/[pcre]/code/trunk/pcre.c

Diff of /code/trunk/pcre.c

Parent Directory | Revision Log | View Patch Patch

-revision 3 by nigel,
Sat Feb 24 21:38:01 2007 UTC
+revision 53 by nigel,
Sat Feb 24 21:39:42 2007 UTC
 Line 9 
 the file Tech.Notes for some information
  Written by: Philip Hazel <ph10@cam.ac.uk>
-            Copyright (c) 1997 University of Cambridge
+            Copyright (c) 1997-2001 University of Cambridge
  -----------------------------------------------------------------------------
  Permission is granted to anyone to use this software for any purpose on any
 Line 25 
 restrictions:
 . Altered versions must be plainly marked as such, and must not be
     misrepresented as being the original software.
+. If PCRE is embedded in any software that is released under the GNU
+    General Purpose Licence (GPL), then the terms of that licence shall
+    supersede any condition above with which it is incompatible.
  -----------------------------------------------------------------------------
  */
-Line 33 
 restrictions:
+Line 37 
 restrictions:
  /* #define DEBUG */
+ /* Use a macro for debugging printing, 'cause that eliminates the use of #ifdef
+ inline, and there are *still* stupid compilers about that don't like indented
+ pre-processor statements. I suppose it's only been 10 years... */
+ #ifdef DEBUG
+ #define DPRINTF(p) printf p
+ #else
+ #define DPRINTF(p) /*nothing*/
+ #endif
  /* Include the internals header, which itself includes Standard C headers plus
  the external pcre header. */
-Line 40 
 the external pcre header. */
+Line 53 
 the external pcre header. */
  #include "internal.h"
+ /* Allow compilation as C++ source code, should anybody want to do that. */
+ #ifdef __cplusplus
+ #define class pcre_class
+ #endif
+ /* Maximum number of items on the nested bracket stacks at compile time. This
+ applies to the nesting of all kinds of parentheses. It does not limit
+ un-nested, non-capturing parentheses. This number can be made bigger if
+ necessary - it is used to dimension one int and one unsigned char vector at
+ compile time. */
+ #define BRASTACK_SIZE 200
+ /* The number of bytes in a literal character string above which we can't add
+ any more is different when UTF-8 characters may be encountered. */
+ #ifdef SUPPORT_UTF8
+ #define MAXLIT 250
+ #else
+ #define MAXLIT 255
+ #endif
  /* Min and max values for the common repeats; for the maxima, 0 => infinity */
- static char rep_min[] = { 0, 0, 1, 1, 0, 0 };
+ static const char rep_min[] = { 0, 0, 1, 1, 0, 0 };
- static char rep_max[] = { 0, 0, 0, 0, 1, 1 };
+ static const char rep_max[] = { 0, 0, 0, 0, 1, 1 };
- /* Text forms of OP_ values and things, for debugging */
+ /* Text forms of OP_ values and things, for debugging (not all used) */
  #ifdef DEBUG
- static char *OP_names[] = { "End", "\\A", "\\B", "\\b", "\\D", "\\d",
+ static const char *OP_names[] = {
-   "\\S", "\\s", "\\W", "\\w", "Cut", "\\Z", "^", "$", "Any", "chars",
+   "End", "\\A", "\\B", "\\b", "\\D", "\\d",
-   "not",
+   "\\S", "\\s", "\\W", "\\w", "\\Z", "\\z",
+   "Opt", "^", "$", "Any", "chars", "not",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
    "*", "*?", "+", "+?", "?", "??", "{", "{",
-   "class", "Ref",
+   "class", "Ref", "Recurse",
-   "Alt", "Ket", "KetRmax", "KetRmin", "Assert", "Assert not", "Once",
+   "Alt", "Ket", "KetRmax", "KetRmin", "Assert", "Assert not",
-   "Brazero", "Braminzero", "Bra"
+   "AssertB", "AssertB not", "Reverse", "Once", "Cond", "Cref",
+   "Brazero", "Braminzero", "Branumber", "Bra"
  };
  #endif
-Line 66 
 are simple data values; negative values
+Line 107 
 are simple data values; negative values
  on. Zero means further processing is needed (for things like \x), or the escape
  is invalid. */
- static short int escapes[] = {
+ static const short int escapes[] = {
 ,      0,      0,      0,      0,      0,      0,      0,   /* 0 - 7 */
 ,      0,    ':',    ';',    '<',    '=',    '>',    '?',   /* 8 - ? */
    '@', -ESC_A, -ESC_B,      0, -ESC_D,      0,      0,      0,   /* @ - G */
 ,      0,      0,      0,      0,      0,      0,      0,   /* H - O */
 ,      0,      0, -ESC_S,      0,      0,      0, -ESC_W,   /* P - W */
 ,      0, -ESC_Z,    '[',   '\\',    ']',    '^',    '_',   /* X - _ */
-   '`',      7, -ESC_b,      0, -ESC_d,     27,   '\f',      0,   /* ` - g */
+   '`',      7, -ESC_b,      0, -ESC_d,  ESC_E,  ESC_F,      0,   /* ` - g */
-,      0,      0,      0,      0,      0,   '\n',      0,   /* h - o */
+,      0,      0,      0,      0,      0,  ESC_N,      0,   /* h - o */
-,      0,   '\r', -ESC_s,   '\t',      0,      0, -ESC_w,   /* p - w */
+,      0,  ESC_R, -ESC_s,  ESC_T,      0,      0, -ESC_w,   /* p - w */
-,      0,      0                                            /* x - z */
+,      0, -ESC_z                                            /* x - z */
  };
+ /* Tables of names of POSIX character classes and their lengths. The list is
+ terminated by a zero length entry. The first three must be alpha, upper, lower,
+ as this is assumed for handling case independence. */
+ static const char *posix_names[] = {
+   "alpha", "lower", "upper",
+   "alnum", "ascii", "cntrl", "digit", "graph",
+   "print", "punct", "space", "word",  "xdigit" };
+ static const uschar posix_name_lengths[] = {
+, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
+ /* Table of class bit maps for each POSIX class; up to three may be combined
+ to form the class. */
+ static const int posix_class_maps[] = {
+   cbit_lower, cbit_upper, -1,             /* alpha */
+   cbit_lower, -1,         -1,             /* lower */
+   cbit_upper, -1,         -1,             /* upper */
+   cbit_digit, cbit_lower, cbit_upper,     /* alnum */
+   cbit_print, cbit_cntrl, -1,             /* ascii */
+   cbit_cntrl, -1,         -1,             /* cntrl */
+   cbit_digit, -1,         -1,             /* digit */
+   cbit_graph, -1,         -1,             /* graph */
+   cbit_print, -1,         -1,             /* print */
+   cbit_punct, -1,         -1,             /* punct */
+   cbit_space, -1,         -1,             /* space */
+   cbit_word,  -1,         -1,             /* word */
+   cbit_xdigit,-1,         -1              /* xdigit */
+ };
  /* Definition to allow mutual recursion */
- static BOOL compile_regex(int, int *,uschar **,uschar **,char **);
+ static BOOL
+   compile_regex(int, int, int *, uschar **, const uschar **, const char **,
+     BOOL, int, int *, int *, compile_data *);
+ /* Structure for building a chain of data that actually lives on the
+ stack, for holding the values of the subject pointer at the start of each
+ subpattern, so as to detect when an empty string has been matched by a
+ subpattern - to break infinite loops. */
+ typedef struct eptrblock {
+   struct eptrblock *prev;
+   const uschar *saved_eptr;
+ } eptrblock;
- /* Structure for passing "static" information around between the functions
+ /* Flag bits for the match() function */
- doing the matching, so that they are thread-safe. */
- typedef struct match_data {
+ #define match_condassert   0x01    /* Called to check a condition assertion */
-   int    errorcode;             /* As it says */
+ #define match_isgroup      0x02    /* Set if start of bracketed group */
-   int   *offset_vector;         /* Offset vector */
-   int    offset_end;            /* One past the end */
-   BOOL   offset_overflow;       /* Set if too many extractions */
-   BOOL   caseless;              /* Case-independent flag */
-   BOOL   runtime_caseless;      /* Caseless forced at run time */
-   BOOL   multiline;             /* Multiline flag */
-   BOOL   notbol;                /* NOTBOL flag */
-   BOOL   noteol;                /* NOTEOL flag */
-   BOOL   dotall;                /* Dot matches any char */
-   BOOL   endonly;               /* Dollar not before final \n */
-   uschar *start_subject;        /* Start of the subject string */
-   uschar *end_subject;          /* End of the subject string */
-   jmp_buf fail_env;             /* Environment for longjump() break out */
-   uschar *end_match_ptr;        /* Subject position at end match */
-   int     end_offset_top;       /* Highwater mark at end of match */
- } match_data;
-Line 121 
 void  (*pcre_free)(void *) = free;
+Line 189 
 void  (*pcre_free)(void *) = free;
+ /*************************************************
+ *    Macros and tables for character handling    *
+ *************************************************/
+ /* When UTF-8 encoding is being used, a character is no longer just a single
+ byte. The macros for character handling generate simple sequences when used in
+ byte-mode, and more complicated ones for UTF-8 characters. */
+ #ifndef SUPPORT_UTF8
+ #define GETCHARINC(c, eptr) c = *eptr++;
+ #define GETCHARLEN(c, eptr, len) c = *eptr;
+ #define BACKCHAR(eptr)
+ #else   /* SUPPORT_UTF8 */
+ /* Get the next UTF-8 character, advancing the pointer */
+ #define GETCHARINC(c, eptr) \
+   c = *eptr++; \
+   if (md->utf8 && (c & 0xc0) == 0xc0) \
+     { \
+     int a = utf8_table4[c & 0x3f];  /* Number of additional bytes */ \
+     int s = 6 - a;                  /* Amount to shift next byte */  \
+     c &= utf8_table3[a];            /* Low order bits from first byte */ \
+     while (a-- > 0) \
+       { \
+       c |= (*eptr++ & 0x3f) << s; \
+       s += 6; \
+       } \
+     }
+ /* Get the next UTF-8 character, not advancing the pointer, setting length */
+ #define GETCHARLEN(c, eptr, len) \
+   c = *eptr; \
+   len = 1; \
+   if (md->utf8 && (c & 0xc0) == 0xc0) \
+     { \
+     int i; \
+     int a = utf8_table4[c & 0x3f];  /* Number of additional bytes */ \
+     int s = 6 - a;                  /* Amount to shift next byte */  \
+     c &= utf8_table3[a];            /* Low order bits from first byte */ \
+     for (i = 1; i <= a; i++) \
+       { \
+       c |= (eptr[i] & 0x3f) << s; \
+       s += 6; \
+       } \
+     len += a; \
+     }
+ /* If the pointer is not at the start of a character, move it back until
+ it is. */
+ #define BACKCHAR(eptr) while((*eptr & 0xc0) == 0x80) eptr--;
+ #endif
+ /*************************************************
+ *             Default character tables           *
+ *************************************************/
+ /* A default set of character tables is included in the PCRE binary. Its source
+ is built by the maketables auxiliary program, which uses the default C ctypes
+ functions, and put in the file chartables.c. These tables are used by PCRE
+ whenever the caller of pcre_compile() does not provide an alternate set of
+ tables. */
+ #include "chartables.c"
+ #ifdef SUPPORT_UTF8
+ /*************************************************
+ *           Tables for UTF-8 support             *
+ *************************************************/
+ /* These are the breakpoints for different numbers of bytes in a UTF-8
+ character. */
+ static int utf8_table1[] = { 0x7f, 0x7ff, 0xffff, 0x1fffff, 0x3ffffff, 0x7fffffff};
+ /* These are the indicator bits and the mask for the data bits to set in the
+ first byte of a character, indexed by the number of additional bytes. */
+ static int utf8_table2[] = { 0,    0xc0, 0xe0, 0xf0, 0xf8, 0xfc};
+ static int utf8_table3[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
+ /* Table of the number of extra characters, indexed by the first character
+ masked with 0x3f. The highest number for a valid UTF-8 character is in fact
+x3d. */
+ static uschar utf8_table4[] = {
+,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
+,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
+,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
+,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
+ /*************************************************
+ *       Convert character value to UTF-8         *
+ *************************************************/
+ /* This function takes an integer value in the range 0 - 0x7fffffff
+ and encodes it as a UTF-8 character in 0 to 6 bytes.
+ Arguments:
+   cvalue     the character value
+   buffer     pointer to buffer for result - at least 6 bytes long
+ Returns:     number of characters placed in the buffer
+ */
+ static int
+ ord2utf8(int cvalue, uschar *buffer)
+ {
+ register int i, j;
+ for (i = 0; i < sizeof(utf8_table1)/sizeof(int); i++)
+   if (cvalue <= utf8_table1[i]) break;
+ *buffer++ = utf8_table2[i] | (cvalue & utf8_table3[i]);
+ cvalue >>= 6 - i;
+ for (j = 0; j < i; j++)
+   {
+   *buffer++ = 0x80 | (cvalue & 0x3f);
+   cvalue >>= 6;
+   }
+ return i + 1;
+ }
+ #endif
  /*************************************************
  *          Return version string                 *
  *************************************************/
- char *
+ #define STRING(a)  # a
+ #define XSTRING(s) STRING(s)
+ const char *
  pcre_version(void)
  {
- return PCRE_VERSION;
+ return XSTRING(PCRE_MAJOR) "." XSTRING(PCRE_MINOR) " " XSTRING(PCRE_DATE);
  }
  /*************************************************
- *       Return info about a compiled pattern     *
+ * (Obsolete) Return info about compiled pattern  *
  *************************************************/
- /* This function picks potentially useful data out of the private
+ /* This is the original "info" function. It picks potentially useful data out
- structure.
+ of the private structure, but its interface was too rigid. It remains for
+ backwards compatibility. The public options are passed back in an int - though
+ the re->options field has been expanded to a long int, all the public options
+ at the low end of it, and so even on 16-bit systems this will still be OK.
+ Therefore, I haven't changed the API for pcre_info().
  Arguments:
    external_re   points to compiled code
-Line 149 
 Arguments:
+Line 356 
 Arguments:
                  or -1 if multiline and all branches start ^,
                  or -2 otherwise
- Returns:        number of identifying extraction brackets
+ Returns:        number of capturing subpatterns
                  or negative values on error
  */
  int
  pcre_info(const pcre *external_re, int *optptr, int *first_char)
  {
- real_pcre *re = (real_pcre *)external_re;
+ const real_pcre *re = (const real_pcre *)external_re;
  if (re == NULL) return PCRE_ERROR_NULL;
  if (re->magic_number != MAGIC_NUMBER) return PCRE_ERROR_BADMAGIC;
- if (optptr != NULL) *optptr = (re->options & PUBLIC_OPTIONS);
+ if (optptr != NULL) *optptr = (int)(re->options & PUBLIC_OPTIONS);
  if (first_char != NULL)
    *first_char = ((re->options & PCRE_FIRSTSET) != 0)? re->first_char :
       ((re->options & PCRE_STARTLINE) != 0)? -1 : -2;
-Line 168 
 return re->top_bracket;
+Line 375 
 return re->top_bracket;
+ /*************************************************
+ *        Return info about compiled pattern      *
+ *************************************************/
+ /* This is a newer "info" function which has an extensible interface so
+ that additional items can be added compatibly.
+ Arguments:
+   external_re      points to compiled code
+   external_study   points to study data, or NULL
+   what             what information is required
+   where            where to put the information
+ Returns:           0 if data returned, negative on error
+ */
+ int
+ pcre_fullinfo(const pcre *external_re, const pcre_extra *study_data, int what,
+   void *where)
+ {
+ const real_pcre *re = (const real_pcre *)external_re;
+ const real_pcre_extra *study = (const real_pcre_extra *)study_data;
+ if (re == NULL || where == NULL) return PCRE_ERROR_NULL;
+ if (re->magic_number != MAGIC_NUMBER) return PCRE_ERROR_BADMAGIC;
+ switch (what)
+   {
+   case PCRE_INFO_OPTIONS:
+   *((unsigned long int *)where) = re->options & PUBLIC_OPTIONS;
+   break;
+   case PCRE_INFO_SIZE:
+   *((size_t *)where) = re->size;
+   break;
+   case PCRE_INFO_CAPTURECOUNT:
+   *((int *)where) = re->top_bracket;
+   break;
+   case PCRE_INFO_BACKREFMAX:
+   *((int *)where) = re->top_backref;
+   break;
+   case PCRE_INFO_FIRSTCHAR:
+   *((int *)where) =
+     ((re->options & PCRE_FIRSTSET) != 0)? re->first_char :
+     ((re->options & PCRE_STARTLINE) != 0)? -1 : -2;
+   break;
+   case PCRE_INFO_FIRSTTABLE:
+   *((const uschar **)where) =
+     (study != NULL && (study->options & PCRE_STUDY_MAPPED) != 0)?
+       study->start_bits : NULL;
+   break;
+   case PCRE_INFO_LASTLITERAL:
+   *((int *)where) =
+     ((re->options & PCRE_REQCHSET) != 0)? re->req_char : -1;
+   break;
+   default: return PCRE_ERROR_BADOPTION;
+   }
+ return 0;
+ }
  #ifdef DEBUG
  /*************************************************
-Line 186 
 Arguments:
+Line 461 
 Arguments:
  Returns:     nothing
  */
- static pchars(uschar *p, int length, BOOL is_subject, match_data *md)
+ static void
+ pchars(const uschar *p, int length, BOOL is_subject, match_data *md)
  {
  int c;
  if (is_subject && length > md->end_subject - p) length = md->end_subject - p;
-Line 199 
 while (length-- > 0)
+Line 475 
 while (length-- > 0)
  /*************************************************
- *         Check subpattern for empty operand     *
- *************************************************/
- /* This function checks a bracketed subpattern to see if any of the paths
- through it could match an empty string. This is used to diagnose an error if
- such a subpattern is followed by a quantifier with an unlimited upper bound.
- Argument:
-   code      points to the opening bracket
- Returns:    TRUE or FALSE
- */
- static BOOL
- could_be_empty(uschar *code)
- {
- do {
-   uschar *cc = code + 3;
-   /* Scan along the opcodes for this branch; as soon as we find something
-   that matches a non-empty string, break out and advance to test the next
-   branch. If we get to the end of the branch, return TRUE for the whole
-   sub-expression. */
-   for (;;)
-     {
-     /* Test an embedded subpattern; if it could not be empty, break the
-     loop. Otherwise carry on in the branch. */
-     if ((int)(*cc) >= OP_BRA)
-       {
-       if (!could_be_empty(cc)) break;
-       do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-       cc += 3;
-       }
-     else switch (*cc)
-       {
-       /* Reached end of a branch: the subpattern may match the empty string */
-       case OP_ALT:
-       case OP_KET:
-       case OP_KETRMAX:
-       case OP_KETRMIN:
-       return TRUE;
-       /* Skip over assertive subpatterns */
-       case OP_ASSERT:
-       case OP_ASSERT_NOT:
-       do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-       cc += 3;
-       break;
-       /* Skip over things that don't match chars */
-       case OP_SOD:
-       case OP_EOD:
-       case OP_CIRC:
-       case OP_DOLL:
-       case OP_BRAZERO:
-       case OP_BRAMINZERO:
-       case OP_NOT_WORD_BOUNDARY:
-       case OP_WORD_BOUNDARY:
-       cc++;
-       break;
-       /* Skip over simple repeats with zero lower bound */
-       case OP_STAR:
-       case OP_MINSTAR:
-       case OP_QUERY:
-       case OP_MINQUERY:
-       case OP_TYPESTAR:
-       case OP_TYPEMINSTAR:
-       case OP_TYPEQUERY:
-       case OP_TYPEMINQUERY:
-       cc += 2;
-       break;
-       /* Skip over UPTOs (lower bound is zero) */
-       case OP_UPTO:
-       case OP_MINUPTO:
-       case OP_TYPEUPTO:
-       case OP_TYPEMINUPTO:
-       cc += 4;
-       break;
-       /* Check a class or a back reference for a zero minimum */
-       case OP_CLASS:
-       case OP_REF:
-       cc += (*cc == OP_REF)? 2 : 4 + 2 * cc[2] + cc[3];
-       switch (*cc)
-         {
-         case OP_CRSTAR:
-         case OP_CRMINSTAR:
-         case OP_CRQUERY:
-         case OP_CRMINQUERY:
-         cc++;
-         break;
-         case OP_CRRANGE:
-         case OP_CRMINRANGE:
-         if ((cc[1] << 8) + cc[2] != 0) goto NEXT_BRANCH;
-         cc += 3;
-         break;
-         default:
-         goto NEXT_BRANCH;
-         }
-       break;
-       /* Anything else matches at least one character */
-       default:
-       goto NEXT_BRANCH;
-       }
-     }
-   NEXT_BRANCH:
-   code += (code[1] << 8) + code[2];
-   }
- while (*code == OP_ALT);
- /* No branches match the empty string */
- return FALSE;
- }
- /*************************************************
  *            Handle escapes                      *
  *************************************************/
  /* This function is called when a \ has been encountered. It either returns a
  positive value for a simple escape such as \n, or a negative value which
- encodes one of the more complicated things such as \d. On entry, ptr is
+ encodes one of the more complicated things such as \d. When UTF-8 is enabled,
- pointing at the \. On exit, it is on the final character of the escape
+ a positive value greater than 255 may be returned. On entry, ptr is pointing at
- sequence.
+ the \. On exit, it is on the final character of the escape sequence.
  Arguments:
    ptrptr     points to the pattern position pointer
-Line 349 
 Arguments:
+Line 490 
 Arguments:
    bracount   number of previous extracting brackets
    options    the options bits
    isclass    TRUE if inside a character class
+   cd         pointer to char tables block
  Returns:     zero or positive => a data character
               negative => a special escape sequence
-Line 356 
 Returns:     zero or positive => a data
+Line 498 
 Returns:     zero or positive => a data
  */
  static int
- check_escape(uschar **ptrptr, char **errorptr, int bracount, int options,
+ check_escape(const uschar **ptrptr, const char **errorptr, int bracount,
-   BOOL isclass)
+   int options, BOOL isclass, compile_data *cd)
  {
- uschar *ptr = *ptrptr;
+ const uschar *ptr = *ptrptr;
- int c = *(++ptr) & 255;   /* Ensure > 0 on signed-char systems */
+ int c, i;
- int i;
+ /* If backslash is at the end of the pattern, it's an error. */
+ c = *(++ptr);
  if (c == 0) *errorptr = ERR1;
  /* Digits or letters may have special meaning; all others are literals. */
-Line 378 
 else if ((i = escapes[c - '0']) != 0) c
+Line 522 
 else if ((i = escapes[c - '0']) != 0) c
  else
    {
-   uschar *oldptr;
+   const uschar *oldptr;
    switch (c)
      {
      /* The handling of escape sequences consisting of a string of digits
-Line 400 
 else
+Line 544 
 else
        {
        oldptr = ptr;
        c -= '0';
-       while ((pcre_ctypes[ptr[1]] & ctype_digit) != 0)
+       while ((cd->ctypes[ptr[1]] & ctype_digit) != 0)
          c = c * 10 + *(++ptr) - '0';
        if (c < 10 || c <= bracount)
          {
-Line 422 
 else
+Line 566 
 else
        }
      /* \0 always starts an octal number, but we may drop through to here with a
-     larger first octal digit */
+     larger first octal digit. */
      case '0':
      c -= '0';
-     while(i++ < 2 && (pcre_ctypes[ptr[1]] & ctype_digit) != 0 &&
+     while(i++ < 2 && (cd->ctypes[ptr[1]] & ctype_digit) != 0 &&
        ptr[1] != '8' && ptr[1] != '9')
          c = c * 8 + *(++ptr) - '0';
+     c &= 255;     /* Take least significant 8 bits */
      break;
-     /* Special escapes not starting with a digit are straightforward */
+     /* \x is complicated when UTF-8 is enabled. \x{ddd} is a character number
+     which can be greater than 0xff, but only if the ddd are hex digits. */
      case 'x':
+ #ifdef SUPPORT_UTF8
+     if (ptr[1] == '{' && (options & PCRE_UTF8) != 0)
+       {
+       const uschar *pt = ptr + 2;
+       register int count = 0;
+       c = 0;
+       while ((cd->ctypes[*pt] & ctype_xdigit) != 0)
+         {
+         count++;
+         c = c * 16 + cd->lcc[*pt] -
+           (((cd->ctypes[*pt] & ctype_digit) != 0)? '0' : 'W');
+         pt++;
+         }
+       if (*pt == '}')
+         {
+         if (c < 0 || count > 8) *errorptr = ERR34;
+         ptr = pt;
+         break;
+         }
+       /* If the sequence of hex digits does not end with '}', then we don't
+       recognize this construct; fall through to the normal \x handling. */
+       }
+ #endif
+     /* Read just a single hex char */
      c = 0;
-     while (i++ < 2 && (pcre_ctypes[ptr[1]] & ctype_xdigit) != 0)
+     while (i++ < 2 && (cd->ctypes[ptr[1]] & ctype_xdigit) != 0)
        {
        ptr++;
-       c = c * 16 + pcre_lcc[*ptr] -
+       c = c * 16 + cd->lcc[*ptr] -
-         (((pcre_ctypes[*ptr] & ctype_digit) != 0)? '0' : 'W');
+         (((cd->ctypes[*ptr] & ctype_digit) != 0)? '0' : 'W');
        }
      break;
+     /* Other special escapes not starting with a digit are straightforward */
      case 'c':
      c = *(++ptr);
      if (c == 0)
-Line 453 
 else
+Line 627 
 else
      /* A letter is upper-cased; then the 0x40 bit is flipped */
-     if (c >= 'a' && c <= 'z') c = pcre_fcc[c];
+     if (c >= 'a' && c <= 'z') c = cd->fcc[c];
      c ^= 0x40;
      break;
      /* PCRE_EXTRA enables extensions to Perl in the matter of escapes. Any
      other alphameric following \ is an error if PCRE_EXTRA was set; otherwise,
-     for Perl compatibility, it is a literal. */
+     for Perl compatibility, it is a literal. This code looks a bit odd, but
+     there used to be some cases other than the default, and there may be again
+     in future, so I haven't "optimized" it. */
      default:
      if ((options & PCRE_EXTRA) != 0) switch(c)
        {
-       case 'X':
-       c = -ESC_X;      /* This could be a lookup if it ever got into Perl */
-       break;
        default:
        *errorptr = ERR3;
        break;
-Line 493 
 where the ddds are digits.
+Line 665 
 where the ddds are digits.
  Arguments:
    p         pointer to the first char after '{'
+   cd        pointer to char tables block
  Returns:    TRUE or FALSE
  */
  static BOOL
- is_counted_repeat(uschar *p)
+ is_counted_repeat(const uschar *p, compile_data *cd)
  {
- if ((pcre_ctypes[*p++] & ctype_digit) == 0) return FALSE;
+ if ((cd->ctypes[*p++] & ctype_digit) == 0) return FALSE;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) p++;
+ while ((cd->ctypes[*p] & ctype_digit) != 0) p++;
  if (*p == '}') return TRUE;
  if (*p++ != ',') return FALSE;
  if (*p == '}') return TRUE;
- if ((pcre_ctypes[*p++] & ctype_digit) == 0) return FALSE;
+ if ((cd->ctypes[*p++] & ctype_digit) == 0) return FALSE;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) p++;
+ while ((cd->ctypes[*p] & ctype_digit) != 0) p++;
  return (*p == '}');
  }
-Line 528 
 Arguments:
+Line 701 
 Arguments:
    maxp       pointer to int for max
               returned as -1 if no max
    errorptr   points to pointer to error message
+   cd         pointer to character tables clock
  Returns:     pointer to '}' on success;
               current ptr on error, with errorptr set
  */
- static uschar *
+ static const uschar *
- read_repeat_counts(uschar *p, int *minp, int *maxp, char **errorptr)
+ read_repeat_counts(const uschar *p, int *minp, int *maxp,
+   const char **errorptr, compile_data *cd)
  {
  int min = 0;
  int max = -1;
- while ((pcre_ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
+ while ((cd->ctypes[*p] & ctype_digit) != 0) min = min * 10 + *p++ - '0';
  if (*p == '}') max = min; else
    {
    if (*(++p) != '}')
      {
      max = 0;
-     while((pcre_ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
+     while((cd->ctypes[*p] & ctype_digit) != 0) max = max * 10 + *p++ - '0';
      if (max < min)
        {
        *errorptr = ERR4;
-Line 571 
 return p;
+Line 746 
 return p;
  /*************************************************
+ *        Find the fixed length of a pattern      *
+ *************************************************/
+ /* Scan a pattern and compute the fixed length of subject that will match it,
+ if the length is fixed. This is needed for dealing with backward assertions.
+ Arguments:
+   code     points to the start of the pattern (the bracket)
+   options  the compiling options
+ Returns:   the fixed length, or -1 if there is no fixed length
+ */
+ static int
+ find_fixedlength(uschar *code, int options)
+ {
+ int length = -1;
+ register int branchlength = 0;
+ register uschar *cc = code + 3;
+ /* Scan along the opcodes for this branch. If we get to the end of the
+ branch, check the length against that of the other branches. */
+ for (;;)
+   {
+   int d;
+   register int op = *cc;
+   if (op >= OP_BRA) op = OP_BRA;
+   switch (op)
+     {
+     case OP_BRA:
+     case OP_ONCE:
+     case OP_COND:
+     d = find_fixedlength(cc, options);
+     if (d < 0) return -1;
+     branchlength += d;
+     do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
+     cc += 3;
+     break;
+     /* Reached end of a branch; if it's a ket it is the end of a nested
+     call. If it's ALT it is an alternation in a nested call. If it is
+     END it's the end of the outer call. All can be handled by the same code. */
+     case OP_ALT:
+     case OP_KET:
+     case OP_KETRMAX:
+     case OP_KETRMIN:
+     case OP_END:
+     if (length < 0) length = branchlength;
+       else if (length != branchlength) return -1;
+     if (*cc != OP_ALT) return length;
+     cc += 3;
+     branchlength = 0;
+     break;
+     /* Skip over assertive subpatterns */
+     case OP_ASSERT:
+     case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
+     do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
+     cc += 3;
+     break;
+     /* Skip over things that don't match chars */
+     case OP_REVERSE:
+     case OP_BRANUMBER:
+     case OP_CREF:
+     cc++;
+     /* Fall through */
+     case OP_OPT:
+     cc++;
+     /* Fall through */
+     case OP_SOD:
+     case OP_EOD:
+     case OP_EODN:
+     case OP_CIRC:
+     case OP_DOLL:
+     case OP_NOT_WORD_BOUNDARY:
+     case OP_WORD_BOUNDARY:
+     cc++;
+     break;
+     /* Handle char strings. In UTF-8 mode we must count characters, not bytes.
+     This requires a scan of the string, unfortunately. We assume valid UTF-8
+     strings, so all we do is reduce the length by one for byte whose bits are
+xxxxxx. */
+     case OP_CHARS:
+     branchlength += *(++cc);
+ #ifdef SUPPORT_UTF8
+     for (d = 1; d <= *cc; d++)
+       if ((cc[d] & 0xc0) == 0x80) branchlength--;
+ #endif
+     cc += *cc + 1;
+     break;
+     /* Handle exact repetitions */
+     case OP_EXACT:
+     case OP_TYPEEXACT:
+     branchlength += (cc[1] << 8) + cc[2];
+     cc += 4;
+     break;
+     /* Handle single-char matchers */
+     case OP_NOT_DIGIT:
+     case OP_DIGIT:
+     case OP_NOT_WHITESPACE:
+     case OP_WHITESPACE:
+     case OP_NOT_WORDCHAR:
+     case OP_WORDCHAR:
+     case OP_ANY:
+     branchlength++;
+     cc++;
+     break;
+     /* Check a class for variable quantification */
+     case OP_CLASS:
+     cc += 33;
+     switch (*cc)
+       {
+       case OP_CRSTAR:
+       case OP_CRMINSTAR:
+       case OP_CRQUERY:
+       case OP_CRMINQUERY:
+       return -1;
+       case OP_CRRANGE:
+       case OP_CRMINRANGE:
+       if ((cc[1] << 8) + cc[2] != (cc[3] << 8) + cc[4]) return -1;
+       branchlength += (cc[1] << 8) + cc[2];
+       cc += 5;
+       break;
+       default:
+       branchlength++;
+       }
+     break;
+     /* Anything else is variable length */
+     default:
+     return -1;
+     }
+   }
+ /* Control never gets here */
+ }
+ /*************************************************
+ *           Check for POSIX class syntax         *
+ *************************************************/
+ /* This function is called when the sequence "[:" or "[." or "[=" is
+ encountered in a character class. It checks whether this is followed by an
+ optional ^ and then a sequence of letters, terminated by a matching ":]" or
+ ".]" or "=]".
+ Argument:
+   ptr      pointer to the initial [
+   endptr   where to return the end pointer
+   cd       pointer to compile data
+ Returns:   TRUE or FALSE
+ */
+ static BOOL
+ check_posix_syntax(const uschar *ptr, const uschar **endptr, compile_data *cd)
+ {
+ int terminator;          /* Don't combine these lines; the Solaris cc */
+ terminator = *(++ptr);   /* compiler warns about "non-constant" initializer. */
+ if (*(++ptr) == '^') ptr++;
+ while ((cd->ctypes[*ptr] & ctype_letter) != 0) ptr++;
+ if (*ptr == terminator && ptr[1] == ']')
+   {
+   *endptr = ptr;
+   return TRUE;
+   }
+ return FALSE;
+ }
+ /*************************************************
+ *          Check POSIX class name                *
+ *************************************************/
+ /* This function is called to check the name given in a POSIX-style class entry
+ such as [:alnum:].
+ Arguments:
+   ptr        points to the first letter
+   len        the length of the name
+ Returns:     a value representing the name, or -1 if unknown
+ */
+ static int
+ check_posix_name(const uschar *ptr, int len)
+ {
+ register int yield = 0;
+ while (posix_name_lengths[yield] != 0)
+   {
+   if (len == posix_name_lengths[yield] &&
+     strncmp((const char *)ptr, posix_names[yield], len) == 0) return yield;
+   yield++;
+   }
+ return -1;
+ }
+ /*************************************************
  *           Compile one branch                   *
  *************************************************/
  /* Scan the pattern, compiling it into the code vector.
  Arguments:
-   options    the option bits
+   options      the option bits
-   bracket    points to number of brackets used
+   brackets     points to number of extracting brackets used
-   code       points to the pointer to the current code point
+   code         points to the pointer to the current code point
-   ptrptr     points to the current pattern pointer
+   ptrptr       points to the current pattern pointer
-   errorptr   points to pointer to error message
+   errorptr     points to pointer to error message
+   optchanged   set to the value of the last OP_OPT item compiled
+   reqchar      set to the last literal character required, else -1
+   countlits    set to count of mandatory literal characters
+   cd           contains pointers to tables
- Returns:     TRUE on success
+ Returns:       TRUE on success
-              FALSE, with *errorptr set on error
+                FALSE, with *errorptr set on error
  */
  static BOOL
- compile_branch(int options, int *brackets, uschar **codeptr, uschar **ptrptr,
+ compile_branch(int options, int *brackets, uschar **codeptr,
-   char **errorptr)
+   const uschar **ptrptr, const char **errorptr, int *optchanged,
+   int *reqchar, int *countlits, compile_data *cd)
  {
  int repeat_type, op_type;
  int repeat_min, repeat_max;
  int bravalue, length;
+ int greedy_default, greedy_non_default;
+ int prevreqchar;
+ int condcount = 0;
+ int subcountlits = 0;
  register int c;
  register uschar *code = *codeptr;
- uschar *ptr = *ptrptr;
+ uschar *tempcode;
+ const uschar *ptr = *ptrptr;
+ const uschar *tempptr;
  uschar *previous = NULL;
- uschar *oldptr;
  uschar class[32];
+ /* Set up the default and non-default settings for greediness */
+ greedy_default = ((options & PCRE_UNGREEDY) != 0);
+ greedy_non_default = greedy_default ^ 1;
+ /* Initialize no required char, and count of literals */
+ *reqchar = prevreqchar = -1;
+ *countlits = 0;
  /* Switch on next character until the end of the branch */
  for (;; ptr++)
    {
    BOOL negate_class;
-   int  class_charcount;
+   int class_charcount;
-   int  class_lastchar;
+   int class_lastchar;
+   int newoptions;
+   int skipbytes;
+   int subreqchar;
    c = *ptr;
    if ((options & PCRE_EXTENDED) != 0)
      {
-     if ((pcre_ctypes[c] & ctype_space) != 0) continue;
+     if ((cd->ctypes[c] & ctype_space) != 0) continue;
      if (c == '#')
        {
-       while ((c = *(++ptr)) != 0 && c != '\n');
+       /* The space before the ; is to avoid a warning on a silly compiler
+       on the Macintosh. */
+       while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
        continue;
        }
      }
-Line 657 
 for (;; ptr++)
+Line 1086 
 for (;; ptr++)
      previous = code;
      *code++ = OP_CLASS;
-     /* If the first character is '^', set the negation flag */
+     /* If the first character is '^', set the negation flag and skip it. */
      if ((c = *(++ptr)) == '^')
        {
-Line 690 
 for (;; ptr++)
+Line 1119 
 for (;; ptr++)
          goto FAILED;
          }
+       /* Handle POSIX class names. Perl allows a negation extension of the
+       form [:^name]. A square bracket that doesn't match the syntax is
+       treated as a literal. We also recognize the POSIX constructions
+       [.ch.] and [=ch=] ("collating elements") and fault them, as Perl
+.6 does. */
+       if (c == '[' &&
+           (ptr[1] == ':' || ptr[1] == '.' || ptr[1] == '=') &&
+           check_posix_syntax(ptr, &tempptr, cd))
+         {
+         BOOL local_negate = FALSE;
+         int posix_class, i;
+         register const uschar *cbits = cd->cbits;
+         if (ptr[1] != ':')
+           {
+           *errorptr = ERR31;
+           goto FAILED;
+           }
+         ptr += 2;
+         if (*ptr == '^')
+           {
+           local_negate = TRUE;
+           ptr++;
+           }
+         posix_class = check_posix_name(ptr, tempptr - ptr);
+         if (posix_class < 0)
+           {
+           *errorptr = ERR30;
+           goto FAILED;
+           }
+         /* If matching is caseless, upper and lower are converted to
+         alpha. This relies on the fact that the class table starts with
+         alpha, lower, upper as the first 3 entries. */
+         if ((options & PCRE_CASELESS) != 0 && posix_class <= 2)
+           posix_class = 0;
+         /* Or into the map we are building up to 3 of the static class
+         tables, or their negations. */
+         posix_class *= 3;
+         for (i = 0; i < 3; i++)
+           {
+           int taboffset = posix_class_maps[posix_class + i];
+           if (taboffset < 0) break;
+           if (local_negate)
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+taboffset];
+           else
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+taboffset];
+           }
+         ptr = tempptr + 1;
+         class_charcount = 10;  /* Set > 1; assumes more than 1 per class */
+         continue;
+         }
        /* Backslash may introduce a single character, or it may introduce one
        of the specials, which just set a flag. Escaped items are checked for
        validity in the pre-compiling pass. The sequence \b is a special case.
-       Inside a class (and only there) it is treated as backslash. Elsewhere
+       Inside a class (and only there) it is treated as backspace. Elsewhere
        it marks a word boundary. Other escapes have preset maps ready to
        or into the one we are building. We assume they have more than one
        character in them, so set class_count bigger than one. */
        if (c == '\\')
          {
-         c = check_escape(&ptr, errorptr, *brackets, options, TRUE);
+         c = check_escape(&ptr, errorptr, *brackets, options, TRUE, cd);
          if (-c == ESC_b) c = '\b';
          else if (c < 0)
            {
+           register const uschar *cbits = cd->cbits;
            class_charcount = 10;
            switch (-c)
              {
              case ESC_d:
-             for (c = 0; c < 32; c++) class[c] |= pcre_cbits[c+cbit_digit];
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_digit];
              continue;
              case ESC_D:
-             for (c = 0; c < 32; c++) class[c] |= ~pcre_cbits[c+cbit_digit];
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_digit];
              continue;
              case ESC_w:
-             for (c = 0; c < 32; c++)
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_word];
-               class[c] |= (pcre_cbits[c] | pcre_cbits[c+cbit_word]);
              continue;
              case ESC_W:
-             for (c = 0; c < 32; c++)
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_word];
-               class[c] |= ~(pcre_cbits[c] | pcre_cbits[c+cbit_word]);
              continue;
              case ESC_s:
-             for (c = 0; c < 32; c++) class[c] |= pcre_cbits[c+cbit_space];
+             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_space];
              continue;
              case ESC_S:
-             for (c = 0; c < 32; c++) class[c] |= ~pcre_cbits[c+cbit_space];
+             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_space];
              continue;
              default:
-Line 738 
 for (;; ptr++)
+Line 1226 
 for (;; ptr++)
              goto FAILED;
              }
            }
-         /* Fall through if single character */
+         /* Fall through if single character, but don't at present allow
+         chars > 255 in UTF-8 mode. */
+ #ifdef SUPPORT_UTF8
+         if (c > 255)
+           {
+           *errorptr = ERR33;
+           goto FAILED;
+           }
+ #endif
          }
        /* A single character may be followed by '-' to form a range. However,
-Line 758 
 for (;; ptr++)
+Line 1256 
 for (;; ptr++)
            }
          /* The second part of a range can be a single-character escape, but
-         not any of the other escapes. */
+         not any of the other escapes. Perl 5.6 treats a hyphen as a literal
+         in such circumstances. */
          if (d == '\\')
            {
-           d = check_escape(&ptr, errorptr, *brackets, options, TRUE);
+           const uschar *oldptr = ptr;
+           d = check_escape(&ptr, errorptr, *brackets, options, TRUE, cd);
+ #ifdef SUPPORT_UTF8
+           if (d > 255)
+             {
+             *errorptr = ERR33;
+             goto FAILED;
+             }
+ #endif
+           /* \b is backslash; any other special means the '-' was literal */
            if (d < 0)
              {
              if (d == -ESC_b) d = '\b'; else
                {
-               *errorptr = ERR7;
+               ptr = oldptr - 2;
-               goto FAILED;
+               goto SINGLE_CHARACTER;  /* A few lines below */
                }
              }
            }
-Line 784 
 for (;; ptr++)
+Line 1294 
 for (;; ptr++)
            class[c/8] |= (1 << (c&7));
            if ((options & PCRE_CASELESS) != 0)
              {
-             int uc = pcre_fcc[c];           /* flip case */
+             int uc = cd->fcc[c];           /* flip case */
              class[uc/8] |= (1 << (uc&7));
              }
            class_charcount++;                /* in case a one-char range */
-Line 796 
 for (;; ptr++)
+Line 1306 
 for (;; ptr++)
        /* Handle a lone single character - we can get here for a normal
        non-escape char, or after \ that introduces a single character. */
+       SINGLE_CHARACTER:
        class [c/8] |= (1 << (c&7));
        if ((options & PCRE_CASELESS) != 0)
          {
-         c = pcre_fcc[c];   /* flip case */
+         c = cd->fcc[c];   /* flip case */
          class[c/8] |= (1 << (c&7));
          }
        class_charcount++;
-Line 846 
 for (;; ptr++)
+Line 1358 
 for (;; ptr++)
      /* Various kinds of repeat */
      case '{':
-     if (!is_counted_repeat(ptr+1)) goto NORMAL_CHAR;
+     if (!is_counted_repeat(ptr+1, cd)) goto NORMAL_CHAR;
-     ptr = read_repeat_counts(ptr+1, &repeat_min, &repeat_max, errorptr);
+     ptr = read_repeat_counts(ptr+1, &repeat_min, &repeat_max, errorptr, cd);
      if (*errorptr != NULL) goto FAILED;
      goto REPEAT;
-Line 872 
 for (;; ptr++)
+Line 1384 
 for (;; ptr++)
        goto FAILED;
        }
-     /* If the next character is '?' this is a minimizing repeat. Advance to the
+     /* If the next character is '?' this is a minimizing repeat, by default,
+     but if PCRE_UNGREEDY is set, it works the other way round. Advance to the
      next character. */
-     if (ptr[1] == '?') { repeat_type = 1; ptr++; } else repeat_type = 0;
+     if (ptr[1] == '?')
+       { repeat_type = greedy_non_default; ptr++; }
-     /* If the maximum is zero then the minimum must also be zero; Perl allows
+     else repeat_type = greedy_default;
-     this case, so we do too - by simply omitting the item altogether. */
-     if (repeat_max == 0) code = previous;
      /* If previous was a string of characters, chop off the last one and use it
      as the subject of the repeat. If there was only one character, we can
-     abolish the previous item altogether. */
+     abolish the previous item altogether. A repeat with a zero minimum wipes
+     out any reqchar setting, backing up to the previous value. We must also
+     adjust the countlits value. */
-     else if (*previous == OP_CHARS)
+     if (*previous == OP_CHARS)
        {
        int len = previous[1];
+       if (repeat_min == 0) *reqchar = prevreqchar;
+       *countlits += repeat_min - 1;
        if (len == 1)
          {
          c = previous[2];
-Line 920 
 for (;; ptr++)
+Line 1436 
 for (;; ptr++)
      create a suitable repeat item. The code is shared with single-character
      repeats by adding a suitable offset into repeat_type. */
-     else if ((int)*previous < OP_EOD || *previous == OP_ANY)
+     else if ((int)*previous < OP_EODN || *previous == OP_ANY)
        {
        op_type = OP_TYPESTAR - OP_STAR;  /* Use type opcodes */
        c = *previous;
        code = previous;
        OUTPUT_SINGLE_REPEAT:
-       repeat_type += op_type;      /* Combine both values for many cases */
+       /* If the maximum is zero then the minimum must also be zero; Perl allows
+       this case, so we do too - by simply omitting the item altogether. */
+       if (repeat_max == 0) goto END_REPEAT;
+       /* Combine the op_type with the repeat_type */
+       repeat_type += op_type;
        /* A minimum of zero is handled either as the special case * or ?, or as
        an UPTO, with the maximum given. */
-Line 964 
 for (;; ptr++)
+Line 1488 
 for (;; ptr++)
          /* If the mininum is 1 and the previous item was a character string,
          we either have to put back the item that got cancelled if the string
          length was 1, or add the character back onto the end of a longer
-         string. For a character type nothing need be done; it will just get put
+         string. For a character type nothing need be done; it will just get
-         back naturally. */
+         put back naturally. Note that the final character is always going to
+         get added below. */
          else if (*previous == OP_CHARS)
            {
            if (code == previous) code += 2; else previous[1]++;
            }
-         /* Insert an UPTO if the max is greater than the min. */
+         /*  For a single negated character we also have to put back the
+         item that got cancelled. */
+         else if (*previous == OP_NOT) code++;
+         /* If the maximum is unlimited, insert an OP_STAR. */
-         if (repeat_max != repeat_min)
+         if (repeat_max < 0)
+           {
+           *code++ = c;
+           *code++ = OP_STAR + repeat_type;
+           }
+         /* Else insert an UPTO if the max is greater than the min. */
+         else if (repeat_max != repeat_min)
            {
            *code++ = c;
            repeat_max -= repeat_min;
-Line 990 
 for (;; ptr++)
+Line 1528 
 for (;; ptr++)
        }
      /* If previous was a character class or a back reference, we put the repeat
-     stuff after it. */
+     stuff after it, but just skip the item if the repeat was {0,0}. */
      else if (*previous == OP_CLASS || *previous == OP_REF)
        {
+       if (repeat_max == 0)
+         {
+         code = previous;
+         goto END_REPEAT;
+         }
        if (repeat_min == 0 && repeat_max == -1)
          *code++ = OP_CRSTAR + repeat_type;
        else if (repeat_min == 1 && repeat_max == -1)
-Line 1012 
 for (;; ptr++)
+Line 1555 
 for (;; ptr++)
        }
      /* If previous was a bracket group, we may have to replicate it in certain
-     cases. If the maximum repeat count is unlimited, check that the bracket
+     cases. */
-     group cannot match the empty string, and diagnose an error if it can. */
-     else if ((int)*previous >= OP_BRA)
+     else if ((int)*previous >= OP_BRA || (int)*previous == OP_ONCE ||
+              (int)*previous == OP_COND)
        {
-       int i;
+       register int i;
-       int length = code - previous;
+       int ketoffset = 0;
+       int len = code - previous;
+       uschar *bralink = NULL;
+       /* If the maximum repeat count is unlimited, find the end of the bracket
+       by scanning through from the start, and compute the offset back to it
+       from the current code pointer. There may be an OP_OPT setting following
+       the final KET, so we can't find the end just by going back from the code
+       pointer. */
+       if (repeat_max == -1)
+         {
+         register uschar *ket = previous;
+         do ket += (ket[1] << 8) + ket[2]; while (*ket != OP_KET);
+         ketoffset = code - ket;
+         }
+       /* The case of a zero minimum is special because of the need to stick
+       OP_BRAZERO in front of it, and because the group appears once in the
+       data, whereas in other cases it appears the minimum number of times. For
+       this reason, it is simplest to treat this case separately, as otherwise
+       the code gets far too messy. There are several special subcases when the
+       minimum is zero. */
-       if (repeat_max == -1 && could_be_empty(previous))
+       if (repeat_min == 0)
          {
-         *errorptr = ERR10;
+         /* If we set up a required char from the bracket, we must back off
-         goto FAILED;
+         to the previous value and reset the countlits value too. */
-         }
-       /* If the minimum is greater than zero, and the maximum is unlimited or
+         if (subcountlits > 0)
-       equal to the minimum, the first copy remains where it is, and is
+           {
-       replicated up to the minimum number of times. This case includes the +
+           *reqchar = prevreqchar;
-       repeat, but of course no replication is needed in that case. */
+           *countlits -= subcountlits;
+           }
-       if (repeat_min > 0 && (repeat_max == -1 || repeat_max == repeat_min))
+         /* If the maximum is also zero, we just omit the group from the output
-         {
+         altogether. */
-         for (i = 1; i < repeat_min; i++)
+         if (repeat_max == 0)
            {
-           memcpy(code, previous, length);
+           code = previous;
-           code += length;
+           goto END_REPEAT;
            }
-         }
-       /* If the minimum is zero, stick BRAZERO in front of the first copy.
+         /* If the maximum is 1 or unlimited, we just have to stick in the
-       Then, if there is a fixed upper limit, replicated up to that many times,
+         BRAZERO and do no more at this point. */
-       sticking BRAZERO in front of all the optional ones. */
-       else
+         if (repeat_max <= 1)
-         {
-         if (repeat_min == 0)
            {
-           memmove(previous+1, previous, length);
+           memmove(previous+1, previous, len);
            code++;
            *previous++ = OP_BRAZERO + repeat_type;
            }
+         /* If the maximum is greater than 1 and limited, we have to replicate
+         in a nested fashion, sticking OP_BRAZERO before each set of brackets.
+         The first one has to be handled carefully because it's the original
+         copy, which has to be moved up. The remainder can be handled by code
+         that is common with the non-zero minimum case below. We just have to
+         adjust the value or repeat_max, since one less copy is required. */
+         else
+           {
+           int offset;
+           memmove(previous+4, previous, len);
+           code += 4;
+           *previous++ = OP_BRAZERO + repeat_type;
+           *previous++ = OP_BRA;
+           /* We chain together the bracket offset fields that have to be
+           filled in later when the ends of the brackets are reached. */
+           offset = (bralink == NULL)? 0 : previous - bralink;
+           bralink = previous;
+           *previous++ = offset >> 8;
+           *previous++ = offset & 255;
+           }
+         repeat_max--;
+         }
+       /* If the minimum is greater than zero, replicate the group as many
+       times as necessary, and adjust the maximum to the number of subsequent
+       copies that we need. */
+       else
+         {
          for (i = 1; i < repeat_min; i++)
            {
-           memcpy(code, previous, length);
+           memcpy(code, previous, len);
-           code += length;
+           code += len;
            }
+         if (repeat_max > 0) repeat_max -= repeat_min;
+         }
+       /* This code is common to both the zero and non-zero minimum cases. If
+       the maximum is limited, it replicates the group in a nested fashion,
+       remembering the bracket starts on a stack. In the case of a zero minimum,
+       the first one was set up above. In all cases the repeat_max now specifies
+       the number of additional copies needed. */
-         for (i = (repeat_min > 0)? repeat_min : 1; i < repeat_max; i++)
+       if (repeat_max >= 0)
+         {
+         for (i = repeat_max - 1; i >= 0; i--)
            {
            *code++ = OP_BRAZERO + repeat_type;
-           memcpy(code, previous, length);
-           code += length;
+           /* All but the final copy start a new nesting, maintaining the
+           chain of brackets outstanding. */
+           if (i != 0)
+             {
+             int offset;
+             *code++ = OP_BRA;
+             offset = (bralink == NULL)? 0 : code - bralink;
+             bralink = code;
+             *code++ = offset >> 8;
+             *code++ = offset & 255;
+             }
+           memcpy(code, previous, len);
+           code += len;
+           }
+         /* Now chain through the pending brackets, and fill in their length
+         fields (which are holding the chain links pro tem). */
+         while (bralink != NULL)
+           {
+           int oldlinkoffset;
+           int offset = code - bralink + 1;
+           uschar *bra = code - offset;
+           oldlinkoffset = (bra[1] << 8) + bra[2];
+           bralink = (oldlinkoffset == 0)? NULL : bralink - oldlinkoffset;
+           *code++ = OP_KET;
+           *code++ = bra[1] = offset >> 8;
+           *code++ = bra[2] = (offset & 255);
            }
          }
-       /* If the maximum is unlimited, set a repeater in the final copy. */
+       /* If the maximum is unlimited, set a repeater in the final copy. We
+       can't just offset backwards from the current code point, because we
+       don't know if there's been an options resetting after the ket. The
+       correct offset was computed above. */
-       if (repeat_max == -1) code[-3] = OP_KETRMAX + repeat_type;
+       else code[-ketoffset] = OP_KETRMAX + repeat_type;
        }
      /* Else there's some kind of shambles */
-Line 1082 
 for (;; ptr++)
+Line 1719 
 for (;; ptr++)
      /* In all case we no longer have a previous item. */
+     END_REPEAT:
      previous = NULL;
      break;
-     /* Start of nested bracket sub-expression, or comment or lookahead.
+     /* Start of nested bracket sub-expression, or comment or lookahead or
-     First deal with special things that can come after a bracket; all are
+     lookbehind or option setting or condition. First deal with special things
-     introduced by ?, and the appearance of any of them means that this is not a
+     that can come after a bracket; all are introduced by ?, and the appearance
-     referencing group. They were checked for validity in the first pass over
+     of any of them means that this is not a referencing group. They were
-     the string, so we don't have to check for syntax errors here.  */
+     checked for validity in the first pass over the string, so we don't have to
+     check for syntax errors here.  */
      case '(':
-     previous = code;              /* Only real brackets can be repeated */
+     newoptions = options;
+     skipbytes = 0;
      if (*(++ptr) == '?')
        {
-       bravalue = OP_BRA;
+       int set, unset;
+       int *optset;
        switch (*(++ptr))
          {
-         case '#':
+         case '#':                 /* Comment; skip to ket */
-         case 'i':
-         case 'm':
-         case 's':
-         case 'x':
          ptr++;
          while (*ptr != ')') ptr++;
-         previous = NULL;
          continue;
          case ':':                 /* Non-extracting bracket */
+         bravalue = OP_BRA;
          ptr++;
          break;
-         case '=':                 /* Assertions can't be repeated */
+         case '(':
+         bravalue = OP_COND;       /* Conditional group */
+         if ((cd->ctypes[*(++ptr)] & ctype_digit) != 0)
+           {
+           int condref = *ptr - '0';
+           while (*(++ptr) != ')') condref = condref*10 + *ptr - '0';
+           if (condref == 0)
+             {
+             *errorptr = ERR35;
+             goto FAILED;
+             }
+           ptr++;
+           code[3] = OP_CREF;
+           code[4] = condref >> 8;
+           code[5] = condref & 255;
+           skipbytes = 3;
+           }
+         else ptr--;
+         break;
+         case '=':                 /* Positive lookahead */
          bravalue = OP_ASSERT;
          ptr++;
-         previous = NULL;
          break;
-         case '!':
+         case '!':                 /* Negative lookahead */
          bravalue = OP_ASSERT_NOT;
          ptr++;
-         previous = NULL;
          break;
-         case '>':                         /* "Match once" brackets */
+         case '<':                 /* Lookbehinds */
-         if ((options & PCRE_EXTRA) != 0)  /* Not yet standard */
+         switch (*(++ptr))
            {
-           bravalue = OP_ONCE;
+           case '=':               /* Positive lookbehind */
+           bravalue = OP_ASSERTBACK;
            ptr++;
-           previous = NULL;
            break;
+           case '!':               /* Negative lookbehind */
+           bravalue = OP_ASSERTBACK_NOT;
+           ptr++;
+           break;
+           default:                /* Syntax error */
+           *errorptr = ERR24;
+           goto FAILED;
            }
-         /* Else fall through */
+         break;
-         default:
+         case '>':                 /* One-time brackets */
-         *errorptr = ERR12;
+         bravalue = OP_ONCE;
-         goto FAILED;
+         ptr++;
+         break;
+         case 'R':                 /* Pattern recursion */
+         *code++ = OP_RECURSE;
+         ptr++;
+         continue;
+         default:                  /* Option setting */
+         set = unset = 0;
+         optset = &set;
+         while (*ptr != ')' && *ptr != ':')
+           {
+           switch (*ptr++)
+             {
+             case '-': optset = &unset; break;
+             case 'i': *optset |= PCRE_CASELESS; break;
+             case 'm': *optset |= PCRE_MULTILINE; break;
+             case 's': *optset |= PCRE_DOTALL; break;
+             case 'x': *optset |= PCRE_EXTENDED; break;
+             case 'U': *optset |= PCRE_UNGREEDY; break;
+             case 'X': *optset |= PCRE_EXTRA; break;
+             default:
+             *errorptr = ERR12;
+             goto FAILED;
+             }
+           }
+         /* Set up the changed option bits, but don't change anything yet. */
+         newoptions = (options | set) & (~unset);
+         /* If the options ended with ')' this is not the start of a nested
+         group with option changes, so the options change at this level. At top
+         level there is nothing else to be done (the options will in fact have
+         been set from the start of compiling as a result of the first pass) but
+         at an inner level we must compile code to change the ims options if
+         necessary, and pass the new setting back so that it can be put at the
+         start of any following branches, and when this group ends, a resetting
+         item can be compiled. */
+         if (*ptr == ')')
+           {
+           if ((options & PCRE_INGROUP) != 0 &&
+               (options & PCRE_IMS) != (newoptions & PCRE_IMS))
+             {
+             *code++ = OP_OPT;
+             *code++ = *optchanged = newoptions & PCRE_IMS;
+             }
+           options = newoptions;  /* Change options at this level */
+           previous = NULL;       /* This item can't be repeated */
+           continue;              /* It is complete */
+           }
+         /* If the options ended with ':' we are heading into a nested group
+         with possible change of options. Such groups are non-capturing and are
+         not assertions of any kind. All we need to do is skip over the ':';
+         the newoptions value is handled below. */
+         bravalue = OP_BRA;
+         ptr++;
          }
        }
-     /* Else we have a referencing group */
+     /* Else we have a referencing group; adjust the opcode. If the bracket
+     number is greater than EXTRACT_BASIC_MAX, we set the opcode one higher, and
+     arrange for the true number to follow later, in an OP_BRANUMBER item. */
      else
        {
-       if (++(*brackets) > EXTRACT_MAX)
+       if (++(*brackets) > EXTRACT_BASIC_MAX)
          {
-         *errorptr = ERR13;
+         bravalue = OP_BRA + EXTRACT_BASIC_MAX + 1;
-         goto FAILED;
+         code[3] = OP_BRANUMBER;
+         code[4] = *brackets >> 8;
+         code[5] = *brackets & 255;
+         skipbytes = 3;
          }
-       bravalue = OP_BRA + *brackets;
+       else bravalue = OP_BRA + *brackets;
        }
-     /* Process nested bracketed re; at end pointer is on the bracket. We copy
+     /* Process nested bracketed re. Assertions may not be repeated, but other
-     code into a non-register variable in order to be able to pass its address
+     kinds can be. We copy code into a non-register variable in order to be able
-     because some compilers complain otherwise. */
+     to pass its address because some compilers complain otherwise. Pass in a
+     new setting for the ims options if they have changed. */
+     previous = (bravalue >= OP_ONCE)? code : NULL;
      *code = bravalue;
+     tempcode = code;
+     if (!compile_regex(
+          options | PCRE_INGROUP,       /* Set for all nested groups */
+          ((options & PCRE_IMS) != (newoptions & PCRE_IMS))?
+            newoptions & PCRE_IMS : -1, /* Pass ims options if changed */
+          brackets,                     /* Extracting bracket count */
+          &tempcode,                    /* Where to put code (updated) */
+          &ptr,                         /* Input pointer (updated) */
+          errorptr,                     /* Where to put an error message */
+          (bravalue == OP_ASSERTBACK ||
+           bravalue == OP_ASSERTBACK_NOT), /* TRUE if back assert */
+          skipbytes,                    /* Skip over OP_COND/OP_BRANUMBER */
+          &subreqchar,                  /* For possible last char */
+          &subcountlits,                /* For literal count */
+          cd))                          /* Tables block */
+       goto FAILED;
+     /* At the end of compiling, code is still pointing to the start of the
+     group, while tempcode has been updated to point past the end of the group
+     and any option resetting that may follow it. The pattern pointer (ptr)
+     is on the bracket. */
+     /* If this is a conditional bracket, check that there are no more than
+     two branches in the group. */
+     else if (bravalue == OP_COND)
        {
-       uschar *mcode = code;
+       uschar *tc = code;
-       if (!compile_regex(options, brackets, &mcode, &ptr, errorptr))
+       condcount = 0;
+       do {
+          condcount++;
+          tc += (tc[1] << 8) | tc[2];
+          }
+       while (*tc != OP_KET);
+       if (condcount > 2)
+         {
+         *errorptr = ERR27;
          goto FAILED;
-       code = mcode;
+         }
        }
+     /* Handle updating of the required character. If the subpattern didn't
+     set one, leave it as it was. Otherwise, update it for normal brackets of
+     all kinds, forward assertions, and conditions with two branches. Don't
+     update the literal count for forward assertions, however. If the bracket
+     is followed by a quantifier with zero repeat, we have to back off. Hence
+     the definition of prevreqchar and subcountlits outside the main loop so
+     that they can be accessed for the back off. */
+     if (subreqchar > 0 &&
+          (bravalue >= OP_BRA || bravalue == OP_ONCE || bravalue == OP_ASSERT ||
+          (bravalue == OP_COND && condcount == 2)))
+       {
+       prevreqchar = *reqchar;
+       *reqchar = subreqchar;
+       if (bravalue != OP_ASSERT) *countlits += subcountlits;
+       }
+     /* Now update the main code pointer to the end of the group. */
+     code = tempcode;
+     /* Error if hit end of pattern */
      if (*ptr != ')')
        {
        *errorptr = ERR14;
-Line 1178 
 for (;; ptr++)
+Line 1973 
 for (;; ptr++)
      for validity in the pre-compiling pass. */
      case '\\':
-     oldptr = ptr;
+     tempptr = ptr;
-     c = check_escape(&ptr, errorptr, *brackets, options, FALSE);
+     c = check_escape(&ptr, errorptr, *brackets, options, FALSE, cd);
      /* Handle metacharacters introduced by \. For ones like \d, the ESC_ values
      are arranged to be the negation of the corresponding OP_values. For the
-Line 1192 
 for (;; ptr++)
+Line 1987 
 for (;; ptr++)
        {
        if (-c >= ESC_REF)
          {
-         int refnum = -c - ESC_REF;
+         int number = -c - ESC_REF;
-         if (*brackets < refnum)
-           {
-           *errorptr = ERR15;
-           goto FAILED;
-           }
          previous = code;
          *code++ = OP_REF;
-         *code++ = refnum;
+         *code++ = number >> 8;
+         *code++ = number & 255;
          }
        else
          {
-         previous = (-c > ESC_b && -c < ESC_X)? code : NULL;
+         previous = (-c > ESC_b && -c < ESC_Z)? code : NULL;
          *code++ = -c;
          }
        continue;
        }
-     /* Reset and fall through */
+     /* Data character: reset and fall through */
-     ptr = oldptr;
+     ptr = tempptr;
      c = '\\';
      /* Handle a run of data characters until a metacharacter is encountered.
-Line 1230 
 for (;; ptr++)
+Line 2021 
 for (;; ptr++)
        {
        if ((options & PCRE_EXTENDED) != 0)
          {
-         if ((pcre_ctypes[c] & ctype_space) != 0) continue;
+         if ((cd->ctypes[c] & ctype_space) != 0) continue;
          if (c == '#')
            {
-           while ((c = *(++ptr)) != 0 && c != '\n');
+           /* The space before the ; is to avoid a warning on a silly compiler
+           on the Macintosh. */
+           while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
            if (c == 0) break;
            continue;
            }
-Line 1245 
 for (;; ptr++)
+Line 2038 
 for (;; ptr++)
        if (c == '\\')
          {
-         oldptr = ptr;
+         tempptr = ptr;
-         c = check_escape(&ptr, errorptr, *brackets, options, FALSE);
+         c = check_escape(&ptr, errorptr, *brackets, options, FALSE, cd);
-         if (c < 0) { ptr = oldptr; break; }
+         if (c < 0) { ptr = tempptr; break; }
+         /* If a character is > 127 in UTF-8 mode, we have to turn it into
+         two or more characters in the UTF-8 encoding. */
+ #ifdef SUPPORT_UTF8
+         if (c > 127 && (options & PCRE_UTF8) != 0)
+           {
+           uschar buffer[8];
+           int len = ord2utf8(c, buffer);
+           for (c = 0; c < len; c++) *code++ = buffer[c];
+           length += len;
+           continue;
+           }
+ #endif
          }
        /* Ordinary character or single-char escape */
-Line 1258 
 for (;; ptr++)
+Line 2065 
 for (;; ptr++)
      /* This "while" is the end of the "do" above. */
-     while (length < 255 && (pcre_ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     while (length < MAXLIT && (cd->ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     /* Update the last character and the count of literals */
+     prevreqchar = (length > 1)? code[-2] : *reqchar;
+     *reqchar = code[-1];
+     *countlits += length;
      /* Compute the length and set it in the data vector, and advance to
      the next state. */
      previous[1] = length;
-     ptr--;
+     if (length < MAXLIT) ptr--;
      break;
      }
    }                   /* end of big loop */
-Line 1288 
 return FALSE;
+Line 2101 
 return FALSE;
  /* On entry, ptr is pointing past the bracket character, but on return
  it points to the closing bracket, or vertical bar, or end of string.
  The code variable is pointing at the byte into which the BRA operator has been
- stored.
+ stored. If the ims options are changed at the start (for a (?ims: group) or
+ during any branch, we need to insert an OP_OPT item at the start of every
+ following branch to ensure they get set correctly at run time, and also pass
+ the new options into every subsequent branch compile.
  Argument:
-   options   the option bits
+   options     the option bits
-   brackets  -> int containing the number of extracting brackets used
+   optchanged  new ims options to set as if (?ims) were at the start, or -1
-   codeptr   -> the address of the current code pointer
+                for no change
-   ptrptr    -> the address of the current pattern pointer
+   brackets    -> int containing the number of extracting brackets used
-   errorptr  -> pointer to error message
+   codeptr     -> the address of the current code pointer
+   ptrptr      -> the address of the current pattern pointer
+   errorptr    -> pointer to error message
+   lookbehind  TRUE if this is a lookbehind assertion
+   skipbytes   skip this many bytes at start (for OP_COND, OP_BRANUMBER)
+   reqchar     -> place to put the last required character, or a negative number
+   countlits   -> place to put the shortest literal count of any branch
+   cd          points to the data block with tables pointers
- Returns:    TRUE on success
+ Returns:      TRUE on success
  */
  static BOOL
- compile_regex(int options, int *brackets, uschar **codeptr, uschar **ptrptr,
+ compile_regex(int options, int optchanged, int *brackets, uschar **codeptr,
-   char **errorptr)
+   const uschar **ptrptr, const char **errorptr, BOOL lookbehind, int skipbytes,
+   int *reqchar, int *countlits, compile_data *cd)
  {
- uschar *ptr = *ptrptr;
+ const uschar *ptr = *ptrptr;
  uschar *code = *codeptr;
+ uschar *last_branch = code;
  uschar *start_bracket = code;
+ uschar *reverse_count = NULL;
+ int oldoptions = options & PCRE_IMS;
+ int branchreqchar, branchcountlits;
+ *reqchar = -1;
+ *countlits = INT_MAX;
+ code += 3 + skipbytes;
+ /* Loop for each alternative branch */
  for (;;)
    {
    int length;
-   uschar *last_branch = code;
-   code += 3;
+   /* Handle change of options */
-   if (!compile_branch(options, brackets, &code, &ptr, errorptr))
+   if (optchanged >= 0)
+     {
+     *code++ = OP_OPT;
+     *code++ = optchanged;
+     options = (options & ~PCRE_IMS) | optchanged;
+     }
+   /* Set up dummy OP_REVERSE if lookbehind assertion */
+   if (lookbehind)
+     {
+     *code++ = OP_REVERSE;
+     reverse_count = code;
+     *code++ = 0;
+     *code++ = 0;
+     }
+   /* Now compile the branch */
+   if (!compile_branch(options, brackets, &code, &ptr, errorptr, &optchanged,
+       &branchreqchar, &branchcountlits, cd))
      {
      *ptrptr = ptr;
      return FALSE;
      }
    /* Fill in the length of the last branch */
+   length = code - last_branch;
+   last_branch[1] = length >> 8;
+   last_branch[2] = length & 255;
+   /* Save the last required character if all branches have the same; a current
+   value of -1 means unset, while -2 means "previous branch had no last required
+   char".  */
+   if (*reqchar != -2)
+     {
+     if (branchreqchar >= 0)
+       {
+       if (*reqchar == -1) *reqchar = branchreqchar;
+       else if (*reqchar != branchreqchar) *reqchar = -2;
+       }
+     else *reqchar = -2;
+     }
+   /* Keep the shortest literal count */
-   length = code - last_branch;
+   if (branchcountlits < *countlits) *countlits = branchcountlits;
-   last_branch[1] = length >> 8;
+   DPRINTF(("literal count = %d min=%d\n", branchcountlits, *countlits));
-   last_branch[2] = length & 255;
+   /* If lookbehind, check that this branch matches a fixed-length string,
+   and put the length into the OP_REVERSE item. Temporarily mark the end of
+   the branch with OP_END. */
+   if (lookbehind)
+     {
+     *code = OP_END;
+     length = find_fixedlength(last_branch, options);
+     DPRINTF(("fixed length = %d\n", length));
+     if (length < 0)
+       {
+       *errorptr = ERR25;
+       *ptrptr = ptr;
+       return FALSE;
+       }
+     reverse_count[0] = (length >> 8);
+     reverse_count[1] = length & 255;
+     }
    /* Reached end of expression, either ')' or end of pattern. Insert a
    terminating ket and the length of the whole bracketed item, and return,
-   leaving the pointer at the terminating char. */
+   leaving the pointer at the terminating char. If any of the ims options
+   were changed inside the group, compile a resetting op-code following. */
    if (*ptr != '|')
      {
-Line 1336 
 for (;;)
+Line 2229 
 for (;;)
      *code++ = OP_KET;
      *code++ = length >> 8;
      *code++ = length & 255;
+     if (optchanged >= 0)
+       {
+       *code++ = OP_OPT;
+       *code++ = oldoptions;
+       }
      *codeptr = code;
      *ptrptr = ptr;
      return TRUE;
-Line 1344 
 for (;;)
+Line 2242 
 for (;;)
    /* Another branch follows; insert an "or" node and advance the pointer. */
    *code = OP_ALT;
+   last_branch = code;
+   code += 3;
    ptr++;
    }
  /* Control never reaches here */
-Line 1351 
 for (;;)
+Line 2251 
 for (;;)
+ /*************************************************
+ *      Find first significant op code            *
+ *************************************************/
+ /* This is called by several functions that scan a compiled expression looking
+ for a fixed first character, or an anchoring op code etc. It skips over things
+ that do not influence this. For one application, a change of caseless option is
+ important.
+ Arguments:
+   code       pointer to the start of the group
+   options    pointer to external options
+   optbit     the option bit whose changing is significant, or
+              zero if none are
+   optstop    TRUE to return on option change, otherwise change the options
+                value and continue
+ Returns:     pointer to the first significant opcode
+ */
+ static const uschar*
+ first_significant_code(const uschar *code, int *options, int optbit,
+   BOOL optstop)
+ {
+ for (;;)
+   {
+   switch ((int)*code)
+     {
+     case OP_OPT:
+     if (optbit > 0 && ((int)code[1] & optbit) != (*options & optbit))
+       {
+       if (optstop) return code;
+       *options = (int)code[1];
+       }
+     code += 2;
+     break;
+     case OP_CREF:
+     case OP_BRANUMBER:
+     code += 3;
+     break;
+     case OP_WORD_BOUNDARY:
+     case OP_NOT_WORD_BOUNDARY:
+     code++;
+     break;
+     case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
+     do code += (code[1] << 8) + code[2]; while (*code == OP_ALT);
+     code += 3;
+     break;
+     default:
+     return code;
+     }
+   }
+ /* Control never reaches here */
+ }
  /*************************************************
  *          Check for anchored expression         *
  *************************************************/
-Line 1361 
 all of whose alternatives start with OP_
+Line 2326 
 all of whose alternatives start with OP_
  it's anchored. However, if this is a multiline pattern, then only OP_SOD
  counts, since OP_CIRC can match in the middle.
- A branch is also implicitly anchored if it starts with .* because that will try
+ A branch is also implicitly anchored if it starts with .* and DOTALL is set,
- the rest of the pattern at all possible matching points, so there is no point
+ because that will try the rest of the pattern at all possible matching points,
- trying them again.
+ so there is no point trying them again.
- Argument:  points to start of expression (the bracket)
+ Arguments:
- Returns:   TRUE or FALSE
+   code       points to start of expression (the bracket)
+   options    points to the options setting
+ Returns:     TRUE or FALSE
  */
  static BOOL
- is_anchored(register uschar *code, BOOL multiline)
+ is_anchored(register const uschar *code, int *options)
  {
  do {
-    int op = (int)code[3];
+    const uschar *scode = first_significant_code(code + 3, options,
-    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE)
+      PCRE_MULTILINE, FALSE);
-      { if (!is_anchored(code+3, multiline)) return FALSE; }
+    register int op = *scode;
-    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
+    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
-      { if (code[4] != OP_ANY) return FALSE; }
+      { if (!is_anchored(scode, options)) return FALSE; }
-    else if (op != OP_SOD && (multiline || op != OP_CIRC)) return FALSE;
+    else if ((op == OP_TYPESTAR || op == OP_TYPEMINSTAR) &&
+             (*options & PCRE_DOTALL) != 0)
+      { if (scode[1] != OP_ANY) return FALSE; }
+    else if (op != OP_SOD &&
+            ((*options & PCRE_MULTILINE) != 0 || op != OP_CIRC))
+      return FALSE;
     code += (code[1] << 8) + code[2];
     }
  while (*code == OP_ALT);
-Line 1388 
 return TRUE;
+Line 2361 
 return TRUE;
  /*************************************************
- *     Check for start with \n line expression    *
+ *         Check for starting with ^ or .*        *
  *************************************************/
- /* This is called for multiline expressions to try to find out if every branch
+ /* This is called to find out if every branch starts with ^ or .* so that
- starts with ^ so that "first char" processing can be done to speed things up.
+ "first char" processing can be done to speed things up in multiline
+ matching and for non-DOTALL patterns that start with .* (which must start at
+ the beginning or after \n).
  Argument:  points to start of expression (the bracket)
  Returns:   TRUE or FALSE
  */
  static BOOL
- is_startline(uschar *code)
+ is_startline(const uschar *code)
  {
  do {
-    if ((int)code[3] >= OP_BRA || code[3] == OP_ASSERT)
+    const uschar *scode = first_significant_code(code + 3, NULL, 0, FALSE);
-      { if (!is_startline(code+3)) return FALSE; }
+    register int op = *scode;
-    else if (code[3] != OP_CIRC) return FALSE;
+    if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
+      { if (!is_startline(scode)) return FALSE; }
+    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
+      { if (scode[1] != OP_ANY) return FALSE; }
+    else if (op != OP_CIRC) return FALSE;
     code += (code[1] << 8) + code[2];
     }
  while (*code == OP_ALT);
-Line 1423 
 Consider each alternative branch. If the
+Line 2402 
 Consider each alternative branch. If the
  a bracket all of whose alternatives start with the same char (recurse ad lib),
  then we return that char, otherwise -1.
- Argument:  points to start of expression (the bracket)
+ Arguments:
- Returns:   -1 or the fixed first char
+   code       points to start of expression (the bracket)
+   options    pointer to the options (used to check casing changes)
+ Returns:     -1 or the fixed first char
  */
  static int
- find_firstchar(uschar *code)
+ find_firstchar(const uschar *code, int *options)
  {
  register int c = -1;
- do
+ do {
-   {
+    int d;
-   register int charoffset = 4;
+    const uschar *scode = first_significant_code(code + 3, options,
+      PCRE_CASELESS, TRUE);
-   if ((int)code[3] >= OP_BRA || code[3] == OP_ASSERT)
+    register int op = *scode;
-     {
-     register int d;
+    if (op >= OP_BRA) op = OP_BRA;
-     if ((d = find_firstchar(code+3)) < 0) return -1;
-     if (c < 0) c = d; else if (c != d) return -1;
+    switch(op)
-     }
+      {
+      default:
-   else switch(code[3])
+      return -1;
-     {
-     default:
+      case OP_BRA:
-     return -1;
+      case OP_ASSERT:
+      case OP_ONCE:
-     case OP_EXACT:       /* Fall through */
+      case OP_COND:
-     charoffset++;
+      if ((d = find_firstchar(scode, options)) < 0) return -1;
+      if (c < 0) c = d; else if (c != d) return -1;
-     case OP_CHARS:       /* Fall through */
+      break;
-     charoffset++;
+      case OP_EXACT:       /* Fall through */
+      scode++;
+      case OP_CHARS:       /* Fall through */
+      scode++;
+      case OP_PLUS:
+      case OP_MINPLUS:
+      if (c < 0) c = scode[1]; else if (c != scode[1]) return -1;
+      break;
+      }
-     case OP_PLUS:
+    code += (code[1] << 8) + code[2];
-     case OP_MINPLUS:
+    }
-     if (c < 0) c = code[charoffset]; else if (c != code[charoffset]) return -1;
-     break;
-     }
-   code += (code[1] << 8) + code[2];
-   }
  while (*code == OP_ALT);
  return c;
  }
  /*************************************************
  *        Compile a Regular Expression            *
  *************************************************/
-Line 1478 
 Arguments:
+Line 2468 
 Arguments:
    options      various option bits
    errorptr     pointer to pointer to error text
    erroroffset  ptr offset in pattern where error was detected
+   tables       pointer to character tables or NULL
  Returns:       pointer to compiled data block, or NULL on error,
                 with errorptr and erroroffset set
  */
  pcre *
- pcre_compile(const char *pattern, int options, char **errorptr,
+ pcre_compile(const char *pattern, int options, const char **errorptr,
-   int *erroroffset)
+   int *erroroffset, const unsigned char *tables)
  {
  real_pcre *re;
- int spaces = 0;
  int length = 3;      /* For initial BRA plus length */
  int runlength;
- int c, size;
+ int c, reqchar, countlits;
  int bracount = 0;
- int brastack[200];
- int brastackptr = 0;
  int top_backref = 0;
- uschar *code, *ptr;
+ int branch_extra = 0;
+ int branch_newextra;
+ unsigned int brastackptr = 0;
+ size_t size;
+ uschar *code;
+ const uschar *ptr;
+ compile_data compile_block;
+ int brastack[BRASTACK_SIZE];
+ uschar bralenstack[BRASTACK_SIZE];
  #ifdef DEBUG
  uschar *code_base, *code_end;
  #endif
+ /* Can't support UTF8 unless PCRE has been compiled to include the code. */
+ #ifndef SUPPORT_UTF8
+ if ((options & PCRE_UTF8) != 0)
+   {
+   *errorptr = ERR32;
+   return NULL;
+   }
+ #endif
  /* We can't pass back an error message if errorptr is NULL; I guess the best we
  can do is just return NULL. */
-Line 1523 
 if ((options & ~PUBLIC_OPTIONS) != 0)
+Line 2529 
 if ((options & ~PUBLIC_OPTIONS) != 0)
    return NULL;
    }
- #ifdef DEBUG
+ /* Set up pointers to the individual character tables */
- printf("------------------------------------------------------------------\n");
- printf("%s\n", pattern);
+ if (tables == NULL) tables = pcre_default_tables;
- #endif
+ compile_block.lcc = tables + lcc_offset;
+ compile_block.fcc = tables + fcc_offset;
+ compile_block.cbits = tables + cbits_offset;
+ compile_block.ctypes = tables + ctypes_offset;
+ /* Reflect pattern for debugging output */
+ DPRINTF(("------------------------------------------------------------------\n"));
+ DPRINTF(("%s\n", pattern));
  /* The first thing to do is to make a pass over the pattern to compute the
  amount of store required to hold the compiled code. This does not have to be
-Line 1535 
 internal flag settings. Make an attempt
+Line 2549 
 internal flag settings. Make an attempt
  if an "extended" flag setting appears late in the pattern. We can't be so
  clever for #-comments. */
- ptr = (uschar *)(pattern - 1);
+ ptr = (const uschar *)(pattern - 1);
  while ((c = *(++ptr)) != 0)
    {
    int min, max;
    int class_charcount;
+   int bracket_length;
-   if ((pcre_ctypes[c] & ctype_space) != 0)
+   if ((options & PCRE_EXTENDED) != 0)
-     {
-     if ((options & PCRE_EXTENDED) != 0) continue;
-     spaces++;
-     }
-   if (c == '#' && (options & PCRE_EXTENDED) != 0)
      {
-     while ((c = *(++ptr)) != 0 && c != '\n');
+     if ((compile_block.ctypes[c] & ctype_space) != 0) continue;
-     continue;
+     if (c == '#')
+       {
+       /* The space before the ; is to avoid a warning on a silly compiler
+       on the Macintosh. */
+       while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
+       continue;
+       }
      }
    switch(c)
-Line 1562 
 while ((c = *(++ptr)) != 0)
+Line 2577 
 while ((c = *(++ptr)) != 0)
      case '\\':
        {
-       uschar *save_ptr = ptr;
+       const uschar *save_ptr = ptr;
-       c = check_escape(&ptr, errorptr, bracount, options, FALSE);
+       c = check_escape(&ptr, errorptr, bracount, options, FALSE, &compile_block);
        if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
        if (c >= 0)
          {
-Line 1574 
 while ((c = *(++ptr)) != 0)
+Line 2589 
 while ((c = *(++ptr)) != 0)
        }
      length++;
-     /* A back reference needs an additional char, plus either one or 5
+     /* A back reference needs an additional 2 bytes, plus either one or 5
      bytes for a repeat. We also need to keep the value of the highest
      back reference. */
-Line 1582 
 while ((c = *(++ptr)) != 0)
+Line 2597 
 while ((c = *(++ptr)) != 0)
        {
        int refnum = -c - ESC_REF;
        if (refnum > top_backref) top_backref = refnum;
-       length++;   /* For single back reference */
+       length += 2;   /* For single back reference */
-       if (ptr[1] == '{' && is_counted_repeat(ptr+2))
+       if (ptr[1] == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr);
+         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr, &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if ((min == 0 && (max == 1 || max == -1)) ||
            (min == 1 && max == -1))
-Line 1609 
 while ((c = *(++ptr)) != 0)
+Line 2624 
 while ((c = *(++ptr)) != 0)
      or back reference. */
      case '{':
-     if (!is_counted_repeat(ptr+1)) goto NORMAL_CHAR;
+     if (!is_counted_repeat(ptr+1, &compile_block)) goto NORMAL_CHAR;
-     ptr = read_repeat_counts(ptr+1, &min, &max, errorptr);
+     ptr = read_repeat_counts(ptr+1, &min, &max, errorptr, &compile_block);
      if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
      if ((min == 0 && (max == 1 || max == -1)) ||
        (min == 1 && max == -1))
-Line 1624 
 while ((c = *(++ptr)) != 0)
+Line 2639 
 while ((c = *(++ptr)) != 0)
      if (ptr[1] == '?') ptr++;
      continue;
-     /* An alternation contains an offset to the next branch or ket. */
+     /* An alternation contains an offset to the next branch or ket. If any ims
+     options changed in the previous branch(es), and/or if we are in a
+     lookbehind assertion, extra space will be needed at the start of the
+     branch. This is handled by branch_extra. */
      case '|':
-     length += 3;
+     length += 3 + branch_extra;
      continue;
      /* A character class uses 33 characters. Don't worry about character types
-Line 1641 
 while ((c = *(++ptr)) != 0)
+Line 2660 
 while ((c = *(++ptr)) != 0)
        {
        if (*ptr == '\\')
          {
-         int c = check_escape(&ptr, errorptr, bracount, options, TRUE);
+         int ch = check_escape(&ptr, errorptr, bracount, options, TRUE,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
-         if (-c == ESC_b) class_charcount++; else class_charcount = 10;
+         if (-ch == ESC_b) class_charcount++; else class_charcount = 10;
          }
        else class_charcount++;
        ptr++;
-Line 1658 
 while ((c = *(++ptr)) != 0)
+Line 2678 
 while ((c = *(++ptr)) != 0)
        /* A repeat needs either 1 or 5 bytes. */
-       if (ptr[1] == '{' && is_counted_repeat(ptr+2))
+       if (*ptr != 0 && ptr[1] == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr);
+         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr, &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if ((min == 0 && (max == 1 || max == -1)) ||
            (min == 1 && max == -1))
-Line 1674 
 while ((c = *(++ptr)) != 0)
+Line 2694 
 while ((c = *(++ptr)) != 0)
      /* Brackets may be genuine groups or special things */
      case '(':
+     branch_newextra = 0;
+     bracket_length = 3;
      /* Handle special forms of bracket, which all start (? */
-     if (ptr[1] == '?') switch (c = ptr[2])
+     if (ptr[1] == '?')
        {
-       /* Skip over comments entirely */
+       int set, unset;
-       case '#':
+       int *optset;
-       ptr += 3;
-       while (*ptr != 0 && *ptr != ')') ptr++;
-       if (*ptr == 0)
-         {
-         *errorptr = ERR18;
-         goto PCRE_ERROR_RETURN;
-         }
-       continue;
-       /* Non-referencing groups and lookaheads just move the pointer on, and
+       switch (c = ptr[2])
-       then behave like a non-special bracket, except that they don't increment
+         {
-       the count of extracting brackets. */
+         /* Skip over comments entirely */
+         case '#':
-       case ':':
+         ptr += 3;
-       case '=':
+         while (*ptr != 0 && *ptr != ')') ptr++;
-       case '!':
+         if (*ptr == 0)
-       ptr += 2;
+           {
-       break;
+           *errorptr = ERR18;
+           goto PCRE_ERROR_RETURN;
+           }
+         continue;
-       /* Ditto for the "once only" bracket, allowed only if the extra bit
+         /* Non-referencing groups and lookaheads just move the pointer on, and
-       is set. */
+         then behave like a non-special bracket, except that they don't increment
+         the count of extracting brackets. Ditto for the "once only" bracket,
+         which is in Perl from version 5.005. */
-       case '>':
+         case ':':
-       if ((options & PCRE_EXTRA) != 0)
+         case '=':
-         {
+         case '!':
+         case '>':
          ptr += 2;
          break;
-         }
-       /* Else fall thourh */
-       /* Else loop setting valid options until ) is met. Anything else is an
+         /* A recursive call to the regex is an extension, to provide the
-       error. */
+         facility which can be obtained by $(?p{perl-code}) in Perl 5.6. */
-       default:
+         case 'R':
-       ptr += 2;
+         if (ptr[3] != ')')
-       for (;; ptr++)
-         {
-         if ((c = *ptr) == 'i')
            {
-           options |= PCRE_CASELESS;
+           *errorptr = ERR29;
-           continue;
+           goto PCRE_ERROR_RETURN;
            }
-         else if ((c = *ptr) == 'm')
+         ptr += 3;
+         length += 1;
+         break;
+         /* Lookbehinds are in Perl from version 5.005 */
+         case '<':
+         if (ptr[3] == '=' || ptr[3] == '!')
            {
-           options |= PCRE_MULTILINE;
+           ptr += 3;
-           continue;
+           branch_newextra = 3;
+           length += 3;         /* For the first branch */
+           break;
+           }
+         *errorptr = ERR24;
+         goto PCRE_ERROR_RETURN;
+         /* Conditionals are in Perl from version 5.005. The bracket must either
+         be followed by a number (for bracket reference) or by an assertion
+         group. */
+         case '(':
+         if ((compile_block.ctypes[ptr[3]] & ctype_digit) != 0)
+           {
+           ptr += 4;
+           length += 3;
+           while ((compile_block.ctypes[*ptr] & ctype_digit) != 0) ptr++;
+           if (*ptr != ')')
+             {
+             *errorptr = ERR26;
+             goto PCRE_ERROR_RETURN;
+             }
            }
-         else if (c == 's')
+         else   /* An assertion must follow */
            {
-           options |= PCRE_DOTALL;
+           ptr++;   /* Can treat like ':' as far as spacing is concerned */
-           continue;
+           if (ptr[2] != '?' ||
+              (ptr[3] != '=' && ptr[3] != '!' && ptr[3] != '<') )
+             {
+             ptr += 2;    /* To get right offset in message */
+             *errorptr = ERR28;
+             goto PCRE_ERROR_RETURN;
+             }
+           }
+         break;
+         /* Else loop checking valid options until ) is met. Anything else is an
+         error. If we are without any brackets, i.e. at top level, the settings
+         act as if specified in the options, so massage the options immediately.
+         This is for backward compatibility with Perl 5.004. */
+         default:
+         set = unset = 0;
+         optset = &set;
+         ptr += 2;
+         for (;; ptr++)
+           {
+           c = *ptr;
+           switch (c)
+             {
+             case 'i':
+             *optset |= PCRE_CASELESS;
+             continue;
+             case 'm':
+             *optset |= PCRE_MULTILINE;
+             continue;
+             case 's':
+             *optset |= PCRE_DOTALL;
+             continue;
+             case 'x':
+             *optset |= PCRE_EXTENDED;
+             continue;
+             case 'X':
+             *optset |= PCRE_EXTRA;
+             continue;
+             case 'U':
+             *optset |= PCRE_UNGREEDY;
+             continue;
+             case '-':
+             optset = &unset;
+             continue;
+             /* A termination by ')' indicates an options-setting-only item;
+             this is global at top level; otherwise nothing is done here and
+             it is handled during the compiling process on a per-bracket-group
+             basis. */
+             case ')':
+             if (brastackptr == 0)
+               {
+               options = (options | set) & (~unset);
+               set = unset = 0;     /* To save length */
+               }
+             /* Fall through */
+             /* A termination by ':' indicates the start of a nested group with
+             the given options set. This is again handled at compile time, but
+             we must allow for compiled space if any of the ims options are
+             set. We also have to allow for resetting space at the end of
+             the group, which is why 4 is added to the length and not just 2.
+             If there are several changes of options within the same group, this
+             will lead to an over-estimate on the length, but this shouldn't
+             matter very much. We also have to allow for resetting options at
+             the start of any alternations, which we do by setting
+             branch_newextra to 2. Finally, we record whether the case-dependent
+             flag ever changes within the regex. This is used by the "required
+             character" code. */
+             case ':':
+             if (((set|unset) & PCRE_IMS) != 0)
+               {
+               length += 4;
+               branch_newextra = 2;
+               if (((set|unset) & PCRE_CASELESS) != 0) options |= PCRE_ICHANGED;
+               }
+             goto END_OPTIONS;
+             /* Unrecognized option character */
+             default:
+             *errorptr = ERR12;
+             goto PCRE_ERROR_RETURN;
+             }
            }
-         else if (c == 'x')
+         /* If we hit a closing bracket, that's it - this is a freestanding
+         option-setting. We need to ensure that branch_extra is updated if
+         necessary. The only values branch_newextra can have here are 0 or 2.
+         If the value is 2, then branch_extra must either be 2 or 5, depending
+         on whether this is a lookbehind group or not. */
+         END_OPTIONS:
+         if (c == ')')
            {
-           options |= PCRE_EXTENDED;
+           if (branch_newextra == 2 && (branch_extra == 0 || branch_extra == 3))
-           length -= spaces;          /* Already counted spaces */
+             branch_extra += branch_newextra;
            continue;
            }
-         else if (c == ')') break;
-         *errorptr = ERR12;
+         /* If options were terminated by ':' control comes here. Fall through
-         goto PCRE_ERROR_RETURN;
+         to handle the group below. */
          }
-       continue;                      /* End of this bracket handling */
        }
      /* Extracting brackets must be counted so we can process escapes in a
-     Perlish way. */
+     Perlish way. If the number exceeds EXTRACT_BASIC_MAX we are going to
+     need an additional 3 bytes of store per extracting bracket. */
-     else bracount++;
+     else
+       {
+       bracount++;
+       if (bracount > EXTRACT_BASIC_MAX) bracket_length += 3;
+       }
-     /* Non-special forms of bracket. Save length for computing whole length
+     /* Save length for computing whole length at end if there's a repeat that
-     at end if there's a repeat that requires duplication of the group. */
+     requires duplication of the group. Also save the current value of
+     branch_extra, and start the new group with the new value. If non-zero, this
+     will either be 2 for a (?imsx: group, or 3 for a lookbehind assertion. */
      if (brastackptr >= sizeof(brastack)/sizeof(int))
        {
-Line 1761 
 while ((c = *(++ptr)) != 0)
+Line 2910 
 while ((c = *(++ptr)) != 0)
        goto PCRE_ERROR_RETURN;
        }
+     bralenstack[brastackptr] = branch_extra;
+     branch_extra = branch_newextra;
      brastack[brastackptr++] = length;
-     length += 3;
+     length += bracket_length;
      continue;
      /* Handle ket. Look for subsequent max/min; for certain sets of values we
-     have to replicate this bracket up to that many times. */
+     have to replicate this bracket up to that many times. If brastackptr is
+this is an unmatched bracket which will generate an error, but take care
+     not to try to access brastack[-1] when computing the length and restoring
+     the branch_extra value. */
      case ')':
      length += 3;
        {
-       int min = 1;
+       int minval = 1;
-       int max = 1;
+       int maxval = 1;
-       int duplength = length - brastack[--brastackptr];
+       int duplength;
+       if (brastackptr > 0)
+         {
+         duplength = length - brastack[--brastackptr];
+         branch_extra = bralenstack[brastackptr];
+         }
+       else duplength = 0;
        /* Leave ptr at the final char; for read_repeat_counts this happens
        automatically; for the others we need an increment. */
-       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2))
+       if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
          {
-         ptr = read_repeat_counts(ptr+2, &min, &max, errorptr);
+         ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          }
-       else if (c == '*') { min = 0; max = -1; ptr++; }
+       else if (c == '*') { minval = 0; maxval = -1; ptr++; }
-       else if (c == '+') { max = -1; ptr++; }
+       else if (c == '+') { maxval = -1; ptr++; }
-       else if (c == '?') { min = 0; ptr++; }
+       else if (c == '?') { minval = 0; ptr++; }
-       /* If there is a minimum > 1 we have to replicate up to min-1 times; if
+       /* If the minimum is zero, we have to allow for an OP_BRAZERO before the
-       there is a limited maximum we have to replicate up to max-1 times and
+       group, and if the maximum is greater than zero, we have to replicate
-       allow for a BRAZERO item before each optional copy, as we also have to
+       maxval-1 times; each replication acquires an OP_BRAZERO plus a nesting
-       do before the first copy if the minimum is zero. */
+       bracket set - hence the 7. */
-       if (min == 0) length++;
+       if (minval == 0)
-         else if (min > 1) length += (min - 1) * duplength;
+         {
-       if (max > min) length += (max - min) * (duplength + 1);
+         length++;
-       }
+         if (maxval > 0) length += (maxval - 1) * (duplength + 7);
+         }
+       /* When the minimum is greater than zero, 1 we have to replicate up to
+       minval-1 times, with no additions required in the copies. Then, if
+       there is a limited maximum we have to replicate up to maxval-1 times
+       allowing for a BRAZERO item before each optional copy and nesting
+       brackets for all but one of the optional copies. */
+       else
+         {
+         length += (minval - 1) * duplength;
+         if (maxval > minval)   /* Need this test as maxval=-1 means no limit */
+           length += (maxval - minval) * (duplength + 7) - 6;
+         }
+       }
      continue;
      /* Non-special character. For a run of such characters the length required
-Line 1810 
 while ((c = *(++ptr)) != 0)
+Line 2987 
 while ((c = *(++ptr)) != 0)
      runlength = 0;
      do
        {
-       if ((pcre_ctypes[c] & ctype_space) != 0)
+       if ((options & PCRE_EXTENDED) != 0)
-         {
-         if ((options & PCRE_EXTENDED) != 0) continue;
-         spaces++;
-         }
-       if (c == '#' && (options & PCRE_EXTENDED) != 0)
          {
-         while ((c = *(++ptr)) != 0 && c != '\n');
+         if ((compile_block.ctypes[c] & ctype_space) != 0) continue;
-         continue;
+         if (c == '#')
+           {
+           /* The space before the ; is to avoid a warning on a silly compiler
+           on the Macintosh. */
+           while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
+           continue;
+           }
          }
        /* Backslash may introduce a data char or a metacharacter; stop the
-Line 1827 
 while ((c = *(++ptr)) != 0)
+Line 3004 
 while ((c = *(++ptr)) != 0)
        if (c == '\\')
          {
-         uschar *saveptr = ptr;
+         const uschar *saveptr = ptr;
-         c = check_escape(&ptr, errorptr, bracount, options, FALSE);
+         c = check_escape(&ptr, errorptr, bracount, options, FALSE,
+           &compile_block);
          if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
          if (c < 0) { ptr = saveptr; break; }
+ #ifdef SUPPORT_UTF8
+         if (c > 127 && (options & PCRE_UTF8) != 0)
+           {
+           int i;
+           for (i = 0; i < sizeof(utf8_table1)/sizeof(int); i++)
+             if (c <= utf8_table1[i]) break;
+           runlength += i;
+           }
+ #endif
          }
        /* Ordinary character or single-char escape */
-Line 1840 
 while ((c = *(++ptr)) != 0)
+Line 3028 
 while ((c = *(++ptr)) != 0)
      /* This "while" is the end of the "do" above. */
-     while (runlength < 255 && (pcre_ctypes[c = *(++ptr)] & ctype_meta) == 0);
+     while (runlength < MAXLIT &&
+       (compile_block.ctypes[c = *(++ptr)] & ctype_meta) == 0);
      ptr--;
      length += runlength;
-Line 1857 
 if (length > 65539)
+Line 3046 
 if (length > 65539)
    }
  /* Compute the size of data block needed and get it, either from malloc or
- externally provided function. Put in the magic number and the options. */
+ externally provided function. We specify "code[0]" in the offsetof() expression
+ rather than just "code", because it has been reported that one broken compiler
+ fails on "code" because it is also an independent variable. It should make no
+ difference to the value of the offsetof(). */
- size = length + offsetof(real_pcre, code);
+ size = length + offsetof(real_pcre, code[0]);
  re = (real_pcre *)(pcre_malloc)(size);
  if (re == NULL)
-Line 1868 
 if (re == NULL)
+Line 3060 
 if (re == NULL)
    return NULL;
    }
+ /* Put in the magic number, and save the size, options, and table pointer */
  re->magic_number = MAGIC_NUMBER;
+ re->size = size;
  re->options = options;
+ re->tables = tables;
  /* Set up a starting, non-extracting bracket, then compile the expression. On
  error, *errorptr will be set non-NULL, so we don't need to look at the result
  of the function here. */
- ptr = (uschar *)pattern;
+ ptr = (const uschar *)pattern;
  code = re->code;
  *code = OP_BRA;
  bracount = 0;
- (void)compile_regex(options, &bracount, &code, &ptr, errorptr);
+ (void)compile_regex(options, -1, &bracount, &code, &ptr, errorptr, FALSE, 0,
+   &reqchar, &countlits, &compile_block);
  re->top_bracket = bracount;
  re->top_backref = top_backref;
-Line 1896 
 if debugging, leave the test till after
+Line 3093 
 if debugging, leave the test till after
  if (code - re->code > length) *errorptr = ERR23;
  #endif
+ /* Give an error if there's back reference to a non-existent capturing
+ subpattern. */
+ if (top_backref > re->top_bracket) *errorptr = ERR15;
  /* Failed to compile */
  if (*errorptr != NULL)
    {
    (pcre_free)(re);
    PCRE_ERROR_RETURN:
-   *erroroffset = ptr - (uschar *)pattern;
+   *erroroffset = ptr - (const uschar *)pattern;
    return NULL;
    }
- /* If the anchored option was not passed, set flag if we can determine that it
+ /* If the anchored option was not passed, set flag if we can determine that the
- is anchored by virtue of ^ characters or \A or anything else. Otherwise, see if
+ pattern is anchored by virtue of ^ characters or \A or anything else (such as
- we can determine what the first character has to be, because that speeds up
+ starting with .* when DOTALL is set).
- unanchored matches no end. In the case of multiline matches, an alternative is
- to set the PCRE_STARTLINE flag if all branches start with ^. */
+ Otherwise, see if we can determine what the first character has to be, because
+ that speeds up unanchored matches no end. If not, see if we can set the
+ PCRE_STARTLINE flag. This is helpful for multiline matches when all branches
+ start with ^. and also when all branches start with .* for non-DOTALL matches.
+ */
  if ((options & PCRE_ANCHORED) == 0)
    {
-   if (is_anchored(re->code, (options & PCRE_MULTILINE) != 0))
+   int temp_options = options;
+   if (is_anchored(re->code, &temp_options))
      re->options |= PCRE_ANCHORED;
    else
      {
-     int c = find_firstchar(re->code);
+     int ch = find_firstchar(re->code, &temp_options);
-     if (c >= 0)
+     if (ch >= 0)
        {
-       re->first_char = c;
+       re->first_char = ch;
        re->options |= PCRE_FIRSTSET;
        }
      else if (is_startline(re->code))
-Line 1929 
 if ((options & PCRE_ANCHORED) == 0)
+Line 3136 
 if ((options & PCRE_ANCHORED) == 0)
      }
    }
+ /* Save the last required character if there are at least two literal
+ characters on all paths, or if there is no first character setting. */
+ if (reqchar >= 0 && (countlits > 1 || (re->options & PCRE_FIRSTSET) == 0))
+   {
+   re->req_char = reqchar;
+   re->options |= PCRE_REQCHSET;
+   }
  /* Print out the compiled data for debugging */
  #ifdef DEBUG
- printf("Length = %d top_bracket = %d top_backref=%d\n",
+ printf("Length = %d top_bracket = %d top_backref = %d\n",
    length, re->top_bracket, re->top_backref);
  if (re->options != 0)
    {
-   printf("%s%s%s%s%s%s%s\n",
+   printf("%s%s%s%s%s%s%s%s%s\n",
      ((re->options & PCRE_ANCHORED) != 0)? "anchored " : "",
      ((re->options & PCRE_CASELESS) != 0)? "caseless " : "",
+     ((re->options & PCRE_ICHANGED) != 0)? "case state changed " : "",
      ((re->options & PCRE_EXTENDED) != 0)? "extended " : "",
      ((re->options & PCRE_MULTILINE) != 0)? "multiline " : "",
      ((re->options & PCRE_DOTALL) != 0)? "dotall " : "",
      ((re->options & PCRE_DOLLAR_ENDONLY) != 0)? "endonly " : "",
-     ((re->options & PCRE_EXTRA) != 0)? "extra " : "");
+     ((re->options & PCRE_EXTRA) != 0)? "extra " : "",
+     ((re->options & PCRE_UNGREEDY) != 0)? "ungreedy " : "");
    }
  if ((re->options & PCRE_FIRSTSET) != 0)
-Line 1954 
 if ((re->options & PCRE_FIRSTSET) != 0)
+Line 3172 
 if ((re->options & PCRE_FIRSTSET) != 0)
      else printf("First char = \\x%02x\n", re->first_char);
    }
+ if ((re->options & PCRE_REQCHSET) != 0)
+   {
+   if (isprint(re->req_char)) printf("Req char = %c\n", re->req_char);
+     else printf("Req char = \\x%02x\n", re->req_char);
+   }
  code_end = code;
  code_base = code = re->code;
-Line 1965 
 while (code < code_end)
+Line 3189 
 while (code < code_end)
    if (*code >= OP_BRA)
      {
-     printf("%3d Bra %d", (code[1] << 8) + code[2], *code - OP_BRA);
+     if (*code - OP_BRA > EXTRACT_BASIC_MAX)
+       printf("%3d Bra extra", (code[1] << 8) + code[2]);
+     else
+       printf("%3d Bra %d", (code[1] << 8) + code[2], *code - OP_BRA);
      code += 2;
      }
    else switch(*code)
      {
+     case OP_OPT:
+     printf(" %.2x %s", code[1], OP_names[*code]);
+     code++;
+     break;
      case OP_CHARS:
      charlength = *(++code);
      printf("%3d ", charlength);
-Line 1984 
 while (code < code_end)
+Line 3216 
 while (code < code_end)
      case OP_KET:
      case OP_ASSERT:
      case OP_ASSERT_NOT:
+     case OP_ASSERTBACK:
+     case OP_ASSERTBACK_NOT:
      case OP_ONCE:
+     case OP_REVERSE:
+     case OP_BRANUMBER:
+     case OP_COND:
+     case OP_CREF:
      printf("%3d %s", (code[1] << 8) + code[2], OP_names[*code]);
      code += 2;
      break;
-Line 2013 
 while (code < code_end)
+Line 3251 
 while (code < code_end)
      case OP_MINUPTO:
      if (isprint(c = code[3])) printf("    %c{", c);
        else printf("    \\x%02x{", c);
-     if (*code != OP_EXACT) printf(",");
+     if (*code != OP_EXACT) printf("0,");
      printf("%d}", (code[1] << 8) + code[2]);
      if (*code == OP_MINUPTO) printf("?");
      code += 3;
-Line 2057 
 while (code < code_end)
+Line 3295 
 while (code < code_end)
      break;
      case OP_REF:
-     printf("    \\%d", *(++code));
+     printf("    \\%d", (code[1] << 8) | code[2]);
-     break;
+     code += 3;
+     goto CLASS_REF_REPEAT;
      case OP_CLASS:
        {
        int i, min, max;
        code++;
        printf("    [");
-Line 2088 
 while (code < code_end)
+Line 3326 
 while (code < code_end)
        printf("]");
        code += 32;
+       CLASS_REF_REPEAT:
        switch(*code)
          {
          case OP_CRSTAR:
-Line 2145 
 return (pcre *)re;
+Line 3385 
 return (pcre *)re;
  /*************************************************
- *        Match a character type                  *
- *************************************************/
- /* Not used in all the places it might be as it's sometimes faster
- to put the code inline.
- Arguments:
-   type        the character type
-   c           the character
-   dotall      the dotall flag
- Returns:      TRUE if character is of the type
- */
- static BOOL
- match_type(int type, int c, BOOL dotall)
- {
- #ifdef DEBUG
- if (isprint(c)) printf("matching subject %c against ", c);
-   else printf("matching subject \\x%02x against ", c);
- printf("%s\n", OP_names[type]);
- #endif
- switch(type)
-   {
-   case OP_ANY:            return dotall || c != '\n';
-   case OP_NOT_DIGIT:      return (pcre_ctypes[c] & ctype_digit) == 0;
-   case OP_DIGIT:          return (pcre_ctypes[c] & ctype_digit) != 0;
-   case OP_NOT_WHITESPACE: return (pcre_ctypes[c] & ctype_space) == 0;
-   case OP_WHITESPACE:     return (pcre_ctypes[c] & ctype_space) != 0;
-   case OP_NOT_WORDCHAR:   return (pcre_ctypes[c] & ctype_word) == 0;
-   case OP_WORDCHAR:       return (pcre_ctypes[c] & ctype_word) != 0;
-   }
- return FALSE;
- }
- /*************************************************
  *          Match a back-reference                *
  *************************************************/
- /* If a back reference hasn't been set, the match fails.
+ /* If a back reference hasn't been set, the length that is passed is greater
+ than the number of characters left in the string, so the match fails.
  Arguments:
-   number      reference number
+   offset      index into the offset vector
    eptr        points into the subject
    length      length to be matched
    md          points to match data block
+   ims         the ims flags
  Returns:      TRUE if matched
  */
  static BOOL
- match_ref(int number, register uschar *eptr, int length, match_data *md)
+ match_ref(int offset, register const uschar *eptr, int length, match_data *md,
+   unsigned long int ims)
  {
- uschar *p = md->start_subject + md->offset_vector[number];
+ const uschar *p = md->start_subject + md->offset_vector[offset];
  #ifdef DEBUG
  if (eptr >= md->end_subject)
-Line 2219 
 printf("\n");
+Line 3422 
 printf("\n");
  /* Always fail if not enough characters left */
- if (length > md->end_subject - p) return FALSE;
+ if (length > md->end_subject - eptr) return FALSE;
  /* Separate the caselesss case for speed */
- if (md->caseless)
+ if ((ims & PCRE_CASELESS) != 0)
-   { while (length-- > 0) if (pcre_lcc[*p++] != pcre_lcc[*eptr++]) return FALSE; }
+   {
+   while (length-- > 0)
+     if (md->lcc[*p++] != md->lcc[*eptr++]) return FALSE;
+   }
  else
    { while (length-- > 0) if (*p++ != *eptr++) return FALSE; }
-Line 2237 
 return TRUE;
+Line 3443 
 return TRUE;
  *         Match from current position            *
  *************************************************/
- /* On entry ecode points to the first opcode, and eptr to the first character.
+ /* On entry ecode points to the first opcode, and eptr to the first character
+ in the subject string, while eptrb holds the value of eptr at the start of the
+ last bracketed group - used for breaking infinite loops matching zero-length
+ strings.
  Arguments:
     eptr        pointer in subject
     ecode       position in code
     offset_top  current top pointer
     md          pointer to "static" info for the match
+    ims         current /i, /m, and /s options
+    eptrb       pointer to chain of blocks containing eptr at start of
+                  brackets - for testing for empty matches
+    flags       can contain
+                  match_condassert - this is an assertion condition
+                  match_isgroup - this is the start of a bracketed group
+ Returns:       TRUE if matched
+ */
+ static BOOL
+ match(register const uschar *eptr, register const uschar *ecode,
+   int offset_top, match_data *md, unsigned long int ims, eptrblock *eptrb,
+   int flags)
+ {
+ unsigned long int original_ims = ims;   /* Save for resetting on ')' */
+ eptrblock newptrb;
+ /* At the start of a bracketed group, add the current subject pointer to the
+ stack of such pointers, to be re-instated at the end of the group when we hit
+ the closing ket. When match() is called in other circumstances, we don't add to
+ the stack. */
+ if ((flags & match_isgroup) != 0)
+   {
+   newptrb.prev = eptrb;
+   newptrb.saved_eptr = eptr;
+   eptrb = &newptrb;
+   }
- Returns:       TRUE if matched
+ /* Now start processing the operations. */
- */
- static BOOL
- match(register uschar *eptr, register uschar *ecode, int offset_top,
-   match_data *md)
- {
  for (;;)
    {
+   int op = (int)*ecode;
    int min, max, ctype;
    register int i;
    register int c;
-   BOOL minimize;
+   BOOL minimize = FALSE;
-   /* Opening bracket. Check the alternative branches in turn, failing if none
+   /* Opening capturing bracket. If there is space in the offset vector, save
-   match. We have to set the start offset if required and there is space
+   the current subject position in the working slot at the top of the vector. We
-   in the offset vector so that it is available for subsequent back references
+   mustn't change the current values of the data slot, because they may be set
-   if the bracket matches. However, if the bracket fails, we must put back the
+   from a previous iteration of this group, and be referred to by a reference
-   previous value of both offsets in case they were set by a previous copy of
+   inside the group.
-   the same bracket. Don't worry about setting the flag for the error case here;
-   that is handled in the code for KET. */
+   If the bracket fails to match, we need to restore this value and also the
+   values of the final offsets, in case they were set by a previous iteration of
+   the same bracket.
+   If there isn't enough space in the offset vector, treat this as if it were a
+   non-capturing bracket. Don't worry about setting the flag for the error case
+   here; that is handled in the code for KET. */
-   if ((int)*ecode >= OP_BRA)
+   if (op > OP_BRA)
      {
-     int number = (*ecode - OP_BRA) << 1;
+     int offset;
-     int save_offset1, save_offset2;
+     int number = op - OP_BRA;
-     #ifdef DEBUG
+     /* For extended extraction brackets (large number), we have to fish out the
-     printf("start bracket %d\n", number/2);
+     number from a dummy opcode at the start. */
-     #endif
+     if (number > EXTRACT_BASIC_MAX) number = (ecode[4] << 8) | ecode[5];
+     offset = number << 1;
+ #ifdef DEBUG
+     printf("start bracket %d subject=", number);
+     pchars(eptr, 16, TRUE, md);
+     printf("\n");
+ #endif
-     if (number > 0 && number < md->offset_end)
+     if (offset < md->offset_max)
        {
-       save_offset1 = md->offset_vector[number];
+       int save_offset1 = md->offset_vector[offset];
-       save_offset2 = md->offset_vector[number+1];
+       int save_offset2 = md->offset_vector[offset+1];
-       md->offset_vector[number] = eptr - md->start_subject;
+       int save_offset3 = md->offset_vector[md->offset_end - number];
-       #ifdef DEBUG
+       DPRINTF(("saving %d %d %d\n", save_offset1, save_offset2, save_offset3));
-       printf("saving %d %d\n", save_offset1, save_offset2);
+       md->offset_vector[md->offset_end - number] = eptr - md->start_subject;
-       #endif
+       do
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+           return TRUE;
+         ecode += (ecode[1] << 8) + ecode[2];
+         }
+       while (*ecode == OP_ALT);
+       DPRINTF(("bracket %d failed\n", number));
+       md->offset_vector[offset] = save_offset1;
+       md->offset_vector[offset+1] = save_offset2;
+       md->offset_vector[md->offset_end - number] = save_offset3;
+       return FALSE;
        }
-     /* Recurse for all the alternatives. */
+     /* Insufficient room for saving captured contents */
+     else op = OP_BRA;
+     }
+   /* Other types of node can be handled by a switch */
+   switch(op)
+     {
+     case OP_BRA:     /* Non-capturing bracket: optimized */
+     DPRINTF(("start bracket 0\n"));
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) return TRUE;
+       if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+         return TRUE;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
+     DPRINTF(("bracket 0 failed\n"));
+     return FALSE;
+     /* Conditional group: compilation checked that there are no more than
+     two branches. If the condition is false, skipping the first branch takes us
+     past the end if there is only one branch, but that's OK because that is
+     exactly what going to the ket would do. */
+     case OP_COND:
+     if (ecode[3] == OP_CREF)         /* Condition is extraction test */
+       {
+       int offset = (ecode[4] << 9) | (ecode[5] << 1); /* Doubled ref number */
+       return match(eptr,
+         ecode + ((offset < offset_top && md->offset_vector[offset] >= 0)?
+: 3 + (ecode[1] << 8) + ecode[2]),
+         offset_top, md, ims, eptrb, match_isgroup);
+       }
-     #ifdef DEBUG
+     /* The condition is an assertion. Call match() to evaluate it - setting
-     printf("bracket %d failed\n", number/2);
+     the final argument TRUE causes it to stop at the end of an assertion. */
-     #endif
-     if (number > 0 && number < md->offset_end)
+     else
        {
-       md->offset_vector[number] = save_offset1;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL,
-       md->offset_vector[number+1] = save_offset2;
+           match_condassert | match_isgroup))
+         {
+         ecode += 3 + (ecode[4] << 8) + ecode[5];
+         while (*ecode == OP_ALT) ecode += (ecode[1] << 8) + ecode[2];
+         }
+       else ecode += (ecode[1] << 8) + ecode[2];
+       return match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup);
        }
+     /* Control never reaches here */
-     return FALSE;
+     /* Skip over conditional reference or large extraction number data if
-     }
+     encountered. */
-   /* Other types of node can be handled by a switch */
+     case OP_CREF:
+     case OP_BRANUMBER:
+     ecode += 3;
+     break;
+     /* End of the pattern. If PCRE_NOTEMPTY is set, fail if we have matched
+     an empty string - recursion will then try other alternatives, if any. */
-   switch(*ecode)
-     {
      case OP_END:
+     if (md->notempty && eptr == md->start_match) return FALSE;
      md->end_match_ptr = eptr;          /* Record where we ended */
      md->end_offset_top = offset_top;   /* and how many extracts were taken */
      return TRUE;
-     /* The equivalent of Prolog's "cut" - if the rest doesn't match, the
+     /* Change option settings */
-     whole thing doesn't match, so we have to get out via a longjmp(). */
-     case OP_CUT:
+     case OP_OPT:
-     if (match(eptr, ecode+1, offset_top, md)) return TRUE;
+     ims = ecode[1];
-     longjmp(md->fail_env, 1);
+     ecode += 2;
+     DPRINTF(("ims set to %02lx\n", ims));
+     break;
      /* Assertion brackets. Check the alternative branches in turn - the
      matching won't pass the KET for an assertion. If any one branch matches,
-     the assertion is true. */
+     the assertion is true. Lookbehind assertions have an OP_REVERSE item at the
+     start of each branch to move the current point backwards, so the code at
+     this level is identical to the lookahead case. */
      case OP_ASSERT:
+     case OP_ASSERTBACK:
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) break;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup)) break;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
      if (*ecode == OP_KET) return FALSE;
+     /* If checking an assertion for a condition, return TRUE. */
+     if ((flags & match_condassert) != 0) return TRUE;
      /* Continue from after the assertion, updating the offsets high water
      mark, since extracts may have been taken during the assertion. */
-Line 2349 
 for (;;)
+Line 3658 
 for (;;)
      /* Negative assertion: all branches must fail to match */
      case OP_ASSERT_NOT:
+     case OP_ASSERTBACK_NOT:
      do
        {
-       if (match(eptr, ecode+3, offset_top, md)) return FALSE;
+       if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup))
+         return FALSE;
        ecode += (ecode[1] << 8) + ecode[2];
        }
      while (*ecode == OP_ALT);
+     if ((flags & match_condassert) != 0) return TRUE;
      ecode += 3;
      continue;
+     /* Move the subject pointer back. This occurs only at the start of
+     each branch of a lookbehind assertion. If we are too close to the start to
+     move back, this match function fails. When working with UTF-8 we move
+     back a number of characters, not bytes. */
+     case OP_REVERSE:
+ #ifdef SUPPORT_UTF8
+     c = (ecode[1] << 8) + ecode[2];
+     for (i = 0; i < c; i++)
+       {
+       eptr--;
+       BACKCHAR(eptr)
+       }
+ #else
+     eptr -= (ecode[1] << 8) + ecode[2];
+ #endif
+     if (eptr < md->start_subject) return FALSE;
+     ecode += 3;
+     break;
+     /* Recursion matches the current regex, nested. If there are any capturing
+     brackets started but not finished, we have to save their starting points
+     and reinstate them after the recursion. However, we don't know how many
+     such there are (offset_top records the completed total) so we just have
+     to save all the potential data. There may be up to 99 such values, which
+     is a bit large to put on the stack, but using malloc for small numbers
+     seems expensive. As a compromise, the stack is used when there are fewer
+     than 16 values to store; otherwise malloc is used. A problem is what to do
+     if the malloc fails ... there is no way of returning to the top level with
+     an error. Save the top 15 values on the stack, and accept that the rest
+     may be wrong. */
+     case OP_RECURSE:
+       {
+       BOOL rc;
+       int *save;
+       int stacksave[15];
+       c = md->offset_max;
+       if (c < 16) save = stacksave; else
+         {
+         save = (int *)(pcre_malloc)((c+1) * sizeof(int));
+         if (save == NULL)
+           {
+           save = stacksave;
+           c = 15;
+           }
+         }
+       for (i = 1; i <= c; i++)
+         save[i] = md->offset_vector[md->offset_end - i];
+       rc = match(eptr, md->start_pattern, offset_top, md, ims, eptrb,
+         match_isgroup);
+       for (i = 1; i <= c; i++)
+         md->offset_vector[md->offset_end - i] = save[i];
+       if (save != stacksave) (pcre_free)(save);
+       if (!rc) return FALSE;
+       /* In case the recursion has set more capturing values, save the final
+       number, then move along the subject till after the recursive match,
+       and advance one byte in the pattern code. */
+       offset_top = md->end_offset_top;
+       eptr = md->end_match_ptr;
+       ecode++;
+       }
+     break;
      /* "Once" brackets are like assertion brackets except that after a match,
      the point in the subject string is not moved back. Thus there can never be
-     a back into the brackets. Check the alternative branches in turn - the
+     a move back into the brackets. Check the alternative branches in turn - the
      matching won't pass the KET for this kind of subpattern. If any one branch
-     matches, we carry on, leaving the subject pointer. */
+     matches, we carry on as at the end of a normal bracket, leaving the subject
+     pointer. */
      case OP_ONCE:
-     do
        {
-       if (match(eptr, ecode+3, offset_top, md)) break;
+       const uschar *prev = ecode;
-       ecode += (ecode[1] << 8) + ecode[2];
+       const uschar *saved_eptr = eptr;
-       }
-     while (*ecode == OP_ALT);
-     if (*ecode == OP_KET) return FALSE;
-     /* Continue as from after the assertion, updating the offsets high water
+       do
-     mark, since extracts may have been taken. */
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
+           break;
+         ecode += (ecode[1] << 8) + ecode[2];
+         }
+       while (*ecode == OP_ALT);
-     do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+       /* If hit the end of the group (which could be repeated), fail */
-     ecode += 3;
-     offset_top = md->end_offset_top;
+       if (*ecode != OP_ONCE && *ecode != OP_ALT) return FALSE;
-     eptr = md->end_match_ptr;
-     continue;
+       /* Continue as from after the assertion, updating the offsets high water
+       mark, since extracts may have been taken. */
+       do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+       offset_top = md->end_offset_top;
+       eptr = md->end_match_ptr;
+       /* For a non-repeating ket, just continue at this level. This also
+       happens for a repeating ket if no characters were matched in the group.
+       This is the forcible breaking of infinite loops as implemented in Perl
+.005. If there is an options reset, it will get obeyed in the normal
+       course of events. */
+       if (*ecode == OP_KET || eptr == saved_eptr)
+         {
+         ecode += 3;
+         break;
+         }
+       /* The repeating kets try the rest of the pattern or restart from the
+       preceding bracket, in the appropriate order. We need to reset any options
+       that changed within the bracket before re-running it, so check the next
+       opcode. */
+       if (ecode[3] == OP_OPT)
+         {
+         ims = (ims & ~PCRE_IMS) | ecode[4];
+         DPRINTF(("ims set to %02lx at group repeat\n", ims));
+         }
+       if (*ecode == OP_KETRMIN)
+         {
+         if (match(eptr, ecode+3, offset_top, md, ims, eptrb, 0) ||
+             match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup))