the ; is to avoid a warning on a silly compiler
+           on the Macintosh. */
+           while ((c = *(++ptr)) != 0 && c != '\n') ;
+           continue;
+           }
          }
        /* Backslash may introduce a data char or a metacharacter; stop the
-Line 1860 
 while ((c = *(++ptr)) != 0)
+Line 2771 
 while ((c = *(++ptr)) != 0)
        if (c == '\\')
          {
          const uschar *saveptr = ptr;
-         c = check_escape(&ptr, errorptr, bracount, options, FALSE);
+         c = check_escape(&ptr, errorptr, bracount, options, FALSE,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if (c < 0) { ptr = saveptr; break; }
          }
-Line 1872 
 while ((c = *(++ptr)) != 0)
+Line 2784 
 while ((c = *(++ptr)) != 0)
      /* This "while" is the end of the "do" above. */
-     while (runlength < 255 && (pcre_ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     while (runlength < 255 &&
+       (compile_block.ctypes[c = *(++ptr)] & ctype_meta) == 0);
      ptr--;
      length += runlength;
-Line 1903 
 if (re == NULL)
+Line 2816 
 if (re == NULL)
    return NULL;
    }
- /* Put in the magic number and the options. */
+ /* Put in the magic number, and save the size, options, and table pointer */
  re->magic_number = MAGIC_NUMBER;
+ re->size = size;
  re->options = options;
+ re->tables = tables;
  /* Set up a starting, non-extracting bracket, then compile the expression. On
  error, *errorptr will be set non-NULL, so we don't need to look at the result
-Line 1916 
 ptr = (const uschar *)pattern;
+Line 2831 
 ptr = (const uschar *)pattern;
  code = re->code;
  *code = OP_BRA;
  bracount = 0;
- (void)compile_regex(options, &bracount, &code, &ptr, errorptr);
+ (void)compile_regex(options, -1, &bracount, &code, &ptr, errorptr, FALSE, -1,
+   &reqchar, &countlits, &compile_block);
  re->top_bracket = bracount;
  re->top_backref = top_backref;
-Line 1933 
 if debugging, leave the test till after
+Line 2849 
 if debugging, leave the test till after
  if (code - re->code > length) *errorptr = ERR23;
  #endif
+ /* Give an error if there's back reference to a non-existent capturing
+ subpattern. */
+ if (top_backref > re->top_bracket) *errorptr = ERR15;
  /* Failed to compile */
  if (*errorptr != NULL)
-Line 1943 
 if (*errorptr != NULL)
+Line 2864 
 if (*errorptr != NULL)
    return NULL;
    }
- /* If the anchored option was not passed, set flag if we can determine that it
+ /* If the anchored option was not passed, set flag if we can determine that the
- is anchored by virtue of ^ characters or \A or anything else. Otherwise, see if
+ pattern is anchored by virtue of ^ characters or \A or anything else (such as
- we can determine what the first character has to be, because that speeds up
+ starting with .* when DOTALL is set).
- unanchored matches no end. In the case of multiline matches, an alternative is
- to set the PCRE_STARTLINE flag if all branches start with ^. */
+ Otherwise, see if we can determine what the first character has to be, because
+ that speeds up unanchored matches no end. If not, see if we can set the
+ PCRE_STARTLINE flag. This is helpful for multiline matches when all branches
+ start with ^. and also when all branches start with .* for non-DOTALL matches.
+ */
  if ((options & PCRE_ANCHORED) == 0)
    {
-   if (is_anchored(re->code, (options & PCRE_MULTILINE) != 0))
+   int temp_options = options;
+   if (is_anchored(re->code, &temp_options))
      re->options |= PCRE_ANCHORED;
    else
      {
-     int ch = find_firstchar(re->code);
+     int ch = find_firstchar(re->code, &temp_options);
      if (ch >= 0)
        {
        re->first_char = ch;
-Line 1966 
 if ((options & PCRE_ANCHORED) == 0)
+Line 2892 
 if ((options & PCRE_ANCHORED) == 0)
      }
    }
+ /* Save the last required character if there are at least two literal
+ characters on all paths, or if there is no first character setting. */
+ if (reqchar >= 0 && (countlits > 1 || (re->options & PCRE_FIRSTSET) == 0))
+   {
+   re->req_char = reqchar;
+   re->options |= PCRE_REQCHSET;
+   }
  /* Print out the compiled data for debugging */
  #ifdef DEBUG
- printf("Length = %d top_bracket = %d top_backref=%d\n",
+ printf("Length = %d top_bracket = %d top_backref = %d\n",
    length, re->top_bracket, re->top_backref);
  if (re->options != 0)
    {
-   printf("%s%s%s%s%s%s%s\n",
+   printf("%s%s%s%s%s%s%s%s%s\n",
      ((re->options & PCRE_ANCHORED) != 0)? "anchored " : "",
      ((re->options & PCRE_CASELESS) != 0)? "caseless " : "",
+     ((re->options & PCRE_ICHANGED) != 0)? "case state changed " : "",
      ((re->options & PCRE_EXTENDED) != 0)? "extended " : "",
      ((re->options & PCRE_MULTILINE) != 0)? "multiline " : "",
      ((re->options & PCRE_DOTALL) != 0)? "dotall " : "",
      ((re->options & PCRE_DOLLAR_ENDONLY) != 0)? "endonly " : "",
-     ((re->options & PCRE_EXTRA) != 0)? "extra " : "");
+     ((re->options & PCRE_EXTRA) != 0)? "extra " : "",
+     ((re->options & PCRE_UNGREEDY) != 0)? "ungreedy " : "");
    }
  if ((re->options & PCRE_FIRSTSET) != 0)
-Line 1991 
 if ((re->options & PCRE_FIRSTSET) != 0)
+Line 2928 
 if ((re->options & PCRE_FIRSTSET) != 0)
      else printf("First char = \\x%02x\n", re->first_char);
    }
+ if ((re->options & PCRE_REQCHSET) != 0)
+   {
+   if (isprint(re->req_char)) printf("Req char = %c\n", re->req_char);
+     else printf("Req char = \\x%02x\n", re->req_char);
+   }
  code_end = code;
  code_base = code = re->code;
-Line 2008 
 while (code < code_end)
+Line 2951 
 while (code < code_end)
    else switch(*code)
      {
+     case OP_OPT:
+     printf(" %.2x %s", code[1], OP_names[*code]);
+     code++;
+     break;
+     case OP_COND:
+     printf("%3d Cond", (code[1] << 8) + code[2]);
+     code += 2;
+     break;
+     case OP_CREF:
+     printf(" %.2d %s", code[1], OP_names[*code]);
+     code++;
+     break;
      case OP_CHARS:
      charlength = *(++code);
      printf("%3d ", charlength);
-Line 2021 
 while (code < code_end)
+Line 2979 
 while (code < code_end)
      case OP_KET:
      case OP_ASSERT:
      case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
      case OP_ONCE:
      printf("%3d %s", (code[1] << 8) + code[2], OP_names[*code]);
      code += 2;
      break;
+     case OP_REVERSE:
+     printf("%3d %s", (code[1] << 8) + code[2], OP_names[*code]);
+     code += 2;
+     break;
      case OP_STAR:
      case OP_MINSTAR:
      case OP_PLUS:
-Line 2099 
 while (code < code_end)
+Line 3064 
 while (code < code_end)
      goto CLASS_REF_REPEAT;
      case OP_CLASS:
-     case OP_NEGCLASS:
        {
        int i, min, max;
+       code++;
-       if (*code++ == OP_CLASS) printf("    [");
+       printf("    [");
-         else printf("   ^[");
        for (i = 0; i < 256; i++)
          {
-Line 2164 
 while (code < code_end)
+Line 3127 
 while (code < code_end)
      }
    code++;
    printf("\n");
    }
  printf("------------------------------------------------------------------\n");
- /* This check is done here in the debugging case so that the code that
- was compiled can be seen. */
- if (code - re->code > length)
-   {
-   *errorptr = ERR23;
-   (pcre_free)(re);
-   *erroroffset = ptr - (uschar *)pattern;
-   return NULL;
-   }
- #endif
- return (pcre *)re;
- }
- /*************************************************
- *        Match a character type                  *
- *************************************************/
- /* Not used in all the places it might be as it's sometimes faster
- to put the code inline.
- Arguments:
-   type        the character type
-   c           the character
-   dotall      the dotall flag
- Returns:      TRUE if character is of the type
- */
- static BOOL
- match_type(int type, int c, BOOL dotall)
- {
- #ifdef DEBUG
+ /* This check is done here in the debugging case so that the code that
- if (isprint(c)) printf("matching subject %c against ", c);
+ was compiled can be seen. */
-   else printf("matching subject \\x%02x against ", c);
- printf("%s\n", OP_names[type]);
- #endif
- switch(type)
+ if (code - re->code > length)
    {
-   case OP_ANY:            return dotall || c != '\n';
+   *errorptr = ERR23;
-   case OP_NOT_DIGIT:      return (pcre_ctypes[c] & ctype_digit) == 0;
+   (pcre_free)(re);
-   case OP_DIGIT:          return (pcre_ctypes[c] & ctype_digit) != 0;
+   *erroroffset = ptr - (uschar *)pattern;
-   case OP_NOT_WHITESPACE: return (pcre_ctypes[c] & ctype_space) == 0;
+   return NULL;
-   case OP_WHITESPACE:     return (pcre_ctypes[c] & ctype_space) != 0;
-   case OP_NOT_WORDCHAR:   return (pcre_ctypes[c] & ctype_word) == 0;
-   case OP_WORDCHAR:       return (pcre_ctypes[c] & ctype_word) != 0;
    }
- return FALSE;
+ #endif
+ return (pcre *)re;
  }
-Line 2229 
 return FALSE;
+Line 3152 
 return FALSE;
  *          Match a back-reference                *
  *************************************************/
- /* If a back reference hasn't been set, the match fails.
+ /* If a back reference hasn't been set, the length that is passed is greater
+ than the number of characters left in the string, so the match fails.
  Arguments:
-   number      reference number
+   offset      index into the offset vector
    eptr        points into the subject
    length      length to be matched
    md          points to match data block
+   ims         the ims flags
  Returns:      TRUE if matched
  */
  static BOOL
- match_ref(int number, register const uschar *eptr, int length, match_data *md)
+ match_ref(int offset, register const uschar *eptr, int length, match_data *md,
+   unsigned long int ims)
  {
- const uschar *p = md->start_subject + md->offset_vector[number];
+ const uschar *p = md->start_subject + md->offset_vector[offset];
  #ifdef DEBUG
  if (eptr >= md->end_subject)
-Line 2260 
 printf("\n");
+Line 3186 
 printf("\n");
  /* Always fail if not enough characters left */
- if (length > md->end_subject - p) return FALSE;
+ if (length > md->end_subject - eptr) return FALSE;
  /* Separate the caselesss case for speed */
- if (md->caseless)
+ if ((ims & PCRE_CASELESS) != 0)
-   { while (length-- > 0) if (pcre_lcc[*p++] != pcre_lcc[*eptr++]) return FALSE; }
+   {
+   while (length-- > 0)
+     if (md->lcc[*p++] != md->lcc[*eptr++]) return FALSE;
+   }
  else
    { while (length-- > 0) if (*p++ != *eptr++) return FALSE; }
-Line 2278 
 return TRUE;
+Line 3207 
 return TRUE;
  *         Match from current position            *
  *************************************************/
- /* On entry ecode points to the first opcode, and eptr to the first character.
+ /* On entry ecode points to the first opcode, and eptr to the first character
+ in the subject string, while eptrb holds the value of eptr at the start of the
+ last bracketed group - used for breaking infinite loops matching zero-length
+ strings.
  Arguments:
     eptr        pointer in subject
     ecode       position in code
     offset_top  current top pointer
     md          pointer to "static" info for the match
+    ims         current /i, /m, and /s options
+    eptrb       pointer to chain of blocks containing eptr at start of
+                  brackets - for testing for empty matches
+    flags       can contain
+                  match_condassert - this is an assertion condition
+                  match_isgroup - this is the start of a bracketed group
  Returns:       TRUE if matched
  */
  static BOOL
- match(register const uschar *eptr, register const uschar *ecode, int offset_top,
+ match(register const uschar *eptr, register const uschar *ecode,
-   match_data *md)
+   int offset_top, match_data *md, unsigned long int ims, eptrblock *eptrb,
+   int flags)
  {
+ unsigned long int original_ims = ims;   /* Save for resetting on ')' */
+ eptrblock newptrb;
+ /* At the start of a bracketed group, add the current subject pointer to the
+ stack of such pointers, to be re-instated at the end of the group when we hit
+ the closing ket. When match() is called in other circumstances, we don't add to
+ the stack. */
+ if ((flags & match_isgroup) != 0)
+   {
+   newptrb.prev = eptrb;
+   newptrb.saved_eptr = eptr;
+   eptrb = &newptrb;
+   }
+ /* Now start processing the operations. */
  for (;;)
    {
+   int op = (int)*ecode;
    int min, max, ctype;
    register int i;
    register int c;
    BOOL minimize = FALSE;
-   /* Opening bracket. Check the alternative branches in turn, failing if none
+   /* Opening capturing bracket. If there is space in the offset vector, save
-   match. We have to set the start offset if required and there is space
+   the current subject position in the working slot at the top of the vector. We
-   in the offset vector so that it is available for subsequent back references
+   mustn't change the current values of the data slot, because they may be set
-   if the bracket matches. However, if the bracket fails, we must put back the
+   from a previous iteration of this group, and be referred to by a reference
-   previous value of both offsets in case they were set by a previous copy of
+   inside the group.
-   the same bracket. Don't worry about setting the flag for the error case here;
-   that is handled in the code for KET. */
+   If the bracket fails to match, we need to restore this value and also the
+   values of the final offsets, in case they were set by a previous iteration of
+   the same bracket.
+   If there isn't enough space in the offset vector, treat this as if it were a
+   non-capturing bracket. Don't worry about setting the flag for the error case
+   here; that is handled in the code for KET. */
-   if ((int)*ecode >= OP_BRA)
+   if (op > OP_BRA)
      {
-     int number = (*ecode - OP_BRA) << 1;
+     int number = op - OP_BRA;
-     int save_offset1 = 0, save_offset2 = 0;
+     int offset = number << 1;
-     DPRINTF(("start bracket %d\n", number/2));
+ #ifdef DEBUG
+     printf("start bracket %d subject=", number);
+     pchars(eptr, 16, TRUE, md);
+     printf("\n");
+ #endif
-     if (number > 0 && number < md->offset_end)
+     if (offset < md->offset_max)
        {
-       save_offset1 = md->offset_vector[number];
+       int save_offset1 = md->offset_vector[offset];
-       save_offset2 = md->offset_vector[number+1];
+       int save_offset2 = md->offset_vector[offset+1];
-       md->offset_vector[number] = eptr - md->start_subject;
+       int save_offset3 = md->offset_vector[md->offset_end - number];
+       DPRINTF(("saving %d %d %d\n", save_offset1, save_offset2, save_offset3));
+       md->offset_vector[md->offset_end - number] = eptr - md->start_subject;
+       do
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+           return TRUE;
+         ecode += (ecode[1] << 8) + ecode[2];
+         }
+       while (*ecode == OP_ALT);
-       DPRINTF(("saving %d %d\n", save_offset1, save_offset2));
+       DPRINTF(("bracket %d failed\n", number));
+       md->offset_vector[offset] = save_offset1;
+       md->offset_vector[offset+1] = save_offset2;
+       md->offset_vector[md->offset_end - number] = save_offset3;
+       return FALSE;
        }
-     /* Recurse for all the alternatives. */
+     /* Insufficient room for saving captured contents */
+     else op = OP_BRA;
+     }
+   /* Other types of node can be handled by a switch */
+   switch(op)
+     {
+     case OP_BRA:     /* Non-capturing bracket: optimized */
+     DPRINTF(("start bracket 0\n"));
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) return TRUE;
+       if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+         return TRUE;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
+     DPRINTF(("bracket 0 failed\n"));
+     return FALSE;
+     /* Conditional group: compilation checked that there are no more than
+     two branches. If the condition is false, skipping the first branch takes us
+     past the end if there is only one branch, but that's OK because that is
+     exactly what going to the ket would do. */
+     case OP_COND:
+     if (ecode[3] == OP_CREF)         /* Condition is extraction test */
+       {
+       int offset = ecode[4] << 1;    /* Doubled reference number */
+       return match(eptr,
+         ecode + ((offset < offset_top && md->offset_vector[offset] >= 0)?
+: 3 + (ecode[1] << 8) + ecode[2]),
+         offset_top, md, ims, eptrb, match_isgroup);
+       }
-     DPRINTF(("bracket %d failed\n", number/2));
+     /* The condition is an assertion. Call match() to evaluate it - setting
+     the final argument TRUE causes it to stop at the end of an assertion. */
-     if (number > 0 && number < md->offset_end)
+     else
        {
-       md->offset_vector[number] = save_offset1;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL,
-       md->offset_vector[number+1] = save_offset2;
+           match_condassert | match_isgroup))
+         {
+         ecode += 3 + (ecode[4] << 8) + ecode[5];
+         while (*ecode == OP_ALT) ecode += (ecode[1] << 8) + ecode[2];
+         }
+       else ecode += (ecode[1] << 8) + ecode[2];
+       return match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup);
        }
+     /* Control never reaches here */
-     return FALSE;
+     /* Skip over conditional reference data if encountered (should not be) */
-     }
-   /* Other types of node can be handled by a switch */
+     case OP_CREF:
+     ecode += 2;
+     break;
+     /* End of the pattern. If PCRE_NOTEMPTY is set, fail if we have matched
+     an empty string - recursion will then try other alternatives, if any. */
-   switch(*ecode)
-     {
      case OP_END:
+     if (md->notempty && eptr == md->start_match) return FALSE;
      md->end_match_ptr = eptr;          /* Record where we ended */
      md->end_offset_top = offset_top;   /* and how many extracts were taken */
      return TRUE;
-     /* The equivalent of Prolog's "cut" - if the rest doesn't match, the
+     /* Change option settings */
-     whole thing doesn't match, so we have to get out via a longjmp(). */
-     case OP_CUT:
+     case OP_OPT:
-     if (match(eptr, ecode+1, offset_top, md)) return TRUE;
+     ims = ecode[1];
-     longjmp(md->fail_env, 1);
+     ecode += 2;
+     DPRINTF(("ims set to %02lx\n", ims));
+     break;
      /* Assertion brackets. Check the alternative branches in turn - the
      matching won't pass the KET for an assertion. If any one branch matches,
-     the assertion is true. */
+     the assertion is true. Lookbehind assertions have an OP_REVERSE item at the
+     start of each branch to move the current point backwards, so the code at
+     this level is identical to the lookahead case. */
      case OP_ASSERT:
+     case OP_ASSERTBACK:
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) break;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup)) break;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
      if (*ecode == OP_KET) return FALSE;
+     /* If checking an assertion for a condition, return TRUE. */
+     if ((flags & match_condassert) != 0) return TRUE;
      /* Continue from after the assertion, updating the offsets high water
      mark, since extracts may have been taken during the assertion. */
-Line 2384 
 for (;;)
+Line 3413 
 for (;;)
      /* Negative assertion: all branches must fail to match */
      case OP_ASSERT_NOT:
+     case OP_ASSERTBACK_NOT:
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) return FALSE;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup))
+         return FALSE;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
+     if ((flags & match_condassert) != 0) return TRUE;
      ecode += 3;
      continue;
+     /* Move the subject pointer back. This occurs only at the start of
+     each branch of a lookbehind assertion. If we are too close to the start to
+     move back, this match function fails. */
+     case OP_REVERSE:
+     eptr -= (ecode[1] << 8) + ecode[2];
+     if (eptr < md->start_subject) return FALSE;
+     ecode += 3;
+     break;
+     /* Recursion matches the current regex, nested. If there are any capturing
+     brackets started but not finished, we have to save their starting points
+     and reinstate them after the recursion. However, we don't know how many
+     such there are (offset_top records the completed total) so we just have
+     to save all the potential data. There may be up to 99 such values, which
+     is a bit large to put on the stack, but using malloc for small numbers
+     seems expensive. As a compromise, the stack is used when there are fewer
+     than 16 values to store; otherwise malloc is used. A problem is what to do
+     if the malloc fails ... there is no way of returning to the top level with
+     an error. Save the top 15 values on the stack, and accept that the rest
+     may be wrong. */
+     case OP_RECURSE:
+       {
+       BOOL rc;
+       int *save;
+       int stacksave[15];
+       c = md->offset_max;
+       if (c < 16) save = stacksave; else
+         {
+         save = (int *)(pcre_malloc)((c+1) * sizeof(int));
+         if (save == NULL)
+           {
+           save = stacksave;
+           c = 15;
+           }
+         }
+       for (i = 1; i <= c; i++)
+         save[i] = md->offset_vector[md->offset_end - i];
+       rc = match(eptr, md->start_pattern, offset_top, md, ims, eptrb,
+         match_isgroup);
+       for (i = 1; i <= c; i++)
+         md->offset_vector[md->offset_end - i] = save[i];
+       if (save != stacksave) (pcre_free)(save);
+       if (!rc) return FALSE;
+       /* In case the recursion has set more capturing values, save the final
+       number, then move along the subject till after the recursive match,
+       and advance one byte in the pattern code. */
+       offset_top = md->end_offset_top;
+       eptr = md->end_match_ptr;
+       ecode++;
+       }
+     break;
      /* "Once" brackets are like assertion brackets except that after a match,
      the point in the subject string is not moved back. Thus there can never be
      a move back into the brackets. Check the alternative branches in turn - the
      matching won't pass the KET for this kind of subpattern. If any one branch
-     matches, we carry on, leaving the subject pointer. */
+     matches, we carry on as at the end of a normal bracket, leaving the subject
+     pointer. */
      case OP_ONCE:
-     do
        {
-       if (match(eptr, ecode+3, offset_top, md)) break;
+       const uschar *prev = ecode;
-       ecode += (ecode[1] << 8) + ecode[2];
+       const uschar *saved_eptr = eptr;
-       }
-     while (*ecode == OP_ALT);
-     if (*ecode == OP_KET) return FALSE;
-     /* Continue as from after the assertion, updating the offsets high water
+       do
-     mark, since extracts may have been taken. */
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+           break;
+         ecode += (ecode[1] << 8) + ecode[2];
+         }
+       while (*ecode == OP_ALT);
-     do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+       /* If hit the end of the group (which could be repeated), fail */
-     ecode += 3;
-     offset_top = md->end_offset_top;
+       if (*ecode != OP_ONCE && *ecode != OP_ALT) return FALSE;
-     eptr = md->end_match_ptr;
-     continue;
+       /* Continue as from after the assertion, updating the offsets high water
+       mark, since extracts may have been taken. */
+       do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+       offset_top = md->end_offset_top;
+       eptr = md->end_match_ptr;
+       /* For a non-repeating ket, just continue at this level. This also
+       happens for a repeating ket if no characters were matched in the group.
+       This is the forcible breaking of infinite loops as implemented in Perl
+.005. If there is an options reset, it will get obeyed in the normal
+       course of events. */
+       if (*ecode == OP_KET || eptr == saved_eptr)
+         {
+         ecode += 3;
+         break;
+         }
+       /* The repeating kets try the rest of the pattern or restart from the
+       preceding bracket, in the appropriate order. We need to reset any options
+       that changed within the bracket before re-running it, so check the next
+       opcode. */
+       if (ecode[3] == OP_OPT)
+         {
+         ims = (ims & ~PCRE_IMS) | ecode[4];
+         DPRINTF(("ims set to %02lx at group repeat\n", ims));
+         }
+       if (*ecode == OP_KETRMIN)
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, 0) ||
+             match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup))
+               return TRUE;
+         }
+       else  /* OP_KETRMAX */
+         {
+         if (match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup) ||
+             match(eptr, ecode+3, offset_top, md, ims, eptrb, 0)) return TRUE;
+         }
+       }
+     return FALSE;
      /* An alternation is the end of a branch; scan along to find the end of the
      bracketed group and go to there. */
-Line 2433 
 for (;;)
+Line 3571 
 for (;;)
      case OP_BRAZERO:
        {
        const uschar *next = ecode+1;
-       if (match(eptr, next, offset_top, md)) return TRUE;
+       if (match(eptr, next, offset_top, md, ims, eptrb, match_isgroup))
+         return TRUE;
        do next += (next[1] << 8) + next[2]; while (*next == OP_ALT);
        ecode = next + 3;
        }
-Line 2443 
 for (;;)
+Line 3582 
 for (;;)
        {
        const uschar *next = ecode+1;
        do next += (next[1] << 8) + next[2]; while (*next == OP_ALT);
-       if (match(eptr, next+3, offset_top, md)) return TRUE;
+       if (match(eptr, next+3, offset_top, md, ims, eptrb, match_isgroup))
+         return TRUE;
        ecode++;
        }
-     break;;
+     break;
      /* End of a group, repeated or non-repeating. If we are at the end of
      an assertion "group", stop matching and return TRUE, but record the
-     current high water mark for use by positive assertions. */
+     current high water mark for use by positive assertions. Do this also
+     for the "once" (not-backup up) groups. */
      case OP_KET:
      case OP_KETRMIN:
      case OP_KETRMAX:
        {
-       int number;
        const uschar *prev = ecode - (ecode[1] << 8) - ecode[2];
+       const uschar *saved_eptr = eptrb->saved_eptr;
-       if (*prev == OP_ASSERT || *prev == OP_ASSERT_NOT || *prev == OP_ONCE)
+       eptrb = eptrb->prev;    /* Back up the stack of bracket start pointers */
+       if (*prev == OP_ASSERT || *prev == OP_ASSERT_NOT ||
+           *prev == OP_ASSERTBACK || *prev == OP_ASSERTBACK_NOT ||
+           *prev == OP_ONCE)
          {
          md->end_match_ptr = eptr;      /* For ONCE */
          md->end_offset_top = offset_top;
          return TRUE;
          }
-       /* In all other cases we have to check the group number back at the
+       /* In all other cases except a conditional group we have to check the
-       start and if necessary complete handling an extraction by setting the
+       group number back at the start and if necessary complete handling an
-       final offset and bumping the high water mark. */
+       extraction by setting the offsets and bumping the high water mark. */
-       number = (*prev - OP_BRA) << 1;
+       if (*prev != OP_COND)
+         {
+         int number = *prev - OP_BRA;
+         int offset = number << 1;
-       DPRINTF(("end bracket %d\n", number/2));
+ #ifdef DEBUG
+         printf("end bracket %d", number);
+         printf("\n");
+ #endif
-       if (number > 0)
+         if (number > 0)
-         {
-         if (number >= md->offset_end) md->offset_overflow = TRUE; else
            {
-           md->offset_vector[number+1] = eptr - md->start_subject;
+           if (offset >= md->offset_max) md->offset_overflow = TRUE; else
-           if (offset_top <= number) offset_top = number + 2;
+             {
+             md->offset_vector[offset] =
+               md->offset_vector[md->offset_end - number];
+             md->offset_vector[offset+1] = eptr - md->start_subject;
+             if (offset_top <= offset) offset_top = offset + 2;
+             }
            }
          }
-       /* For a non-repeating ket, just advance to the next node and continue at
+       /* Reset the value of the ims flags, in case they got changed during
-       this level. */
+       the group. */
+       ims = original_ims;
+       DPRINTF(("ims reset to %02lx\n", ims));
-       if (*ecode == OP_KET)
+       /* For a non-repeating ket, just continue at this level. This also
+       happens for a repeating ket if no characters were matched in the group.
+       This is the forcible breaking of infinite loops as implemented in Perl
+.005. If there is an options reset, it will get obeyed in the normal
+       course of events. */
+       if (*ecode == OP_KET || eptr == saved_eptr)
          {
          ecode += 3;
          break;
-Line 2497 
 for (;;)
+Line 3660 
 for (;;)
        if (*ecode == OP_KETRMIN)
          {
-         if (match(eptr, ecode+3, offset_top, md) ||
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, 0) ||
-             match(eptr, prev, offset_top, md)) return TRUE;
+             match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup))
+               return TRUE;
          }
        else  /* OP_KETRMAX */
          {
-         if (match(eptr, prev, offset_top, md) ||
+         if (match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup) ||
-             match(eptr, ecode+3, offset_top, md)) return TRUE;
+             match(eptr, ecode+3, offset_top, md, ims, eptrb, 0)) return TRUE;
          }
        }
      return FALSE;
-Line 2512 
 for (;;)
+Line 3676 
 for (;;)
      case OP_CIRC:
      if (md->notbol && eptr == md->start_subject) return FALSE;
-     if (md->multiline)
+     if ((ims & PCRE_MULTILINE) != 0)
        {
        if (eptr != md->start_subject && eptr[-1] != '\n') return FALSE;
        ecode++;
-Line 2527 
 for (;;)
+Line 3691 
 for (;;)
      ecode++;
      break;
-     /* Assert before internal newline if multiline, or before
+     /* Assert before internal newline if multiline, or before a terminating
-     a terminating newline unless endonly is set, else end of subject unless
+     newline unless endonly is set, else end of subject unless noteol is set. */
-     noteol is set. */
      case OP_DOLL:
-     if (md->noteol && eptr >= md->end_subject) return FALSE;
+     if ((ims & PCRE_MULTILINE) != 0)
-     if (md->multiline)
        {
-       if (eptr < md->end_subject && *eptr != '\n') return FALSE;
+       if (eptr < md->end_subject) { if (*eptr != '\n') return FALSE; }
+         else { if (md->noteol) return FALSE; }
        ecode++;
        break;
        }
-     else if (!md->endonly)
+     else
        {
-       if (eptr < md->end_subject - 1 ||
+       if (md->noteol) return FALSE;
-          (eptr == md->end_subject - 1 && *eptr != '\n')) return FALSE;
+       if (!md->endonly)
-       ecode++;
+         {
-       break;
+         if (eptr < md->end_subject - 1 ||
+            (eptr == md->end_subject - 1 && *eptr != '\n')) return FALSE;
+         ecode++;
+         break;
+         }
        }
      /* ... else fall through */
-     /* End of subject assertion */
+     /* End of subject assertion (\z) */
      case OP_EOD:
      if (eptr < md->end_subject) return FALSE;
      ecode++;
      break;
+     /* End of subject or ending \n assertion (\Z) */
+     case OP_EODN:
+     if (eptr < md->end_subject - 1 ||
+        (eptr == md->end_subject - 1 && *eptr != '\n')) return FALSE;
+     ecode++;
+     break;
      /* Word boundary assertions */
      case OP_NOT_WORD_BOUNDARY:
      case OP_WORD_BOUNDARY:
        {
        BOOL prev_is_word = (eptr != md->start_subject) &&
-         ((pcre_ctypes[eptr[-1]] & ctype_word) != 0);
+         ((md->ctypes[eptr[-1]] & ctype_word) != 0);
        BOOL cur_is_word = (eptr < md->end_subject) &&
-         ((pcre_ctypes[*eptr] & ctype_word) != 0);
+         ((md->ctypes[*eptr] & ctype_word) != 0);
        if ((*ecode++ == OP_WORD_BOUNDARY)?
             cur_is_word == prev_is_word : cur_is_word != prev_is_word)
          return FALSE;
-Line 2573 
 for (;;)
+Line 3749 
 for (;;)
      /* Match a single character type; inline for speed */
      case OP_ANY:
-     if (!md->dotall && eptr < md->end_subject && *eptr == '\n') return FALSE;
+     if ((ims & PCRE_DOTALL) == 0 && eptr < md->end_subject && *eptr == '\n')
+       return FALSE;
      if (eptr++ >= md->end_subject) return FALSE;
      ecode++;
      break;
      case OP_NOT_DIGIT:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_digit) != 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_digit) != 0)
        return FALSE;
      ecode++;
      break;
      case OP_DIGIT:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_digit) == 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_digit) == 0)
        return FALSE;
      ecode++;
      break;
      case OP_NOT_WHITESPACE:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_space) != 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_space) != 0)
        return FALSE;
      ecode++;
      break;
      case OP_WHITESPACE:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_space) == 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_space) == 0)
        return FALSE;
      ecode++;
      break;
      case OP_NOT_WORDCHAR:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_word) != 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_word) != 0)
        return FALSE;
      ecode++;
      break;
      case OP_WORDCHAR:
-     if (eptr >= md->end_subject || (pcre_ctypes[*eptr++] & ctype_word) == 0)
+     if (eptr >= md->end_subject ||
+        (md->ctypes[*eptr++] & ctype_word) == 0)
        return FALSE;
      ecode++;
      break;
-Line 2625 
 for (;;)
+Line 3808 
 for (;;)
      case OP_REF:
        {
        int length;
-       int number = ecode[1] << 1;                /* Doubled reference number */
+       int offset = ecode[1] << 1;                /* Doubled reference number */
        ecode += 2;                                /* Advance past the item */
-       if (number >= offset_top || md->offset_vector[number] < 0)
+       /* If the reference is unset, set the length to be longer than the amount
-         {
+       of subject left; this ensures that every attempt at a match fails. We
-         md->errorcode = PCRE_ERROR_BADREF;
+       can't just fail here, because of the possibility of quantifiers with zero
-         return FALSE;
+       minima. */
-         }
+       length = (offset >= offset_top || md->offset_vector[offset] < 0)?
+         md->end_subject - eptr + 1 :
+         md->offset_vector[offset+1] - md->offset_vector[offset];
-       length = md->offset_vector[number+1] - md->offset_vector[number];
+       /* Set up for repetition, or handle the non-repeated case */
        switch (*ecode)
          {
-Line 2661 
 for (;;)
+Line 3847 
 for (;;)
          break;
          default:               /* No repeat follows */
-         if (!match_ref(number, eptr, length, md)) return FALSE;
+         if (!match_ref(offset, eptr, length, md, ims)) return FALSE;
          eptr += length;
          continue;              /* With the main loop */
          }
-Line 2677 
 for (;;)
+Line 3863 
 for (;;)
        for (i = 1; i <= min; i++)
          {
-         if (!match_ref(number, eptr, length, md)) return FALSE;
+         if (!match_ref(offset, eptr, length, md, ims)) return FALSE;
          eptr += length;
          }
-Line 2692 
 for (;;)
+Line 3878 
 for (;;)
          {
          for (i = min;; i++)
            {
-           if (match(eptr, ecode, offset_top, md)) return TRUE;
+           if (match(eptr, ecode, offset_top, md, ims, eptrb, 0))
-           if (i >= max || !match_ref(number, eptr, length, md))
+             return TRUE;
+           if (i >= max || !match_ref(offset, eptr, length, md, ims))
              return FALSE;
            eptr += length;
            }
-Line 2707 
 for (;;)
+Line 3894 
 for (;;)
          const uschar *pp = eptr;
          for (i = min; i < max; i++)
            {
-           if (!match_ref(number, eptr, length, md)) break;
+           if (!match_ref(offset, eptr, length, md, ims)) break;
            eptr += length;
            }
          while (eptr >= pp)
            {
-           if (match(eptr, ecode, offset_top, md)) return TRUE;
+           if (match(eptr, ecode, offset_top, md, ims, eptrb, 0))
+             return TRUE;
            eptr -= length;
            }
          return FALSE;
-Line 2720 
 for (;;)
+Line 3908 
 for (;;)
        }
      /* Control never gets here */
      /* Match a character class, possibly repeatedly. Look past the end of the
      item to see if there is repeat information following. Then obey similar
-     code to character type repeats - written out again for speed. If caseless
+     code to character type repeats - written out again for speed. */
-     matching was set at runtime but not at compile time, we have to check both
-     versions of a character, and we have to behave differently for positive and
-     negative classes. This is the only time where OP_CLASS and OP_NEGCLASS are
-     treated differently. */
      case OP_CLASS:
-     case OP_NEGCLASS:
        {
-       BOOL nasty_case = *ecode == OP_NEGCLASS && md->runtime_caseless;
        const uschar *data = ecode + 1;  /* Save for matching */
        ecode += 33;                     /* Advance past the item */
-Line 2770 
 for (;;)
+Line 3954 
 for (;;)
          {
          if (eptr >= md->end_subject) return FALSE;
          c = *eptr++;
+         if ((data[c/8] & (1 << (c&7))) != 0) continue;
-         /* Either not runtime caseless, or it was a positive class. For
-         runtime caseless, continue if either case is in the map. */
-         if (!nasty_case)
-           {
-           if ((data[c/8] & (1 << (c&7))) != 0) continue;
-           if (md->runtime_caseless)
-             {
-             c = pcre_fcc[c];
-             if ((data[c/8] & (1 << (c&7))) != 0) continue;
-             }
-           }
-         /* Runtime caseless and it was a negative class. Continue only if
-         both cases are in the map. */
-         else
-           {
-           if ((data[c/8] & (1 << (c&7))) == 0) return FALSE;
-           c = pcre_fcc[c];
-           if ((data[c/8] & (1 << (c&7))) != 0) continue;
-           }
          return FALSE;
          }
-Line 2809 
 for (;;)
+Line 3970 
 for (;;)
          {
          for (i = min;; i++)
            {
-           if (match(eptr, ecode, offset_top, md)) return TRUE;
+           if (match(eptr, ecode, offset_top, md, ims, eptrb, 0))
+             return TRUE;
            if (i >= max || eptr >= md->end_subject) return FALSE;
            c = *eptr++;
+           if ((data[c/8] & (1 << (c&7))) != 0) continue;
-           /* Either not runtime caseless, or it was a positive class. For
-           runtime caseless, continue if either case is in the map. */
-           if (!nasty_case)
-             {
-             if ((data[c/8] & (1 << (c&7))) != 0) continue;
-             if (md->runtime_caseless)
-               {
-               c = pcre_fcc[c];
-               if ((data[c/8] & (1 << (c&7))) != 0) continue;
-               }
-             }
-           /* Runtime caseless and it was a negative class. Continue only if
-           both cases are in the map. */
-           else
-             {
-             if ((data[c/8] & (1 << (c&7))) == 0) return FALSE;
-             c = pcre_fcc[c];
-             if ((data[c/8] & (1 << (c&7))) != 0) continue;
-             }
+&nbs