/[pcre]/code/trunk/pcre_compile.c

Diff of /code/trunk/pcre_compile.c

Parent Directory | Revision Log | View Patch Patch

-revision 475 by ph10,
Sat Jan  2 18:21:30 2010 UTC
+revision 1538 by ph10,
Sun Mar 29 11:22:24 2015 UTC
 Line 6
  and semantics are as close as possible to those of the Perl 5 language.
                         Written by Philip Hazel
-            Copyright (c) 1997-2010 University of Cambridge
+            Copyright (c) 1997-2014 University of Cambridge
  -----------------------------------------------------------------------------
  Redistribution and use in source and binary forms, with or without
 Line 47 
 supporting internal functions that are n
  #endif
  #define NLBLOCK cd             /* Block containing newline information */
- #define PSSTART start_pattern  /* Field containing processed string start */
+ #define PSSTART start_pattern  /* Field containing pattern start */
- #define PSEND   end_pattern    /* Field containing processed string end */
+ #define PSEND   end_pattern    /* Field containing pattern end */
  #include "pcre_internal.h"
- /* When PCRE_DEBUG is defined, we need the pcre_printint() function, which is
+ /* When PCRE_DEBUG is defined, we need the pcre(16|32)_printint() function, which
- also used by pcretest. PCRE_DEBUG is not defined when building a production
+ is also used by pcretest. PCRE_DEBUG is not defined when building a production
- library. */
+ library. We do not need to select pcre16_printint.c specially, because the
+ COMPILE_PCREx macro will already be appropriately set. */
  #ifdef PCRE_DEBUG
- #include "pcre_printint.src"
+ /* pcre_printint.c should not include any headers */
+ #define PCRE_INCLUDED
+ #include "pcre_printint.c"
+ #undef PCRE_INCLUDED
  #endif
  /* Macro for setting individual bits in class bitmaps. */
- #define SETBIT(a,b) a[b/8] |= (1 << (b%8))
+ #define SETBIT(a,b) a[(b)/8] |= (1 << ((b)&7))
  /* Maximum length value to check against when making sure that the integer that
  holds the compiled pattern length does not overflow. We make it a bit less than
-Line 73 
 to check them every time. */
+Line 77 
 to check them every time. */
  #define OFLOW_MAX (INT_MAX - 20)
+ /* Definitions to allow mutual recursion */
+ static int
+   add_list_to_class(pcre_uint8 *, pcre_uchar **, int, compile_data *,
+     const pcre_uint32 *, unsigned int);
+ static BOOL
+   compile_regex(int, pcre_uchar **, const pcre_uchar **, int *, BOOL, BOOL, int, int,
+     pcre_uint32 *, pcre_int32 *, pcre_uint32 *, pcre_int32 *, branch_chain *,
+     compile_data *, int *);
  /*************************************************
  *      Code parameters and static tables         *
-Line 88 
 so this number is very generous.
+Line 104 
 so this number is very generous.
  The same workspace is used during the second, actual compile phase for
  remembering forward references to groups so that they can be filled in at the
  end. Each entry in this list occupies LINK_SIZE bytes, so even when LINK_SIZE
- is 4 there is plenty of room. */
+ is 4 there is plenty of room for most patterns. However, the memory can get
+ filled up by repetitions of forward references, for example patterns like
+ /(?1){0,1999}(b)/, and one user did hit the limit. The code has been changed so
+ that the workspace is expanded using malloc() in this situation. The value
+ below is therefore a minimum, and we put a maximum on it for safety. The
+ minimum is now also defined in terms of LINK_SIZE so that the use of malloc()
+ kicks in at the same number of forward references in all cases. */
+ #define COMPILE_WORK_SIZE (2048*LINK_SIZE)
+ #define COMPILE_WORK_SIZE_MAX (100*COMPILE_WORK_SIZE)
+ /* This value determines the size of the initial vector that is used for
+ remembering named groups during the pre-compile. It is allocated on the stack,
+ but if it is too small, it is expanded using malloc(), in a similar way to the
+ workspace. The value is the number of slots in the list. */
- #define COMPILE_WORK_SIZE (4096)
+ #define NAMED_GROUP_LIST_SIZE  20
+ /* The overrun tests check for a slightly smaller size so that they detect the
+ overrun before it actually does run off the end of the data block. */
+ #define WORK_SIZE_SAFETY_MARGIN (100)
+ /* Private flags added to firstchar and reqchar. */
+ #define REQ_CASELESS    (1 << 0)        /* Indicates caselessness */
+ #define REQ_VARY        (1 << 1)        /* Reqchar followed non-literal item */
+ /* Negative values for the firstchar and reqchar flags */
+ #define REQ_UNSET       (-2)
+ #define REQ_NONE        (-1)
+ /* Repeated character flags. */
+ #define UTF_LENGTH     0x10000000l      /* The char contains its length. */
  /* Table for handling escaped characters in the range '0'-'z'. Positive returns
  are simple data values; negative values are for special things like \d and so
-Line 119 
 static const short int escapes[] = {
+Line 165 
 static const short int escapes[] = {
       -ESC_H,                  0,
 ,                       -ESC_K,
 ,                       0,
-,                       0,
+      -ESC_N,                  0,
       -ESC_P,                  -ESC_Q,
       -ESC_R,                  -ESC_S,
 ,                       0,
-Line 166 
 static const short int escapes[] = {
+Line 212 
 static const short int escapes[] = {
  /*  B8 */     0,     0,      0,       0,      0,   ']',    '=',    '-',
  /*  C0 */   '{',-ESC_A, -ESC_B,  -ESC_C, -ESC_D,-ESC_E,      0, -ESC_G,
  /*  C8 */-ESC_H,     0,      0,       0,      0,     0,      0,      0,
- /*  D0 */   '}',     0, -ESC_K,       0,      0,     0,      0, -ESC_P,
+ /*  D0 */   '}',     0, -ESC_K,       0,      0,-ESC_N,      0, -ESC_P,
  /*  D8 */-ESC_Q,-ESC_R,      0,       0,      0,     0,      0,      0,
  /*  E0 */  '\\',     0, -ESC_S,       0,      0,-ESC_V, -ESC_W, -ESC_X,
  /*  E8 */     0,-ESC_Z,      0,       0,      0,     0,      0,      0,
-Line 183 
 string is built from string macros so th
+Line 229 
 string is built from string macros so th
  platforms. */
  typedef struct verbitem {
-   int   len;
+   int   len;                 /* Length of verb name */
-   int   op;
+   int   op;                  /* Op when no arg, or -1 if arg mandatory */
+   int   op_arg;              /* Op when arg present, or -1 if not allowed */
  } verbitem;
  static const char verbnames[] =
+   "\0"                       /* Empty name is a shorthand for MARK */
+   STRING_MARK0
    STRING_ACCEPT0
    STRING_COMMIT0
    STRING_F0
-Line 197 
 static const char verbnames[] =
+Line 246 
 static const char verbnames[] =
    STRING_THEN;
  static const verbitem verbs[] = {
-   { 6, OP_ACCEPT },
+   { 0, -1,        OP_MARK },
-   { 6, OP_COMMIT },
+   { 4, -1,        OP_MARK },
-   { 1, OP_FAIL },
+   { 6, OP_ACCEPT, -1 },
-   { 4, OP_FAIL },
+   { 6, OP_COMMIT, -1 },
-   { 5, OP_PRUNE },
+   { 1, OP_FAIL,   -1 },
-   { 4, OP_SKIP  },
+   { 4, OP_FAIL,   -1 },
-   { 4, OP_THEN  }
+   { 5, OP_PRUNE,  OP_PRUNE_ARG },
+   { 4, OP_SKIP,   OP_SKIP_ARG  },
+   { 4, OP_THEN,   OP_THEN_ARG  }
  };
  static const int verbcount = sizeof(verbs)/sizeof(verbitem);
+ /* Substitutes for [[:<:]] and [[:>:]], which mean start and end of word in
+ another regex library. */
+ static const pcre_uchar sub_start_of_word[] = {
+   CHAR_BACKSLASH, CHAR_b, CHAR_LEFT_PARENTHESIS, CHAR_QUESTION_MARK,
+   CHAR_EQUALS_SIGN, CHAR_BACKSLASH, CHAR_w, CHAR_RIGHT_PARENTHESIS, '\0' };
+ static const pcre_uchar sub_end_of_word[] = {
+   CHAR_BACKSLASH, CHAR_b, CHAR_LEFT_PARENTHESIS, CHAR_QUESTION_MARK,
+   CHAR_LESS_THAN_SIGN, CHAR_EQUALS_SIGN, CHAR_BACKSLASH, CHAR_w,
+   CHAR_RIGHT_PARENTHESIS, '\0' };
  /* Tables of names of POSIX character classes and their lengths. The names are
  now all in a single string, to reduce the number of relocations when a shared
  library is dynamically loaded. The list of lengths is terminated by a zero
  length entry. The first three must be alpha, lower, upper, as this is assumed
- for handling case independence. */
+ for handling case independence. The indices for graph, print, and punct are
+ needed, so identify them. */
  static const char posix_names[] =
    STRING_alpha0 STRING_lower0 STRING_upper0 STRING_alnum0
-Line 221 
 static const char posix_names[] =
+Line 286 
 static const char posix_names[] =
    STRING_graph0 STRING_print0 STRING_punct0 STRING_space0
    STRING_word0  STRING_xdigit;
- static const uschar posix_name_lengths[] = {
+ static const pcre_uint8 posix_name_lengths[] = {
 , 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
+ #define PC_GRAPH  8
+ #define PC_PRINT  9
+ #define PC_PUNCT 10
  /* Table of class bit maps for each POSIX class. Each class is formed from a
  base map, with an optional addition or removal of another map. Then, for some
  classes, there is some additional tweaking: for [:blank:] the vertical space
-Line 251 
 static const int posix_class_maps[] = {
+Line 321 
 static const int posix_class_maps[] = {
    cbit_xdigit,-1,          0              /* xdigit */
  };
+ /* Table of substitutes for \d etc when PCRE_UCP is set. They are replaced by
+ Unicode property escapes. */
+ #ifdef SUPPORT_UCP
+ static const pcre_uchar string_PNd[]  = {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_N, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pNd[]  = {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_N, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PXsp[] = {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_s, CHAR_p, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pXsp[] = {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_s, CHAR_p, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PXwd[] = {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_w, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pXwd[] = {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_w, CHAR_d, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar *substitutes[] = {
+   string_PNd,           /* \D */
+   string_pNd,           /* \d */
+   string_PXsp,          /* \S */   /* Xsp is Perl space, but from 8.34, Perl */
+   string_pXsp,          /* \s */   /* space and POSIX space are the same. */
+   string_PXwd,          /* \W */
+   string_pXwd           /* \w */
+ };
+ /* The POSIX class substitutes must be in the order of the POSIX class names,
+ defined above, and there are both positive and negative cases. NULL means no
+ general substitute of a Unicode property escape (\p or \P). However, for some
+ POSIX classes (e.g. graph, print, punct) a special property code is compiled
+ directly. */
+ static const pcre_uchar string_pL[] =   {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pLl[] =  {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_l, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pLu[] =  {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_u, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_pXan[] = {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_a, CHAR_n, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_h[] =    {
+   CHAR_BACKSLASH, CHAR_h, '\0' };
+ static const pcre_uchar string_pXps[] = {
+   CHAR_BACKSLASH, CHAR_p, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_p, CHAR_s, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PL[] =   {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PLl[] =  {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_l, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PLu[] =  {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_L, CHAR_u, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_PXan[] = {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_a, CHAR_n, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar string_H[] =    {
+   CHAR_BACKSLASH, CHAR_H, '\0' };
+ static const pcre_uchar string_PXps[] = {
+   CHAR_BACKSLASH, CHAR_P, CHAR_LEFT_CURLY_BRACKET,
+   CHAR_X, CHAR_p, CHAR_s, CHAR_RIGHT_CURLY_BRACKET, '\0' };
+ static const pcre_uchar *posix_substitutes[] = {
+   string_pL,            /* alpha */
+   string_pLl,           /* lower */
+   string_pLu,           /* upper */
+   string_pXan,          /* alnum */
+   NULL,                 /* ascii */
+   string_h,             /* blank */
+   NULL,                 /* cntrl */
+   string_pNd,           /* digit */
+   NULL,                 /* graph */
+   NULL,                 /* print */
+   NULL,                 /* punct */
+   string_pXps,          /* space */   /* Xps is POSIX space, but from 8.34 */
+   string_pXwd,          /* word  */   /* Perl and POSIX space are the same */
+   NULL,                 /* xdigit */
+   /* Negated cases */
+   string_PL,            /* ^alpha */
+   string_PLl,           /* ^lower */
+   string_PLu,           /* ^upper */
+   string_PXan,          /* ^alnum */
+   NULL,                 /* ^ascii */
+   string_H,             /* ^blank */
+   NULL,                 /* ^cntrl */
+   string_PNd,           /* ^digit */
+   NULL,                 /* ^graph */
+   NULL,                 /* ^print */
+   NULL,                 /* ^punct */
+   string_PXps,          /* ^space */  /* Xps is POSIX space, but from 8.34 */
+   string_PXwd,          /* ^word */   /* Perl and POSIX space are the same */
+   NULL                  /* ^xdigit */
+ };
+ #define POSIX_SUBSIZE (sizeof(posix_substitutes) / sizeof(pcre_uchar *))
+ #endif
  #define STRING(a)  # a
  #define XSTRING(s) STRING(s)
-Line 263 
 the number of relocations needed when a
+Line 439 
 the number of relocations needed when a
  it is now one long string. We cannot use a table of offsets, because the
  lengths of inserts such as XSTRING(MAX_NAME_SIZE) are not known. Instead, we
  simply count through to the one we want - this isn't a performance issue
- because these strings are used only when there is a compilation error. */
+ because these strings are used only when there is a compilation error.
+ Each substring ends with \0 to insert a null character. This includes the final
+ substring, so that the whole string ends with \0\0, which can be detected when
+ counting through. */
  static const char error_texts[] =
    "no error\0"
-Line 304 
 static const char error_texts[] =
+Line 484 
 static const char error_texts[] =
    /* 30 */
    "unknown POSIX class name\0"
    "POSIX collating elements are not supported\0"
-   "this version of PCRE is not compiled with PCRE_UTF8 support\0"
+   "this version of PCRE is compiled without UTF support\0"
    "spare error\0"  /** DEAD **/
-   "character value in \\x{...} sequence is too large\0"
+   "character value in \\x{} or \\o{} is too large\0"
    /* 35 */
    "invalid condition (?(0)\0"
    "\\C not allowed in lookbehind assertion\0"
-   "PCRE does not support \\L, \\l, \\N, \\U, or \\u\0"
+   "PCRE does not support \\L, \\l, \\N{name}, \\U, or \\u\0"
    "number after (?C is > 255\0"
    "closing ) for (?C expected\0"
    /* 40 */
-Line 327 
 static const char error_texts[] =
+Line 507 
 static const char error_texts[] =
    "too many named subpatterns (maximum " XSTRING(MAX_NAME_COUNT) ")\0"
    /* 50 */
    "repeated subpattern is too long\0"    /** DEAD **/
-   "octal value is greater than \\377 (not in UTF-8 mode)\0"
+   "octal value is greater than \\377 in 8-bit non-UTF-8 mode\0"
    "internal error: overran compiling workspace\0"
    "internal error: previously-checked referenced subpattern not found\0"
    "DEFINE group contains more than one branch\0"
    /* 55 */
-   "repeating a DEFINE group is not allowed\0"
+   "repeating a DEFINE group is not allowed\0"  /** DEAD **/
    "inconsistent NEWLINE options\0"
    "\\g is not followed by a braced, angle-bracketed, or quoted name/number or by a plain number\0"
    "a numbered reference must not be zero\0"
-   "(*VERB) with an argument is not supported\0"
+   "an argument is not allowed for (*ACCEPT), (*FAIL), or (*COMMIT)\0"
    /* 60 */
-   "(*VERB) not recognized\0"
+   "(*VERB) not recognized or malformed\0"
    "number is too big\0"
    "subpattern name expected\0"
    "digit expected after (?+\0"
    "] is an invalid data character in JavaScript compatibility mode\0"
    /* 65 */
-   "different names for subpatterns of the same number are not allowed";
+   "different names for subpatterns of the same number are not allowed\0"
+   "(*MARK) must have an argument\0"
+   "this version of PCRE is not compiled with Unicode property support\0"
+   "\\c must be followed by an ASCII character\0"
+   "\\k is not followed by a braced, angle-bracketed, or quoted name\0"
+   /* 70 */
+   "internal error: unknown opcode in find_fixedlength()\0"
+   "\\N is not supported in a class\0"
+   "too many forward references\0"
+   "disallowed Unicode code point (>= 0xd800 && <= 0xdfff)\0"
+   "invalid UTF-16 string\0"
+   /* 75 */
+   "name is too long in (*MARK), (*PRUNE), (*SKIP), or (*THEN)\0"
+   "character value in \\u.... sequence is too large\0"
+   "invalid UTF-32 string\0"
+   "setting UTF is disabled by the application\0"
+   "non-hex character in \\x{} (closing brace missing?)\0"
+   /* 80 */
+   "non-octal character in \\o{} (closing brace missing?)\0"
+   "missing opening brace after \\o\0"
+   "parentheses are too deeply nested\0"
+   "invalid range in character class\0"
+   "group name must start with a non-digit\0"
+   /* 85 */
+   "parentheses are too deeply nested (stack check)\0"
+   "digits missing in \\x{} or \\o{}\0"
+   ;
  /* Table to identify digits and hex digits. This is used when compiling
  patterns. Note that the tables in chartables are dependent on the locale, and
-Line 363 
 For convenience, we use the same bit def
+Line 568 
 For convenience, we use the same bit def
  Then we can use ctype_digit and ctype_xdigit in the code. */
+ /* Using a simple comparison for decimal numbers rather than a memory read
+ is much faster, and the resulting code is simpler (the compiler turns it
+ into a subtraction and unsigned comparison). */
+ #define IS_DIGIT(x) ((x) >= CHAR_0 && (x) <= CHAR_9)
  #ifndef EBCDIC
  /* This is the "normal" case, for ASCII systems, and EBCDIC systems running in
  UTF-8 mode. */
- static const unsigned char digitab[] =
+ static const pcre_uint8 digitab[] =
    {
 x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   0-  7 */
 x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   8- 15 */
-Line 407 
 static const unsigned char digitab[] =
+Line 618 
 static const unsigned char digitab[] =
  /* This is the "abnormal" case, for EBCDIC systems not running in UTF-8 mode. */
- static const unsigned char digitab[] =
+ static const pcre_uint8 digitab[] =
    {
 x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   0-  7  0 */
 x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   8- 15    */
-Line 442 
 static const unsigned char digitab[] =
+Line 653 
 static const unsigned char digitab[] =
 x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c,0x0c, /*  0 - 7  F0 */
 x0c,0x0c,0x00,0x00,0x00,0x00,0x00,0x00};/*  8 -255    */
- static const unsigned char ebcdic_chartab[] = { /* chartable partial dup */
+ static const pcre_uint8 ebcdic_chartab[] = { /* chartable partial dup */
 x80,0x00,0x00,0x00,0x00,0x01,0x00,0x00, /*   0-  7 */
 x00,0x00,0x00,0x00,0x01,0x01,0x00,0x00, /*   8- 15 */
 x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00, /*  16- 23 */
-Line 478 
 static const unsigned char ebcdic_charta
+Line 689 
 static const unsigned char ebcdic_charta
  #endif
- /* Definition to allow mutual recursion */
+ /* This table is used to check whether auto-possessification is possible
+ between adjacent character-type opcodes. The left-hand (repeated) opcode is
+ used to select the row, and the right-hand opcode is use to select the column.
+ A value of 1 means that auto-possessification is OK. For example, the second
+ value in the first row means that \D+\d can be turned into \D++\d.
+ The Unicode property types (\P and \p) have to be present to fill out the table
+ because of what their opcode values are, but the table values should always be
+ zero because property types are handled separately in the code. The last four
+ columns apply to items that cannot be repeated, so there is no need to have
+ rows for them. Note that OP_DIGIT etc. are generated only when PCRE_UCP is
+ *not* set. When it is set, \d etc. are converted into OP_(NOT_)PROP codes. */
+ #define APTROWS (LAST_AUTOTAB_LEFT_OP - FIRST_AUTOTAB_OP + 1)
+ #define APTCOLS (LAST_AUTOTAB_RIGHT_OP - FIRST_AUTOTAB_OP + 1)
+ static const pcre_uint8 autoposstab[APTROWS][APTCOLS] = {
+ /* \D \d \S \s \W \w  . .+ \C \P \p \R \H \h \V \v \X \Z \z  $ $M */
+   { 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \D */
+   { 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \d */
+   { 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \S */
+   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \s */
+   { 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \W */
+   { 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1 },  /* \w */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* .  */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* .+ */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 },  /* \C */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },  /* \P */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },  /* \p */
+   { 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0 },  /* \R */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0 },  /* \H */
+   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0 },  /* \h */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0 },  /* \V */
+   { 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0 },  /* \v */
+   { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0 }   /* \X */
+ };
- static BOOL
+ /* This table is used to check whether auto-possessification is possible
-   compile_regex(int, int, uschar **, const uschar **, int *, BOOL, BOOL, int,
+ between adjacent Unicode property opcodes (OP_PROP and OP_NOTPROP). The
-     int *, int *, branch_chain *, compile_data *, int *);
+ left-hand (repeated) opcode is used to select the row, and the right-hand
+ opcode is used to select the column. The values are as follows:
+  Always return FALSE (never auto-possessify)
+  Character groups are distinct (possessify if both are OP_PROP)
+  Check character categories in the same group (general or particular)
+  TRUE if the two opcodes are not the same (PROP vs NOTPROP)
+  Check left general category vs right particular category
+  Check right general category vs left particular category
+  Left alphanum vs right general category
+  Left space vs right general category
+  Left word vs right general category
+  Right alphanum vs left general category
+  Right space vs left general category
+  Right word vs left general category
+  Left alphanum vs right particular category
+  Left space vs right particular category
+  Left word vs right particular category
+  Right alphanum vs left particular category
+  Right space vs left particular category
+  Right word vs left particular category
+ */
+ static const pcre_uint8 propposstab[PT_TABSIZE][PT_TABSIZE] = {
+ /* ANY LAMP GC  PC  SC ALNUM SPACE PXSPACE WORD CLIST UCNC */
+   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   0 },  /* PT_ANY */
+   { 0,  3,  0,  0,  0,    3,    1,      1,   0,    0,   0 },  /* PT_LAMP */
+   { 0,  0,  2,  4,  0,    9,   10,     10,  11,    0,   0 },  /* PT_GC */
+   { 0,  0,  5,  2,  0,   15,   16,     16,  17,    0,   0 },  /* PT_PC */
+   { 0,  0,  0,  0,  2,    0,    0,      0,   0,    0,   0 },  /* PT_SC */
+   { 0,  3,  6, 12,  0,    3,    1,      1,   0,    0,   0 },  /* PT_ALNUM */
+   { 0,  1,  7, 13,  0,    1,    3,      3,   1,    0,   0 },  /* PT_SPACE */
+   { 0,  1,  7, 13,  0,    1,    3,      3,   1,    0,   0 },  /* PT_PXSPACE */
+   { 0,  0,  8, 14,  0,    0,    1,      1,   3,    0,   0 },  /* PT_WORD */
+   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   0 },  /* PT_CLIST */
+   { 0,  0,  0,  0,  0,    0,    0,      0,   0,    0,   3 }   /* PT_UCNC */
+ };
+ /* This table is used to check whether auto-possessification is possible
+ between adjacent Unicode property opcodes (OP_PROP and OP_NOTPROP) when one
+ specifies a general category and the other specifies a particular category. The
+ row is selected by the general category and the column by the particular
+ category. The value is 1 if the particular category is not part of the general
+ category. */
+ static const pcre_uint8 catposstab[7][30] = {
+ /* Cc Cf Cn Co Cs Ll Lm Lo Lt Lu Mc Me Mn Nd Nl No Pc Pd Pe Pf Pi Po Ps Sc Sk Sm So Zl Zp Zs */
+   { 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* C */
+   { 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* L */
+   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* M */
+   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 },  /* N */
+   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1 },  /* P */
+   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1 },  /* S */
+   { 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0 }   /* Z */
+ };
+ /* This table is used when checking ALNUM, (PX)SPACE, SPACE, and WORD against
+ a general or particular category. The properties in each row are those
+ that apply to the character set in question. Duplication means that a little
+ unnecessary work is done when checking, but this keeps things much simpler
+ because they can all use the same code. For more details see the comment where
+ this table is used.
+ Note: SPACE and PXSPACE used to be different because Perl excluded VT from
+ "space", but from Perl 5.18 it's included, so both categories are treated the
+ same here. */
+ static const pcre_uint8 posspropstab[3][4] = {
+   { ucp_L, ucp_N, ucp_N, ucp_Nl },  /* ALNUM, 3rd and 4th values redundant */
+   { ucp_Z, ucp_Z, ucp_C, ucp_Cc },  /* SPACE and PXSPACE, 2nd value redundant */
+   { ucp_L, ucp_N, ucp_P, ucp_Po }   /* WORD */
+ };
+ /* This table is used when converting repeating opcodes into possessified
+ versions as a result of an explicit possessive quantifier such as ++. A zero
+ value means there is no possessified version - in those cases the item in
+ question must be wrapped in ONCE brackets. The table is truncated at OP_CALLOUT
+ because all relevant opcodes are less than that. */
+ static const pcre_uint8 opcode_possessify[] = {
+, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,   /* 0 - 15  */
+, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,   /* 16 - 31 */
+,                       /* NOTI */
+   OP_POSSTAR, 0,           /* STAR, MINSTAR */
+   OP_POSPLUS, 0,           /* PLUS, MINPLUS */
+   OP_POSQUERY, 0,          /* QUERY, MINQUERY */
+   OP_POSUPTO, 0,           /* UPTO, MINUPTO */
+,                       /* EXACT */
+, 0, 0, 0,              /* POS{STAR,PLUS,QUERY,UPTO} */
+   OP_POSSTARI, 0,          /* STARI, MINSTARI */
+   OP_POSPLUSI, 0,          /* PLUSI, MINPLUSI */
+   OP_POSQUERYI, 0,         /* QUERYI, MINQUERYI */
+   OP_POSUPTOI, 0,          /* UPTOI, MINUPTOI */
+,                       /* EXACTI */
+, 0, 0, 0,              /* POS{STARI,PLUSI,QUERYI,UPTOI} */
+   OP_NOTPOSSTAR, 0,        /* NOTSTAR, NOTMINSTAR */
+   OP_NOTPOSPLUS, 0,        /* NOTPLUS, NOTMINPLUS */
+   OP_NOTPOSQUERY, 0,       /* NOTQUERY, NOTMINQUERY */
+   OP_NOTPOSUPTO, 0,        /* NOTUPTO, NOTMINUPTO */
+,                       /* NOTEXACT */
+, 0, 0, 0,              /* NOTPOS{STAR,PLUS,QUERY,UPTO} */
+   OP_NOTPOSSTARI, 0,       /* NOTSTARI, NOTMINSTARI */
+   OP_NOTPOSPLUSI, 0,       /* NOTPLUSI, NOTMINPLUSI */
+   OP_NOTPOSQUERYI, 0,      /* NOTQUERYI, NOTMINQUERYI */
+   OP_NOTPOSUPTOI, 0,       /* NOTUPTOI, NOTMINUPTOI */
+,                       /* NOTEXACTI */
+, 0, 0, 0,              /* NOTPOS{STARI,PLUSI,QUERYI,UPTOI} */
+   OP_TYPEPOSSTAR, 0,       /* TYPESTAR, TYPEMINSTAR */
+   OP_TYPEPOSPLUS, 0,       /* TYPEPLUS, TYPEMINPLUS */
+   OP_TYPEPOSQUERY, 0,      /* TYPEQUERY, TYPEMINQUERY */
+   OP_TYPEPOSUPTO, 0,       /* TYPEUPTO, TYPEMINUPTO */
+,                       /* TYPEEXACT */
+, 0, 0, 0,              /* TYPEPOS{STAR,PLUS,QUERY,UPTO} */
+   OP_CRPOSSTAR, 0,         /* CRSTAR, CRMINSTAR */
+   OP_CRPOSPLUS, 0,         /* CRPLUS, CRMINPLUS */
+   OP_CRPOSQUERY, 0,        /* CRQUERY, CRMINQUERY */
+   OP_CRPOSRANGE, 0,        /* CRRANGE, CRMINRANGE */
+, 0, 0, 0,              /* CRPOS{STAR,PLUS,QUERY,RANGE} */
+, 0, 0,                 /* CLASS, NCLASS, XCLASS */
+, 0,                    /* REF, REFI */
+, 0,                    /* DNREF, DNREFI */
+, 0                     /* RECURSE, CALLOUT */
+ };
-Line 503 
 static const char *
+Line 884 
 static const char *
  find_error_text(int n)
  {
  const char *s = error_texts;
- for (; n > 0; n--) while (*s++ != 0) {};
+ for (; n > 0; n--)
+   {
+   while (*s++ != CHAR_NULL) {};
+   if (*s == CHAR_NULL) return "Error text not found (please report)";
+   }
  return s;
  }
+ /*************************************************
+ *           Expand the workspace                 *
+ *************************************************/
+ /* This function is called during the second compiling phase, if the number of
+ forward references fills the existing workspace, which is originally a block on
+ the stack. A larger block is obtained from malloc() unless the ultimate limit
+ has been reached or the increase will be rather small.
+ Argument: pointer to the compile data block
+ Returns:  0 if all went well, else an error number
+ */
+ static int
+ expand_workspace(compile_data *cd)
+ {
+ pcre_uchar *newspace;
+ int newsize = cd->workspace_size * 2;
+ if (newsize > COMPILE_WORK_SIZE_MAX) newsize = COMPILE_WORK_SIZE_MAX;
+ if (cd->workspace_size >= COMPILE_WORK_SIZE_MAX ||
+     newsize - cd->workspace_size < WORK_SIZE_SAFETY_MARGIN)
+  return ERR72;
+ newspace = (PUBL(malloc))(IN_UCHARS(newsize));
+ if (newspace == NULL) return ERR21;
+ memcpy(newspace, cd->start_workspace, cd->workspace_size * sizeof(pcre_uchar));
+ cd->hwm = (pcre_uchar *)newspace + (cd->hwm - cd->start_workspace);
+ if (cd->workspace_size > COMPILE_WORK_SIZE)
+   (PUBL(free))((void *)cd->start_workspace);
+ cd->start_workspace = newspace;
+ cd->workspace_size = newsize;
+ return 0;
+ }
+ /*************************************************
+ *            Check for counted repeat            *
+ *************************************************/
+ /* This function is called when a '{' is encountered in a place where it might
+ start a quantifier. It looks ahead to see if it really is a quantifier or not.
+ It is only a quantifier if it is one of the forms {ddd} {ddd,} or {ddd,ddd}
+ where the ddds are digits.
+ Arguments:
+   p         pointer to the first char after '{'
+ Returns:    TRUE or FALSE
+ */
+ static BOOL
+ is_counted_repeat(const pcre_uchar *p)
+ {
+ if (!IS_DIGIT(*p)) return FALSE;
+ p++;
+ while (IS_DIGIT(*p)) p++;
+ if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
+ if (*p++ != CHAR_COMMA) return FALSE;
+ if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
+ if (!IS_DIGIT(*p)) return FALSE;
+ p++;
+ while (IS_DIGIT(*p)) p++;
+ return (*p == CHAR_RIGHT_CURLY_BRACKET);
+ }
  /*************************************************
  *            Handle escapes                      *
  *************************************************/
  /* This function is called when a \ has been encountered. It either returns a
- positive value for a simple escape such as \n, or a negative value which
+ positive value for a simple escape such as \n, or 0 for a data character which
- encodes one of the more complicated things such as \d. A backreference to group
+ will be placed in chptr. A backreference to group n is returned as negative n.
- n is returned as -(ESC_REF + n); ESC_REF is the highest ESC_xxx macro. When
+ When UTF-8 is enabled, a positive value greater than 255 may be returned in
- UTF-8 is enabled, a positive value greater than 255 may be returned. On entry,
+ chptr. On entry, ptr is pointing at the \. On exit, it is on the final
- ptr is pointing at the \. On exit, it is on the final character of the escape
+ character of the escape sequence.
- sequence.
  Arguments:
    ptrptr         points to the pattern position pointer
+   chptr          points to a returned data character
    errorcodeptr   points to the errorcode variable
    bracount       number of previous extracting brackets
    options        the options bits
    isclass        TRUE if inside a character class
- Returns:         zero or positive => a data character
+ Returns:         zero => a data character
-                  negative => a special escape sequence
+                  positive => a special escape sequence
+                  negative => a back reference
                   on error, errorcodeptr is set
  */
  static int
- check_escape(const uschar **ptrptr, int *errorcodeptr, int bracount,
+ check_escape(const pcre_uchar **ptrptr, pcre_uint32 *chptr, int *errorcodeptr,
-   int options, BOOL isclass)
+   int bracount, int options, BOOL isclass)
  {
- BOOL utf8 = (options & PCRE_UTF8) != 0;
+ /* PCRE_UTF16 has the same value as PCRE_UTF8. */
- const uschar *ptr = *ptrptr + 1;
+ BOOL utf = (options & PCRE_UTF8) != 0;
- int c, i;
+ const pcre_uchar *ptr = *ptrptr + 1;
+ pcre_uint32 c;
+ int escape = 0;
+ int i;
  GETCHARINCTEST(c, ptr);           /* Get character value, increment pointer */
  ptr--;                            /* Set pointer back to the last byte */
  /* If backslash is at the end of the pattern, it's an error. */
- if (c == 0) *errorcodeptr = ERR1;
+ if (c == CHAR_NULL) *errorcodeptr = ERR1;
  /* Non-alphanumerics are literals. For digits or letters, do an initial lookup
  in a table. A non-zero result is something that can be returned immediately.
  Otherwise further processing may be required. */
  #ifndef EBCDIC  /* ASCII/UTF-8 coding */
- else if (c < CHAR_0 || c > CHAR_z) {}                     /* Not alphanumeric */
+ /* Not alphanumeric */
- else if ((i = escapes[c - CHAR_0]) != 0) c = i;
+ else if (c < CHAR_0 || c > CHAR_z) {}
+ else if ((i = escapes[c - CHAR_0]) != 0)
+   { if (i > 0) c = (pcre_uint32)i; else escape = -i; }
  #else           /* EBCDIC coding */
- else if (c < 'a' || (ebcdic_chartab[c] & 0x0E) == 0) {}   /* Not alphanumeric */
+ /* Not alphanumeric */
- else if ((i = escapes[c - 0x48]) != 0)  c = i;
+ else if (c < CHAR_a || (!MAX_255(c) || (ebcdic_chartab[c] & 0x0E) == 0)) {}
+ else if ((i = escapes[c - 0x48]) != 0)  { if (i > 0) c = (pcre_uint32)i; else escape = -i; }
  #endif
  /* Escapes that need further processing, or are illegal. */
  else
    {
-   const uschar *oldptr;
+   const pcre_uchar *oldptr;
-   BOOL braced, negated;
+   BOOL braced, negated, overflow;
+   int s;
    switch (c)
      {
-Line 574 
 else
+Line 1040 
 else
      case CHAR_l:
      case CHAR_L:
-     case CHAR_N:
+     *errorcodeptr = ERR37;
+     break;
      case CHAR_u:
+     if ((options & PCRE_JAVASCRIPT_COMPAT) != 0)
+       {
+       /* In JavaScript, \u must be followed by four hexadecimal numbers.
+       Otherwise it is a lowercase u letter. */
+       if (MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0
+         && MAX_255(ptr[2]) && (digitab[ptr[2]] & ctype_xdigit) != 0
+         && MAX_255(ptr[3]) && (digitab[ptr[3]] & ctype_xdigit) != 0
+         && MAX_255(ptr[4]) && (digitab[ptr[4]] & ctype_xdigit) != 0)
+         {
+         c = 0;
+         for (i = 0; i < 4; ++i)
+           {
+           register pcre_uint32 cc = *(++ptr);
+ #ifndef EBCDIC  /* ASCII/UTF-8 coding */
+           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
+           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
+ #else           /* EBCDIC coding */
+           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
+           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
+ #endif
+           }
+ #if defined COMPILE_PCRE8
+         if (c > (utf ? 0x10ffffU : 0xffU))
+ #elif defined COMPILE_PCRE16
+         if (c > (utf ? 0x10ffffU : 0xffffU))
+ #elif defined COMPILE_PCRE32
+         if (utf && c > 0x10ffffU)
+ #endif
+           {
+           *errorcodeptr = ERR76;
+           }
+         else if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
+         }
+       }
+     else
+       *errorcodeptr = ERR37;
+     break;
      case CHAR_U:
-     *errorcodeptr = ERR37;
+     /* In JavaScript, \U is an uppercase U letter. */
+     if ((options & PCRE_JAVASCRIPT_COMPAT) == 0) *errorcodeptr = ERR37;
      break;
-     /* \g must be followed by one of a number of specific things:
+     /* In a character class, \g is just a literal "g". Outside a character
+     class, \g must be followed by one of a number of specific things:
      (1) A number, either plain or braced. If positive, it is an absolute
      backreference. If negative, it is a relative backreference. This is a Perl
-Line 594 
 else
+Line 1103 
 else
      (3) For Oniguruma compatibility we also support \g followed by a name or a
      number either in angle brackets or in single quotes. However, these are
      (possibly recursive) subroutine calls, _not_ backreferences. Just return
-     the -ESC_g code (cf \k). */
+     the ESC_g code (cf \k). */
      case CHAR_g:
+     if (isclass) break;
      if (ptr[1] == CHAR_LESS_THAN_SIGN || ptr[1] == CHAR_APOSTROPHE)
        {
-       c = -ESC_g;
+       escape = ESC_g;
        break;
        }
-Line 607 
 else
+Line 1117 
 else
      if (ptr[1] == CHAR_LEFT_CURLY_BRACKET)
        {
-       const uschar *p;
+       const pcre_uchar *p;
-       for (p = ptr+2; *p != 0 && *p != CHAR_RIGHT_CURLY_BRACKET; p++)
+       for (p = ptr+2; *p != CHAR_NULL && *p != CHAR_RIGHT_CURLY_BRACKET; p++)
-         if (*p != CHAR_MINUS && (digitab[*p] & ctype_digit) == 0) break;
+         if (*p != CHAR_MINUS && !IS_DIGIT(*p)) break;
-       if (*p != 0 && *p != CHAR_RIGHT_CURLY_BRACKET)
+       if (*p != CHAR_NULL && *p != CHAR_RIGHT_CURLY_BRACKET)
          {
-         c = -ESC_k;
+         escape = ESC_k;
          break;
          }
        braced = TRUE;
-Line 627 
 else
+Line 1137 
 else
        }
      else negated = FALSE;
-     c = 0;
+     /* The integer range is limited by the machine's int representation. */
-     while ((digitab[ptr[1]] & ctype_digit) != 0)
+     s = 0;
-       c = c * 10 + *(++ptr) - CHAR_0;
+     overflow = FALSE;
+     while (IS_DIGIT(ptr[1]))
-     if (c < 0)   /* Integer overflow */
+       {
+       if (s > INT_MAX / 10 - 1) /* Integer overflow */
+         {
+         overflow = TRUE;
+         break;
+         }
+       s = s * 10 + (int)(*(++ptr) - CHAR_0);
+       }
+     if (overflow) /* Integer overflow */
        {
+       while (IS_DIGIT(ptr[1]))
+         ptr++;
        *errorcodeptr = ERR61;
        break;
        }
-Line 643 
 else
+Line 1163 
 else
        break;
        }
-     if (c == 0)
+     if (s == 0)
        {
        *errorcodeptr = ERR58;
        break;
-Line 651 
 else
+Line 1171 
 else
      if (negated)
        {
-       if (c > bracount)
+       if (s > bracount)
          {
          *errorcodeptr = ERR15;
          break;
          }
-       c = bracount - (c - 1);
+       s = bracount - (s - 1);
        }
-     c = -(ESC_REF + c);
+     escape = -s;
      break;
      /* The handling of escape sequences consisting of a string of digits
-     starting with one that is not zero is not straightforward. By experiment,
+     starting with one that is not zero is not straightforward. Perl has changed
-     the way Perl works seems to be as follows:
+     over the years. Nowadays \g{} for backreferences and \o{} for octal are
+     recommended to avoid the ambiguities in the old syntax.
      Outside a character class, the digits are read as a decimal number. If the
-     number is less than 10, or if there are that many previous extracting
+     number is less than 8 (used to be 10), or if there are that many previous
-     left brackets, then it is a back reference. Otherwise, up to three octal
+     extracting left brackets, then it is a back reference. Otherwise, up to
-     digits are read to form an escaped byte. Thus \123 is likely to be octal
+     three octal digits are read to form an escaped byte. Thus \123 is likely to
-(cf \0123, which is octal 012 followed by the literal 3). If the octal
+     be octal 123 (cf \0123, which is octal 012 followed by the literal 3). If
-     value is greater than 377, the least significant 8 bits are taken. Inside a
+     the octal value is greater than 377, the least significant 8 bits are
-     character class, \ followed by a digit is always an octal number. */
+     taken. \8 and \9 are treated as the literal characters 8 and 9.
+     Inside a character class, \ followed by a digit is always either a literal
+or 9 or an octal number. */
      case CHAR_1: case CHAR_2: case CHAR_3: case CHAR_4: case CHAR_5:
      case CHAR_6: case CHAR_7: case CHAR_8: case CHAR_9:
-Line 680 
 else
+Line 1204 
 else
      if (!isclass)
        {
        oldptr = ptr;
-       c -= CHAR_0;
+       /* The integer range is limited by the machine's int representation. */
-       while ((digitab[ptr[1]] & ctype_digit) != 0)
+       s = (int)(c -CHAR_0);
-         c = c * 10 + *(++ptr) - CHAR_0;
+       overflow = FALSE;
-       if (c < 0)    /* Integer overflow */
+       while (IS_DIGIT(ptr[1]))
+         {
+         if (s > INT_MAX / 10 - 1) /* Integer overflow */
+           {
+           overflow = TRUE;
+           break;
+           }
+         s = s * 10 + (int)(*(++ptr) - CHAR_0);
+         }
+       if (overflow) /* Integer overflow */
          {
+         while (IS_DIGIT(ptr[1]))
+           ptr++;
          *errorcodeptr = ERR61;
          break;
          }
-       if (c < 10 || c <= bracount)
+       if (s < 8 || s <= bracount)  /* Check for back reference */
          {
-         c = -(ESC_REF + c);
+         escape = -s;
          break;
          }
        ptr = oldptr;      /* Put the pointer back and fall through */
        }
-     /* Handle an octal number following \. If the first digit is 8 or 9, Perl
+     /* Handle a digit following \ when the number is not a back reference. If
-     generates a binary zero byte and treats the digit as a following literal.
+     the first digit is 8 or 9, Perl used to generate a binary zero byte and
-     Thus we have to pull back the pointer by one. */
+     then treat the digit as a following literal. At least by Perl 5.18 this
+     changed so as not to insert the binary zero. */
-     if ((c = *ptr) >= CHAR_8)
+     if ((c = *ptr) >= CHAR_8) break;
-       {
-       ptr--;
+     /* Fall through with a digit less than 8 */
-       c = 0;
-       break;
-       }
      /* \0 always starts an octal number, but we may drop through to here with a
      larger first octal digit. The original code used just to take the least
      significant 8 bits of octal numbers (I think this is what early Perls used
-     to do). Nowadays we allow for larger numbers in UTF-8 mode, but no more
+     to do). Nowadays we allow for larger numbers in UTF-8 mode and 16-bit mode,
-     than 3 octal digits. */
+     but no more than 3 octal digits. */
      case CHAR_0:
      c -= CHAR_0;
      while(i++ < 2 && ptr[1] >= CHAR_0 && ptr[1] <= CHAR_7)
          c = c * 8 + *(++ptr) - CHAR_0;
-     if (!utf8 && c > 255) *errorcodeptr = ERR51;
+ #ifdef COMPILE_PCRE8
+     if (!utf && c > 0xff) *errorcodeptr = ERR51;
+ #endif
      break;
-     /* \x is complicated. \x{ddd} is a character number which can be greater
+     /* \o is a relatively new Perl feature, supporting a more general way of
-     than 0xff in utf8 mode, but only if the ddd are hex digits. If not, { is
+     specifying character codes in octal. The only supported form is \o{ddd}. */
-     treated as a data character. */
-     case CHAR_x:
+     case CHAR_o:
-     if (ptr[1] == CHAR_LEFT_CURLY_BRACKET)
+     if (ptr[1] != CHAR_LEFT_CURLY_BRACKET) *errorcodeptr = ERR81; else
+     if (ptr[2] == CHAR_RIGHT_CURLY_BRACKET) *errorcodeptr = ERR86; else
        {
-       const uschar *pt = ptr + 2;
+       ptr += 2;
-       int count = 0;
        c = 0;
-       while ((digitab[*pt] & ctype_xdigit) != 0)
+       overflow = FALSE;
+       while (*ptr >= CHAR_0 && *ptr <= CHAR_7)
          {
-         register int cc = *pt++;
+         register pcre_uint32 cc = *ptr++;
          if (c == 0 && cc == CHAR_0) continue;     /* Leading zeroes */
-         count++;
+ #ifdef COMPILE_PCRE32
+         if (c >= 0x20000000l) { overflow = TRUE; break; }
+ #endif
+         c = (c << 3) + cc - CHAR_0 ;
+ #if defined COMPILE_PCRE8
+         if (c > (utf ? 0x10ffffU : 0xffU)) { overflow = TRUE; break; }
+ #elif defined COMPILE_PCRE16
+         if (c > (utf ? 0x10ffffU : 0xffffU)) { overflow = TRUE; break; }
+ #elif defined COMPILE_PCRE32
+         if (utf && c > 0x10ffffU) { overflow = TRUE; break; }
+ #endif
+         }
+       if (overflow)
+         {
+         while (*ptr >= CHAR_0 && *ptr <= CHAR_7) ptr++;
+         *errorcodeptr = ERR34;
+         }
+       else if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
+         {
+         if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
+         }
+       else *errorcodeptr = ERR80;
+       }
+     break;
+     /* \x is complicated. In JavaScript, \x must be followed by two hexadecimal
+     numbers. Otherwise it is a lowercase x letter. */
+     case CHAR_x:
+     if ((options & PCRE_JAVASCRIPT_COMPAT) != 0)
+       {
+       if (MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0
+         && MAX_255(ptr[2]) && (digitab[ptr[2]] & ctype_xdigit) != 0)
+         {
+         c = 0;
+         for (i = 0; i < 2; ++i)
+           {
+           register pcre_uint32 cc = *(++ptr);
  #ifndef EBCDIC  /* ASCII/UTF-8 coding */
-         if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
+           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
-         c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
+           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
  #else           /* EBCDIC coding */
-         if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
+           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
-         c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
+           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
  #endif
+           }
          }
+       }    /* End JavaScript handling */
+     /* Handle \x in Perl's style. \x{ddd} is a character number which can be
+     greater than 0xff in utf or non-8bit mode, but only if the ddd are hex
+     digits. If not, { used to be treated as a data character. However, Perl
+     seems to read hex digits up to the first non-such, and ignore the rest, so
+     that, for example \x{zz} matches a binary zero. This seems crazy, so PCRE
+     now gives an error. */
-       if (*pt == CHAR_RIGHT_CURLY_BRACKET)
+     else
+       {
+       if (ptr[1] == CHAR_LEFT_CURLY_BRACKET)
          {
-         if (c < 0 || count > (utf8? 8 : 2)) *errorcodeptr = ERR34;
+         ptr += 2;
-         ptr = pt;
+         if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
-         break;
+           {
-         }
+           *errorcodeptr = ERR86;
+           break;
+           }
+         c = 0;
+         overflow = FALSE;
+         while (MAX_255(*ptr) && (digitab[*ptr] & ctype_xdigit) != 0)
+           {
+           register pcre_uint32 cc = *ptr++;
+           if (c == 0 && cc == CHAR_0) continue;     /* Leading zeroes */
-       /* If the sequence of hex digits does not end with '}', then we don't
+ #ifdef COMPILE_PCRE32
-       recognize this construct; fall through to the normal \x handling. */
+           if (c >= 0x10000000l) { overflow = TRUE; break; }
-       }
+ #endif
-     /* Read just a single-byte hex-defined char */
+ #ifndef EBCDIC  /* ASCII/UTF-8 coding */
+           if (cc >= CHAR_a) cc -= 32;               /* Convert to upper case */
+           c = (c << 4) + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
+ #else           /* EBCDIC coding */
+           if (cc >= CHAR_a && cc <= CHAR_z) cc += 64;  /* Convert to upper case */
+           c = (c << 4) + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
+ #endif
-     c = 0;
+ #if defined COMPILE_PCRE8
-     while (i++ < 2 && (digitab[ptr[1]] & ctype_xdigit) != 0)
+           if (c > (utf ? 0x10ffffU : 0xffU)) { overflow = TRUE; break; }
-       {
+ #elif defined COMPILE_PCRE16
-       int cc;                                  /* Some compilers don't like */
+           if (c > (utf ? 0x10ffffU : 0xffffU)) { overflow = TRUE; break; }
-       cc = *(++ptr);                           /* ++ in initializers */
+ #elif defined COMPILE_PCRE32
+           if (utf && c > 0x10ffffU) { overflow = TRUE; break; }
+ #endif
+           }
+         if (overflow)
+           {
+           while (MAX_255(*ptr) && (digitab[*ptr] & ctype_xdigit) != 0) ptr++;
+           *errorcodeptr = ERR34;
+           }
+         else if (*ptr == CHAR_RIGHT_CURLY_BRACKET)
+           {
+           if (utf && c >= 0xd800 && c <= 0xdfff) *errorcodeptr = ERR73;
+           }
+         /* If the sequence of hex digits does not end with '}', give an error.
+         We used just to recognize this construct and fall through to the normal
+         \x handling, but nowadays Perl gives an error, which seems much more
+         sensible, so we do too. */
+         else *errorcodeptr = ERR79;
+         }   /* End of \x{} processing */
+       /* Read a single-byte hex-defined char (up to two hex digits after \x) */
+       else
+         {
+         c = 0;
+         while (i++ < 2 && MAX_255(ptr[1]) && (digitab[ptr[1]] & ctype_xdigit) != 0)
+           {
+           pcre_uint32 cc;                          /* Some compilers don't like */
+           cc = *(++ptr);                           /* ++ in initializers */
  #ifndef EBCDIC  /* ASCII/UTF-8 coding */
-       if (cc >= CHAR_a) cc -= 32;              /* Convert to upper case */
+           if (cc >= CHAR_a) cc -= 32;              /* Convert to upper case */
-       c = c * 16 + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
+           c = c * 16 + cc - ((cc < CHAR_A)? CHAR_0 : (CHAR_A - 10));
  #else           /* EBCDIC coding */
-       if (cc <= CHAR_z) cc += 64;              /* Convert to upper case */
+           if (cc <= CHAR_z) cc += 64;              /* Convert to upper case */
-       c = c * 16 + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
+           c = c * 16 + cc - ((cc >= CHAR_0)? CHAR_0 : (CHAR_A - 10));
  #endif
-       }
+           }
+         }     /* End of \xdd handling */
+       }       /* End of Perl-style \x handling */
      break;
      /* For \c, a following letter is upper-cased; then the 0x40 bit is flipped.
-     This coding is ASCII-specific, but then the whole concept of \cx is
+     An error is given if the byte following \c is not an ASCII character. This
+     coding is ASCII-specific, but then the whole concept of \cx is
      ASCII-specific. (However, an EBCDIC equivalent has now been added.) */
      case CHAR_c:
      c = *(++ptr);
-     if (c == 0)
+     if (c == CHAR_NULL)
        {
        *errorcodeptr = ERR2;
        break;
        }
+ #ifndef EBCDIC    /* ASCII/UTF-8 coding */
- #ifndef EBCDIC  /* ASCII/UTF-8 coding */
+     if (c > 127)  /* Excludes all non-ASCII in either mode */
+       {
+       *errorcodeptr = ERR68;
+       break;
+       }
      if (c >= CHAR_a && c <= CHAR_z) c -= 32;
      c ^= 0x40;
- #else           /* EBCDIC coding */
+ #else             /* EBCDIC coding */
      if (c >= CHAR_a && c <= CHAR_z) c += 64;
      c ^= 0xC0;
  #endif
-Line 812 
 else
+Line 1446 
 else
      }
    }
+ /* Perl supports \N{name} for character names, as well as plain \N for "not
+ newline". PCRE does not support \N{name}. However, it does support
+ quantification such as \N{2,3}. */
+ if (escape == ESC_N && ptr[1] == CHAR_LEFT_CURLY_BRACKET &&
+      !is_counted_repeat(ptr+2))
+   *errorcodeptr = ERR37;
+ /* If PCRE_UCP is set, we change the values for \d etc. */
+ if ((options & PCRE_UCP) != 0 && escape >= ESC_D && escape <= ESC_w)
+   escape += (ESC_DU - ESC_D);
+ /* Set the pointer to the final character before returning. */
  *ptrptr = ptr;
- return c;
+ *chptr = c;
+ return escape;
  }
-Line 831 
 escape sequence.
+Line 1481 
 escape sequence.
  Argument:
    ptrptr         points to the pattern position pointer
    negptr         points to a boolean that is set TRUE for negation else FALSE
-   dptr           points to an int that is set to the detailed property value
+   ptypeptr       points to an unsigned int that is set to the type value
+   pdataptr       points to an unsigned int that is set to the detailed property value
    errorcodeptr   points to the error code variable
- Returns:         type value from ucp_type_table, or -1 for an invalid type
+ Returns:         TRUE if the type value was found, or FALSE for an invalid type
  */
- static int
+ static BOOL
- get_ucp(const uschar **ptrptr, BOOL *negptr, int *dptr, int *errorcodeptr)
+ get_ucp(const pcre_uchar **ptrptr, BOOL *negptr, unsigned int *ptypeptr,
+   unsigned int *pdataptr, int *errorcodeptr)
  {
- int c, i, bot, top;
+ pcre_uchar c;
- const uschar *ptr = *ptrptr;
+ int i, bot, top;
- char name[32];
+ const pcre_uchar *ptr = *ptrptr;
+ pcre_uchar name[32];
  c = *(++ptr);
- if (c == 0) goto ERROR_RETURN;
+ if (c == CHAR_NULL) goto ERROR_RETURN;
  *negptr = FALSE;
-Line 859 
 if (c == CHAR_LEFT_CURLY_BRACKET)
+Line 1512 
 if (c == CHAR_LEFT_CURLY_BRACKET)
      *negptr = TRUE;
      ptr++;
      }
-   for (i = 0; i < (int)sizeof(name) - 1; i++)
+   for (i = 0; i < (int)(sizeof(name) / sizeof(pcre_uchar)) - 1; i++)
      {
      c = *(++ptr);
-     if (c == 0) goto ERROR_RETURN;
+     if (c == CHAR_NULL) goto ERROR_RETURN;
      if (c == CHAR_RIGHT_CURLY_BRACKET) break;
      name[i] = c;
      }
-Line 883 
 else
+Line 1536 
 else
  /* Search for a recognized property name using binary chop */
  bot = 0;
- top = _pcre_utt_size;
+ top = PRIV(utt_size);
  while (bot < top)
    {
+   int r;
    i = (bot + top) >> 1;
-   c = strcmp(name, _pcre_utt_names + _pcre_utt[i].name_offset);
+   r = STRCMP_UC_C8(name, PRIV(utt_names) + PRIV(utt)[i].name_offset);
-   if (c == 0)
+   if (r == 0)
      {
-     *dptr = _pcre_utt[i].value;
+     *ptypeptr = PRIV(utt)[i].type;
-     return _pcre_utt[i].type;
+     *pdataptr = PRIV(utt)[i].value;
+     return TRUE;
      }
-   if (c > 0) bot = i + 1; else top = i;
+   if (r > 0) bot = i + 1; else top = i;
    }
  *errorcodeptr = ERR47;
  *ptrptr = ptr;
- return -1;
+ return FALSE;
  ERROR_RETURN:
  *errorcodeptr = ERR46;
  *ptrptr = ptr;
- return -1;
+ return FALSE;
  }
  #endif
- /*************************************************
- *            Check for counted repeat            *
- *************************************************/
- /* This function is called when a '{' is encountered in a place where it might
- start a quantifier. It looks ahead to see if it really is a quantifier or not.
- It is only a quantifier if it is one of the forms {ddd} {ddd,} or {ddd,ddd}
- where the ddds are digits.
- Arguments:
-   p         pointer to the first char after '{'
- Returns:    TRUE or FALSE
- */
- static BOOL
- is_counted_repeat(const uschar *p)
- {
- if ((digitab[*p++] & ctype_digit) == 0) return FALSE;
- while ((digitab[*p] & ctype_digit) != 0) p++;
- if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
- if (*p++ != CHAR_COMMA) return FALSE;
- if (*p == CHAR_RIGHT_CURLY_BRACKET) return TRUE;
- if ((digitab[*p++] & ctype_digit) == 0) return FALSE;
- while ((digitab[*p] & ctype_digit) != 0) p++;
- return (*p == CHAR_RIGHT_CURLY_BRACKET);
- }
  /*************************************************
  *         Read repeat counts                     *
  *************************************************/
-Line 963 
 Returns:         pointer to '}' on succe
+Line 1584 
 Returns:         pointer to '}' on succe
                   current ptr on error, with errorcodeptr set non-zero
  */
- static const uschar *
+ static const pcre_uchar *
- read_repeat_counts(const uschar *p, int *minp, int *maxp, int *errorcodeptr)
+ read_repeat_counts(const pcre_uchar *p, int *minp, int *maxp, int *errorcodeptr)
  {
  int min = 0;
  int max = -1;
- /* Read the minimum value and do a paranoid check: a negative value indicates
+ while (IS_DIGIT(*p))
- an integer overflow. */
- while ((digitab[*p] & ctype_digit) != 0) min = min * 10 + *p++ - CHAR_0;
- if (min < 0 || min > 65535)
    {
-   *errorcodeptr = ERR5;
+   min = min * 10 + (int)(*p++ - CHAR_0);
-   return p;
+   if (min > 65535)
+     {
+     *errorcodeptr = ERR5;
+     return p;
+     }
    }
- /* Read the maximum value if there is one, and again do a paranoid on its size.
- Also, max must not be less than min. */
  if (*p == CHAR_RIGHT_CURLY_BRACKET) max = min; else
    {
    if (*(++p) != CHAR_RIGHT_CURLY_BRACKET)
      {
      max = 0;
-     while((digitab[*p] & ctype_digit) != 0) max = max * 10 + *p++ - CHAR_0;
+     while(IS_DIGIT(*p))
-     if (max < 0 || max > 65535)
        {
-       *errorcodeptr = ERR5;
+       max = max * 10 + (int)(*p++ - CHAR_0);
-       return p;
+       if (max > 65535)
+         {
+         *errorcodeptr = ERR5;
+         return p;
+         }
        }
      if (max < min)
        {
-Line 1001 
 if (*p == CHAR_RIGHT_CURLY_BRACKET) max
+Line 1622 
 if (*p == CHAR_RIGHT_CURLY_BRACKET) max
      }
    }
- /* Fill in the required variables, and pass back the pointer to the terminating
- '}'. */
  *minp = min;
  *maxp = max;
  return p;
-Line 1012 
 return p;
+Line 1630 
 return p;
  /*************************************************
- *  Subroutine for finding forward reference      *
+ *      Find first significant op code            *
  *************************************************/
- /* This recursive function is called only from find_parens() below. The
+ /* This is called by several functions that scan a compiled expression looking
- top-level call starts at the beginning of the pattern. All other calls must
+ for a fixed first character, or an anchoring op code etc. It skips over things
- start at a parenthesis. It scans along a pattern's text looking for capturing
+ that do not influence this. For some calls, it makes sense to skip negative
- subpatterns, and counting them. If it finds a named pattern that matches the
+ forward and all backward assertions, and also the \b assertion; for others it
- name it is given, it returns its number. Alternatively, if the name is NULL, it
+ does not.
- returns when it reaches a given numbered subpattern. We know that if (?P< is
- encountered, the name will be terminated by '>' because that is checked in the
- first pass. Recursion is used to keep track of subpatterns that reset the
- capturing group numbers - the (?| feature.
  Arguments:
-   ptrptr       address of the current character pointer (updated)
+   code         pointer to the start of the group
-   cd           compile background data
+   skipassert   TRUE if certain assertions are to be skipped
-   name         name to seek, or NULL if seeking a numbered subpattern
-   lorn         name length, or subpattern number if name is NULL
-   xmode        TRUE if we are in /x mode
-   count        pointer to the current capturing subpattern number (updated)
- Returns:       the number of the named subpattern, or -1 if not found
+ Returns:       pointer to the first significant opcode
  */
- static int
+ static const pcre_uchar*
- find_parens_sub(uschar **ptrptr, compile_data *cd, const uschar *name, int lorn,
+ first_significant_code(const pcre_uchar *code, BOOL skipassert)
-   BOOL xmode, int *count)
  {
- uschar *ptr = *ptrptr;
+ for (;;)
- int start_count = *count;
- int hwm_count = start_count;
- BOOL dup_parens = FALSE;
- /* If the first character is a parenthesis, check on the type of group we are
- dealing with. The very first call may not start with a parenthesis. */
- if (ptr[0] == CHAR_LEFT_PARENTHESIS)
    {
-   if (ptr[1] == CHAR_QUESTION_MARK &&
+   switch ((int)*code)
-       ptr[2] == CHAR_VERTICAL_LINE)
      {
-     ptr += 3;
+     case OP_ASSERT_NOT:
-     dup_parens = TRUE;
+     case OP_ASSERTBACK:
-     }
+     case OP_ASSERTBACK_NOT:
+     if (!skipassert) return code;
+     do code += GET(code, 1); while (*code == OP_ALT);
+     code += PRIV(OP_lengths)[*code];
+     break;
-   /* Handle a normal, unnamed capturing parenthesis */
+     case OP_WORD_BOUNDARY:
+     case OP_NOT_WORD_BOUNDARY:
-   else if (ptr[1] != CHAR_QUESTION_MARK && ptr[1] != CHAR_ASTERISK)
+     if (!skipassert) return code;
-     {
+     /* Fall through */
-     *count += 1;
-     if (name == NULL && *count == lorn) return *count;
-     ptr++;
-     }
-   /* Handle a condition. If it is an assertion, just carry on so that it
-   is processed as normal. If not, skip to the closing parenthesis of the
-   condition (there can't be any nested parens. */
-   else if (ptr[2] == CHAR_LEFT_PARENTHESIS)
-     {
-     ptr += 2;
-     if (ptr[1] != CHAR_QUESTION_MARK)
-       {
-       while (*ptr != 0 && *ptr != CHAR_RIGHT_PARENTHESIS) ptr++;
-       if (*ptr != 0) ptr++;
-       }
-     }
-   /* We have either (? or (* and not a condition */
-   else
-     {
-     ptr += 2;
-     if (*ptr == CHAR_P) ptr++;                      /* Allow optional P */
-     /* We have to disambiguate (?<! and (?<= from (?<name> for named groups */
-     if ((*ptr == CHAR_LESS_THAN_SIGN && ptr[1] != CHAR_EXCLAMATION_MARK &&
-         ptr[1] != CHAR_EQUALS_SIGN) || *ptr == CHAR_APOSTROPHE)
-       {
-       int term;
-       const uschar *thisname;
-       *count += 1;
-       if (name == NULL && *count == lorn) return *count;
-       term = *ptr++;
-       if (term == CHAR_LESS_THAN_SIGN) term = CHAR_GREATER_THAN_SIGN;
-       thisname = ptr;
-       while (*ptr != term) ptr++;
-       if (name != NULL && lorn == ptr - thisname &&
-           strncmp((const char *)name, (const char *)thisname, lorn) == 0)
-         return *count;
-       term++;
-       }
-     }
-   }
- /* Past any initial parenthesis handling, scan for parentheses or vertical
- bars. */
- for (; *ptr != 0; ptr++)
-   {
-   /* Skip over backslashed characters and also entire \Q...\E */
-   if (*ptr == CHAR_BACKSLASH)
-     {
-     if (*(++ptr) == 0) goto FAIL_EXIT;
-     if (*ptr == CHAR_Q) for (;;)
-       {
-       while (*(++ptr) != 0 && *ptr != CHAR_BACKSLASH) {};
-       if (*ptr == 0) goto FAIL_EXIT;
-       if (*(++ptr) == CHAR_E) break;
-       }
-     continue;
-     }
-   /* Skip over character classes; this logic must be similar to the way they
-   are handled for real. If the first character is '^', skip it. Also, if the
-   first few characters (either before or after ^) are \Q\E or \E we skip them
-   too. This makes for compatibility with Perl. Note the use of STR macros to
-   encode "Q\\E" so that it works in UTF-8 on EBCDIC platforms. */
-   if (*ptr == CHAR_LEFT_SQUARE_BRACKET)
-     {
-     BOOL negate_class = FALSE;
-     for (;;)
-       {
-       if (ptr[1] == CHAR_BACKSLASH)
-         {
-         if (ptr[2] == CHAR_E)
-           ptr+= 2;
-         else if (strncmp((const char *)ptr+2,
-                  STR_Q STR_BACKSLASH STR_E, 3) == 0)
-           ptr += 4;
-         else
-           break;
-         }
-       else if (!negate_class && ptr[1] == CHAR_CIRCUMFLEX_ACCENT)
-         {
-         negate_class = TRUE;
-         ptr++;
-         }
-       else break;
-       }
-     /* If the next character is ']', it is a data character that must be
-     skipped, except in JavaScript compatibility mode. */
-     if (ptr[1] == CHAR_RIGHT_SQUARE_BRACKET &&
-         (cd->external_options & PCRE_JAVASCRIPT_COMPAT) == 0)
-       ptr++;
-     while (*(++ptr) != CHAR_RIGHT_SQUARE_BRACKET)
-       {
-       if (*ptr == 0) return -1;
-       if (*ptr == CHAR_BACKSLASH)
-         {
-         if (*(++ptr) == 0) goto FAIL_EXIT;
-         if (*ptr == CHAR_Q) for (;;)
-           {
-           while (*(++ptr) != 0 && *ptr != CHAR_BACKSLASH) {};
-           if (*ptr == 0) goto FAIL_EXIT;
-           if (*(++ptr) == CHAR_E) break;
-           }
-         continue;
-         }
-       }
-     continue;
-     }
-   /* Skip comments in /x mode */
-   if (xmode && *ptr == CHAR_NUMBER_SIGN)
-     {
-     while (*(++ptr) != 0 && *ptr != CHAR_NL) {};
-     if (*ptr == 0) goto FAIL_EXIT;
-     continue;
-     }
-   /* Check for the special metacharacters */
-   if (*ptr == CHAR_LEFT_PARENTHESIS)
-     {
-     int rc = find_parens_sub(&ptr, cd, name, lorn, xmode, count);
-     if (rc > 0) return rc;
-     if (*ptr == 0) goto FAIL_EXIT;
-     }
-   else if (*ptr == CHAR_RIGHT_PARENTHESIS)
-     {
-     if (dup_parens && *count < hwm_count) *count = hwm_count;
-     *ptrptr = ptr;
-     return -1;
-     }
-   else if (*ptr == CHAR_VERTICAL_LINE && dup_parens)
-     {
-     if (*count > hwm_count) hwm_count = *count;
-     *count = start_count;
-     }
-   }
- FAIL_EXIT:
- *ptrptr = ptr;
- return -1;
- }
- /*************************************************
- *       Find forward referenced subpattern       *
- *************************************************/
- /* This function scans along a pattern's text looking for capturing
- subpatterns, and counting them. If it finds a named pattern that matches the
- name it is given, it returns its number. Alternatively, if the name is NULL, it
- returns when it reaches a given numbered subpattern. This is used for forward
- references to subpatterns. We used to be able to start this scan from the
- current compiling point, using the current count value from cd->bracount, and
- do it all in a single loop, but the addition of the possibility of duplicate
- subpattern numbers means that we have to scan from the very start, in order to
- take account of such duplicates, and to use a recursive function to keep track
- of the different types of group.
- Arguments:
-   cd           compile background data
-   name         name to seek, or NULL if seeking a numbered subpattern
-   lorn         name length, or subpattern number if name is NULL
-   xmode        TRUE if we are in /x mode
- Returns:       the number of the found subpattern, or -1 if not found
- */
- static int
- find_parens(compile_data *cd, const uschar *name, int lorn, BOOL xmode)
- {
- uschar *ptr = (uschar *)cd->start_pattern;
- int count = 0;
- int rc;
- /* If the pattern does not start with an opening parenthesis, the first call
- to find_parens_sub() will scan right to the end (if necessary). However, if it
- does start with a parenthesis, find_parens_sub() will return when it hits the
- matching closing parens. That is why we have to have a loop. */
- for (;;)
-   {
-   rc = find_parens_sub(&ptr, cd, name, lorn, xmode, &count);
-   if (rc > 0 || *ptr++ == 0) break;
-   }
- return rc;
- }
- /*************************************************
- *      Find first significant op code            *
- *************************************************/
- /* This is called by several functions that scan a compiled expression looking
- for a fixed first character, or an anchoring op code etc. It skips over things
- that do not influence this. For some calls, a change of option is important.
- For some calls, it makes sense to skip negative forward and all backward
- assertions, and also the \b assertion; for others it does not.
- Arguments:
-   code         pointer to the start of the group
-   options      pointer to external options
-   optbit       the option bit whose changing is significant, or
-                  zero if none are
-   skipassert   TRUE if certain assertions are to be skipped
- Returns:       pointer to the first significant opcode
- */
- static const uschar*
- first_significant_code(const uschar *code, int *options, int optbit,
-   BOOL skipassert)
- {
- for (;;)
-   {
-   switch ((int)*code)
-     {
-     case OP_OPT:
-     if (optbit > 0 && ((int)code[1] & optbit) != (*options & optbit))
-       *options = (int)code[1];
-     code += 2;
-     break;
-     case OP_ASSERT_NOT:
-     case OP_ASSERTBACK:
-     case OP_ASSERTBACK_NOT:
-     if (!skipassert) return code;
-     do code += GET(code, 1); while (*code == OP_ALT);
-     code += _pcre_OP_lengths[*code];
-     break;
-     case OP_WORD_BOUNDARY:
-     case OP_NOT_WORD_BOUNDARY:
-     if (!skipassert) return code;
-     /* Fall through */
      case OP_CALLOUT:
      case OP_CREF:
-     case OP_NCREF:
+     case OP_DNCREF:
      case OP_RREF:
-     case OP_NRREF:
+     case OP_DNRREF:
      case OP_DEF:
-     code += _pcre_OP_lengths[*code];
+     code += PRIV(OP_lengths)[*code];
      break;
      default:
-Line 1334 
 for (;;)
+Line 1684 
 for (;;)
  /*************************************************
  *        Find the fixed length of a branch       *
  *************************************************/
-Line 1352 
 and doing the check at the end; a flag s
+Line 1701 
 and doing the check at the end; a flag s
  Arguments:
    code     points to the start of the pattern (the bracket)
-   options  the compiling options
+   utf      TRUE in UTF-8 / UTF-16 / UTF-32 mode
    atend    TRUE if called when the pattern is complete
    cd       the "compile data" structure
  Returns:   the fixed length,
               or -1 if there is no fixed length,
-              or -2 if \C was encountered
+              or -2 if \C was encountered (in UTF-8 mode only)
               or -3 if an OP_RECURSE item was encountered and atend is FALSE
+              or -4 if an unknown opcode was encountered (internal error)
  */
  static int
- find_fixedlength(uschar *code, int options, BOOL atend, compile_data *cd)
+ find_fixedlength(pcre_uchar *code, BOOL utf, BOOL atend, compile_data *cd)
  {
  int length = -1;
  register int branchlength = 0;
- register uschar *cc = code + 1 + LINK_SIZE;
+ register pcre_uchar *cc = code + 1 + LINK_SIZE;
  /* Scan along the opcodes for this branch. If we get to the end of the
  branch, check the length against that of the other branches. */
-Line 1376 
 branch, check the length against that of
+Line 1726 
 branch, check the length against that of
  for (;;)
    {
    int d;
-   uschar *ce, *cs;
+   pcre_uchar *ce, *cs;
-   register int op = *cc;
+   register pcre_uchar op = *cc;
    switch (op)
      {
+     /* We only need to continue for OP_CBRA (normal capturing bracket) and
+     OP_BRA (normal non-capturing bracket) because the other variants of these
+     opcodes are all concerned with unlimited repeated groups, which of course
+     are not of fixed length. */
      case OP_CBRA:
      case OP_BRA:
      case OP_ONCE:
+     case OP_ONCE_NC:
      case OP_COND:
-     d = find_fixedlength(cc + ((op == OP_CBRA)? 2:0), options, atend, cd);
+     d = find_fixedlength(cc + ((op == OP_CBRA)? IMM2_SIZE : 0), utf, atend, cd);
      if (d < 0) return d;
      branchlength += d;
      do cc += GET(cc, 1); while (*cc == OP_ALT);
      cc += 1 + LINK_SIZE;
      break;
-     /* Reached end of a branch; if it's a ket it is the end of a nested
+     /* Reached end of a branch; if it's a ket it is the end of a nested call.
-     call. If it's ALT it is an alternation in a nested call. If it is
+     If it's ALT it is an alternation in a nested call. An ACCEPT is effectively
-     END it's the end of the outer call. All can be handled by the same code. */
+     an ALT. If it is END it's the end of the outer call. All can be handled by
+     the same code. Note that we must not include the OP_KETRxxx opcodes here,
+     because they all imply an unlimited repeat. */
      case OP_ALT:
      case OP_KET:
-     case OP_KETRMAX:
-     case OP_KETRMIN:
      case OP_END:
+     case OP_ACCEPT:
+     case OP_ASSERT_ACCEPT:
      if (length < 0) length = branchlength;
        else if (length != branchlength) return -1;
      if (*cc != OP_ALT) return length;
-Line 1413 
 for (;;)
+Line 1772 
 for (;;)
      case OP_RECURSE:
      if (!atend) return -3;
-     cs = ce = (uschar *)cd->start_code + GET(cc, 1);  /* Start subpattern */
+     cs = ce = (pcre_uchar *)cd->start_code + GET(cc, 1);  /* Start subpattern */
-     do ce += GET(ce, 1); while (*ce == OP_ALT);       /* End subpattern */
+     do ce += GET(ce, 1); while (*ce == OP_ALT);           /* End subpattern */
-     if (cc > cs && cc < ce) return -1;                /* Recursion */
+     if (cc > cs && cc < ce) return -1;                    /* Recursion */
-     d = find_fixedlength(cs + 2, options, atend, cd);
+     d = find_fixedlength(cs + IMM2_SIZE, utf, atend, cd);
      if (d < 0) return d;
      branchlength += d;
      cc += 1 + LINK_SIZE;
-Line 1429 
 for (;;)
+Line 1788 
 for (;;)
      case OP_ASSERTBACK:
      case OP_ASSERTBACK_NOT:
      do cc += GET(cc, 1); while (*cc == OP_ALT);
-     /* Fall through */
+     cc += PRIV(OP_lengths)[*cc];
+     break;
      /* Skip over things that don't match chars */
-     case OP_REVERSE:
+     case OP_MARK:
+     case OP_PRUNE_ARG:
+     case OP_SKIP_ARG:
+     case OP_THEN_ARG:
+     cc += cc[1] + PRIV(OP_lengths)[*cc];
+     break;
+     case OP_CALLOUT:
+     case OP_CIRC:
+     case OP_CIRCM:
+     case OP_CLOSE:
+     case OP_COMMIT:
      case OP_CREF:
-     case OP_NCREF:
-     case OP_RREF:
-     case OP_NRREF:
      case OP_DEF:
-     case OP_OPT:
+     case OP_DNCREF:
-     case OP_CALLOUT:
+     case OP_DNRREF:
-     case OP_SOD:
+     case OP_DOLL:
-     case OP_SOM:
+     case OP_DOLLM:
      case OP_EOD:
      case OP_EODN:
-     case OP_CIRC:
+     case OP_FAIL:
-     case OP_DOLL:
      case OP_NOT_WORD_BOUNDARY:
+     case OP_PRUNE:
+     case OP_REVERSE:
+     case OP_RREF:
+     case OP_SET_SOM:
+     case OP_SKIP:
+     case OP_SOD:
+     case OP_SOM:
+     case OP_THEN:
      case OP_WORD_BOUNDARY:
-     cc += _pcre_OP_lengths[*cc];
+     cc += PRIV(OP_lengths)[*cc];
      break;
      /* Handle literal characters */
      case OP_CHAR:
-     case OP_CHARNC:
+     case OP_CHARI:
      case OP_NOT:
+     case OP_NOTI:
      branchlength++;
      cc += 2;
- #ifdef SUPPORT_UTF8
+ #ifdef SUPPORT_UTF
-     if ((options & PCRE_UTF8) != 0 && cc[-1] >= 0xc0)
+     if (utf && HAS_EXTRALEN(cc[-1])) cc += GET_EXTRALEN(cc[-1]);
-       cc += _pcre_utf8_table4[cc[-1] & 0x3f];
  #endif
      break;
-Line 1469 
 for (;;)
+Line 1844 
 for (;;)
      need to skip over a multibyte character in UTF8 mode.  */
      case OP_EXACT:
-     branchlength += GET2(cc,1);
+     case OP_EXACTI:
-     cc += 4;
+     case OP_NOTEXACT:
- #ifdef SUPPORT_UTF8
+     case OP_NOTEXACTI:
-     if ((options & PCRE_UTF8) != 0 && cc[-1] >= 0xc0)
+     branchlength += (int)GET2(cc,1);
-       cc += _pcre_utf8_table4[cc[-1] & 0x3f];
+     cc += 2 + IMM2_SIZE;
+ #ifdef SUPPORT_UTF
+     if (utf && HAS_EXTRALEN(cc[-1])) cc += GET_EXTRALEN(cc[-1]);
  #endif
      break;
      case OP_TYPEEXACT:
      branchlength += GET2(cc,1);
-     if (cc[3] == OP_PROP || cc[3] == OP_NOTPROP) cc += 2;
+     if (cc[1 + IMM2_SIZE] == OP_PROP || cc[1 + IMM2_SIZE] == OP_NOTPROP)
-     cc += 4;
+       cc += 2;
+     cc += 1 + IMM2_SIZE + 1;
      break;
      /* Handle single-char matchers */
-Line 1490 
 for (;;)
+Line 1868 
 for (;;)
      cc += 2;
      /* Fall through */
+     case OP_HSPACE:
+     case OP_VSPACE:
+     case OP_NOT_HSPACE:
+     case OP_NOT_VSPACE:
      case OP_NOT_DIGIT:
      case OP_DIGIT:
      case OP_NOT_WHITESPACE:
-Line 1502 
 for (;;)
+Line 1884 
 for (;;)
      cc++;
      break;
-     /* The single-byte matcher isn't allowed */
+     /* The single-byte matcher isn't allowed. This only happens in UTF-8 mode;
+     otherwise \C is coded as OP_ALLANY. */
      case OP_ANYBYTE:
      return -2;
      /* Check a class for variable quantification */
- #ifdef SUPPORT_UTF8
-     case OP_XCLASS:
-     cc += GET(cc, 1) - 33;
-     /* Fall through */
- #endif
      case OP_CLASS:
      case OP_NCLASS:
-     cc += 33;
+ #if defined SUPPORT_UTF || defined COMPILE_PCRE16 || defined COMPILE_PCRE32
+     case OP_XCLASS:
+     /* The original code caused an unsigned overflow in 64 bit systems,
+     so now we use a conditional statement. */
+     if (op == OP_XCLASS)
+       cc += GET(cc, 1);
+     else
+       cc += PRIV(OP_lengths)[OP_CLASS];
+ #else
+     cc += PRIV(OP_lengths)[OP_CLASS];
+ #endif
      switch (*cc)
        {
        case OP_CRSTAR:
        case OP_CRMINSTAR:
+       case OP_CRPLUS:
+       case OP_CRMINPLUS:
        case OP_CRQUERY:
        case OP_CRMINQUERY:
+       case OP_CRPOSSTAR:
+       case OP_CRPOSPLUS:
+       case OP_CRPOSQUERY:
        return -1;
        case OP_CRRANGE:
        case OP_CRMINRANGE:
-       if (GET2(cc,1) != GET2(cc,3)) return -1;
+       case OP_CRPOSRANGE:
-       branchlength += GET2(cc,1);
+       if (GET2(cc,1) != GET2(cc,1+IMM2_SIZE)) return -1;
-       cc += 5;
+       branchlength += (int)GET2(cc,1);
+       cc += 1 + 2 * IMM2_SIZE;
        break;
        default:
-Line 1541 
 for (;;)
+Line 1934 
 for (;;)
      /* Anything else is variable length */
-     default:
+     case OP_ANYNL:
+     case OP_BRAMINZERO:
+     case OP_BRAPOS:
+     case OP_BRAPOSZERO:
+     case OP_BRAZERO:
+     case OP_CBRAPOS:
+     case OP_EXTUNI:
+     case OP_KETRMAX:
+     case OP_KETRMIN:
+     case OP_KETRPOS:
+     case OP_MINPLUS:
+     case OP_MINPLUSI:
+     case OP_MINQUERY:
+     case OP_MINQUERYI:
+     case OP_MINSTAR:
+     case OP_MINSTARI:
+     case OP_MINUPTO:
+     case OP_MINUPTOI:
+     case OP_NOTMINPLUS:
+     case OP_NOTMINPLUSI:
+     case OP_NOTMINQUERY:
+     case OP_NOTMINQUERYI:
+     case OP_NOTMINSTAR:
+     case OP_NOTMINSTARI:
+     case OP_NOTMINUPTO:
+     case OP_NOTMINUPTOI:
+     case OP_NOTPLUS:
+     case OP_NOTPLUSI:
+     case OP_NOTPOSPLUS:
+     case OP_NOTPOSPLUSI:
+     case OP_NOTPOSQUERY:
+     case OP_NOTPOSQUERYI:
+     case OP_NOTPOSSTAR:
+     case OP_NOTPOSSTARI:
+     case OP_NOTPOSUPTO:
+     case OP_NOTPOSUPTOI:
+     case OP_NOTQUERY:
+     case OP_NOTQUERYI:
+     case OP_NOTSTAR:
+     case OP_NOTSTARI:
+     case OP_NOTUPTO:
+     case OP_NOTUPTOI:
+     case OP_PLUS:
+     case OP_PLUSI:
+     case OP_POSPLUS:
+     case OP_POSPLUSI:
+     case OP_POSQUERY:
+     case OP_POSQUERYI:
+     case OP_POSSTAR:
+     case OP_POSSTARI:
+     case OP_POSUPTO:
+     case OP_POSUPTOI:
+     case OP_QUERY:
+     case OP_QUERYI:
+     case OP_REF:
+     case OP_REFI:
+     case OP_DNREF:
+     case OP_DNREFI:
+     case OP_SBRA:
+     case OP_SBRAPOS:
+     case OP_SCBRA:
+     case OP_SCBRAPOS:
+     case OP_SCOND:
+     case OP_SKIPZERO:
+     case OP_STAR:
+     case OP_STARI:
+     case OP_TYPEMINPLUS:
+     case OP_TYPEMINQUERY:
+     case OP_TYPEMINSTAR:
+     case OP_TYPEMINUPTO:
+     case OP_TYPEPLUS:
+     case OP_TYPEPOSPLUS:
+     case OP_TYPEPOSQUERY:
+     case OP_TYPEPOSSTAR:
+     case OP_TYPEPOSUPTO:
+     case OP_TYPEQUERY:
+     case OP_TYPESTAR:
+     case OP_TYPEUPTO:
+     case OP_UPTO:
+     case OP_UPTOI:
      return -1;
+     /* Catch unrecognized opcodes so that when new ones are added they
+     are not forgotten, as has happened in the past. */
+     default:
+     return -4;
      }
    }
  /* Control never gets here */
-Line 1550 
 for (;;)
+Line 2028 
 for (;;)
  /*************************************************
  *    Scan compiled regex for specific bracket    *
  *************************************************/
-Line 1563 
 length.
+Line 2040 
 length.
  Arguments:
    code        points to start of expression
-   utf8        TRUE in UTF-8 mode
+   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
    number      the required bracket number or negative to find a lookbehind
  Returns:      pointer to the opcode for the bracket, or NULL if not found
  */
- const uschar *
+ const pcre_uchar *
- _pcre_find_bracket(const uschar *code, BOOL utf8, int number)
+ PRIV(find_bracket)(const pcre_uchar *code, BOOL utf, int number)
  {
  for (;;)
    {
-   register int c = *code;
+   register pcre_uchar c = *code;
    if (c == OP_END) return NULL;
    /* XCLASS is used for classes that cannot be represented just by a bit
-Line 1587 
 for (;;)
+Line 2065 
 for (;;)
    else if (c == OP_REVERSE)
      {
-     if (number < 0) return (uschar *)code;
+     if (number < 0) return (pcre_uchar *)code;
-     code += _pcre_OP_lengths[c];
+     code += PRIV(OP_lengths)[c];
      }
    /* Handle capturing bracket */
-   else if (c == OP_CBRA)
+   else if (c == OP_CBRA || c == OP_SCBRA ||
+            c == OP_CBRAPOS || c == OP_SCBRAPOS)
      {
-     int n = GET2(code, 1+LINK_SIZE);
+     int n = (int)GET2(code, 1+LINK_SIZE);
-     if (n == number) return (uschar *)code;
+     if (n == number) return (pcre_uchar *)code;
-     code += _pcre_OP_lengths[c];
+     code += PRIV(OP_lengths)[c];
      }
    /* Otherwise, we can get the item's length from the table, except that for
    repeated character types, we have to test for \p and \P, which have an extra
-   two bytes of parameters. */
+   two bytes of parameters, and for MARK/PRUNE/SKIP/THEN with an argument, we
+   must add in its length. */
    else
      {
-Line 1624 
 for (;;)
+Line 2104 
 for (;;)
        case OP_TYPEMINUPTO:
        case OP_TYPEEXACT:
        case OP_TYPEPOSUPTO:
-       if (code[3] == OP_PROP || code[3] == OP_NOTPROP) code += 2;
+       if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
+         code += 2;
+       break;
+       case OP_MARK:
+       case OP_PRUNE_ARG:
+       case OP_SKIP_ARG:
+       case OP_THEN_ARG:
+       code += code[1];
        break;
        }
      /* Add in the fixed length from the table */
-     code += _pcre_OP_lengths[c];
+     code += PRIV(OP_lengths)[c];
    /* In UTF-8 mode, opcodes that are followed by a character may be followed by
    a multi-byte character. The length in the table is a minimum, so we have to
    arrange to skip the extra bytes. */
- #ifdef SUPPORT_UTF8
+ #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
-     if (utf8) switch(c)
+     if (utf) switch(c)
        {
        case OP_CHAR:
-       case OP_CHARNC:
+       case OP_CHARI:
+       case OP_NOT:
+       case OP_NOTI:
        case OP_EXACT:
+       case OP_EXACTI:
+       case OP_NOTEXACT:
+       case OP_NOTEXACTI:
        case OP_UPTO:
+       case OP_UPTOI:
+       case OP_NOTUPTO:
+       case OP_NOTUPTOI:
        case OP_MINUPTO:
+       case OP_MINUPTOI:
+       case OP_NOTMINUPTO:
+       case OP_NOTMINUPTOI:
        case OP_POSUPTO:
+       case OP_POSUPTOI:
+       case OP_NOTPOSUPTO:
+       case OP_NOTPOSUPTOI:
        case OP_STAR:
+       case OP_STARI:
+       case OP_NOTSTAR:
+       case OP_NOTSTARI:
        case OP_MINSTAR:
+       case OP_MINSTARI:
+       case OP_NOTMINSTAR:
+       case OP_NOTMINSTARI:
        case OP_POSSTAR:
+       case OP_POSSTARI:
+       case OP_NOTPOSSTAR:
+       case OP_NOTPOSSTARI:
        case OP_PLUS:
+       case OP_PLUSI:
+       case OP_NOTPLUS:
+       case OP_NOTPLUSI:
        case OP_MINPLUS:
+       case OP_MINPLUSI:
+       case OP_NOTMINPLUS:
+       case OP_NOTMINPLUSI:
        case OP_POSPLUS:
+       case OP_POSPLUSI:
+       case OP_NOTPOSPLUS:
+       case OP_NOTPOSPLUSI:
        case OP_QUERY:
+       case OP_QUERYI:
+       case OP_NOTQUERY:
+       case OP_NOTQUERYI:
        case OP_MINQUERY:
+       case OP_MINQUERYI:
+       case OP_NOTMINQUERY:
+       case OP_NOTMINQUERYI:
        case OP_POSQUERY:
-       if (code[-1] >= 0xc0) code += _pcre_utf8_table4[code[-1] & 0x3f];
+       case OP_POSQUERYI:
+       case OP_NOTPOSQUERY:
+       case OP_NOTPOSQUERYI:
+       if (HAS_EXTRALEN(code[-1])) code += GET_EXTRALEN(code[-1]);
        break;
        }
  #else
-     (void)(utf8);  /* Keep compiler happy by referencing function argument */
+     (void)(utf);  /* Keep compiler happy by referencing function argument */
  #endif
      }
    }
-Line 1675 
 instance of OP_RECURSE.
+Line 2204 
 instance of OP_RECURSE.
  Arguments:
    code        points to start of expression
-   utf8        TRUE in UTF-8 mode
+   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
  Returns:      pointer to the opcode for OP_RECURSE, or NULL if not found
  */
- static const uschar *
+ static const pcre_uchar *
- find_recurse(const uschar *code, BOOL utf8)
+ find_recurse(const pcre_uchar *code, BOOL utf)
  {
  for (;;)
    {
-   register int c = *code;
+   register pcre_uchar c = *code;
    if (c == OP_END) return NULL;
    if (c == OP_RECURSE) return code;
-Line 1697 
 for (;;)
+Line 2226 
 for (;;)
    /* Otherwise, we can get the item's length from the table, except that for
    repeated character types, we have to test for \p and \P, which have an extra
-   two bytes of parameters. */
+   two bytes of parameters, and for MARK/PRUNE/SKIP/THEN with an argument, we
+   must add in its length. */
    else
      {
-Line 1719 
 for (;;)
+Line 2249 
 for (;;)
        case OP_TYPEUPTO:
        case OP_TYPEMINUPTO:
        case OP_TYPEEXACT:
-       if (code[3] == OP_PROP || code[3] == OP_NOTPROP) code += 2;
+       if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
+         code += 2;
+       break;
+       case OP_MARK:
+       case OP_PRUNE_ARG:
+       case OP_SKIP_ARG:
+       case OP_THEN_ARG:
+       code += code[1];
        break;
        }
      /* Add in the fixed length from the table */
-     code += _pcre_OP_lengths[c];
+     code += PRIV(OP_lengths)[c];
      /* In UTF-8 mode, opcodes that are followed by a character may be followed
      by a multi-byte character. The length in the table is a minimum, so we have
      to arrange to skip the extra bytes. */
- #ifdef SUPPORT_UTF8
+ #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
-     if (utf8) switch(c)
+     if (utf) switch(c)
        {
        case OP_CHAR:
-       case OP_CHARNC:
+       case OP_CHARI:
+       case OP_NOT:
+       case OP_NOTI:
        case OP_EXACT:
+       case OP_EXACTI:
+       case OP_NOTEXACT:
+       case OP_NOTEXACTI:
        case OP_UPTO:
+       case OP_UPTOI:
+       case OP_NOTUPTO:
+       case OP_NOTUPTOI:
        case OP_MINUPTO:
+       case OP_MINUPTOI:
+       case OP_NOTMINUPTO:
+       case OP_NOTMINUPTOI:
        case OP_POSUPTO:
+       case OP_POSUPTOI:
+       case OP_NOTPOSUPTO:
+       case OP_NOTPOSUPTOI:
        case OP_STAR:
+       case OP_STARI:
+       case OP_NOTSTAR:
+       case OP_NOTSTARI:
        case OP_MINSTAR:
+       case OP_MINSTARI:
+       case OP_NOTMINSTAR:
+       case OP_NOTMINSTARI:
        case OP_POSSTAR:
+       case OP_POSSTARI:
+       case OP_NOTPOSSTAR:
+       case OP_NOTPOSSTARI:
        case OP_PLUS:
+       case OP_PLUSI:
+       case OP_NOTPLUS:
+       case OP_NOTPLUSI:
        case OP_MINPLUS:
+       case OP_MINPLUSI:
+       case OP_NOTMINPLUS:
+       case OP_NOTMINPLUSI:
        case OP_POSPLUS:
+       case OP_POSPLUSI:
+       case OP_NOTPOSPLUS:
+       case OP_NOTPOSPLUSI:
        case OP_QUERY:
+       case OP_QUERYI:
+       case OP_NOTQUERY:
+       case OP_NOTQUERYI:
        case OP_MINQUERY:
+       case OP_MINQUERYI:
+       case OP_NOTMINQUERY:
+       case OP_NOTMINQUERYI:
        case OP_POSQUERY:
-       if (code[-1] >= 0xc0) code += _pcre_utf8_table4[code[-1] & 0x3f];
+       case OP_POSQUERYI:
+       case OP_NOTPOSQUERY:
+       case OP_NOTPOSQUERYI:
+       if (HAS_EXTRALEN(code[-1])) code += GET_EXTRALEN(code[-1]);
        break;
        }
  #else
-     (void)(utf8);  /* Keep compiler happy by referencing function argument */
+     (void)(utf);  /* Keep compiler happy by referencing function argument */
  #endif
      }
    }
-Line 1776 
 bracket whose current branch will alread
+Line 2355 
 bracket whose current branch will alread
  Arguments:
    code        points to start of search
    endcode     points to where to stop
-   utf8        TRUE if in UTF8 mode
+   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
+   cd          contains pointers to tables etc.
+   recurses    chain of recurse_check to catch mutual recursion
  Returns:      TRUE if what is matched could be empty
  */
+ typedef struct recurse_check {
+   struct recurse_check *prev;
+   const pcre_uchar *group;
+ } recurse_check;
  static BOOL
- could_be_empty_branch(const uschar *code, const uschar *endcode, BOOL utf8)
+ could_be_empty_branch(const pcre_uchar *code, const pcre_uchar *endcode,
+   BOOL utf, compile_data *cd, recurse_check *recurses)
  {
- register int c;
+ register pcre_uchar c;
- for (code = first_significant_code(code + _pcre_OP_lengths[*code], NULL, 0, TRUE);
+ recurse_check this_recurse;
+ for (code = first_significant_code(code + PRIV(OP_lengths)[*code], TRUE);
       code < endcode;
-      code = first_significant_code(code + _pcre_OP_lengths[c], NULL, 0, TRUE))
+      code = first_significant_code(code + PRIV(OP_lengths)[c], TRUE))
    {
-   const uschar *ccode;
+   const pcre_uchar *ccode;
    c = *code;
-Line 1803 
 for (code = first_significant_code(code
+Line 2392 
 for (code = first_significant_code(code
      continue;
      }
+   /* For a recursion/subroutine call, if its end has been reached, which
+   implies a backward reference subroutine call, we can scan it. If it's a
+   forward reference subroutine call, we can't. To detect forward reference
+   we have to scan up the list that is kept in the workspace. This function is
+   called only when doing the real compile, not during the pre-compile that
+   measures the size of the compiled pattern. */
+   if (c == OP_RECURSE)
+     {
+     const pcre_uchar *scode = cd->start_code + GET(code, 1);
+     const pcre_uchar *endgroup = scode;
+     BOOL empty_branch;
+     /* Test for forward reference or uncompleted reference. This is disabled
+     when called to scan a completed pattern by setting cd->start_workspace to
+     NULL. */
+     if (cd->start_workspace != NULL)
+       {
+       const pcre_uchar *tcode;
+       for (tcode = cd->start_workspace; tcode < cd->hwm; tcode += LINK_SIZE)
+         if ((int)GET(tcode, 0) == (int)(code + 1 - cd->start_code)) return TRUE;
+       if (GET(scode, 1) == 0) return TRUE;    /* Unclosed */
+       }
+     /* If the reference is to a completed group, we need to detect whether this
+     is a recursive call, as otherwise there will be an infinite loop. If it is
+     a recursion, just skip over it. Simple recursions are easily detected. For
+     mutual recursions we keep a chain on the stack. */
+     do endgroup += GET(endgroup, 1); while (*endgroup == OP_ALT);
+     if (code >= scode && code <= endgroup) continue;  /* Simple recursion */
+     else
+       {
+       recurse_check *r = recurses;
+       for (r = recurses; r != NULL; r = r->prev)
+         if (r->group == scode) break;
+       if (r != NULL) continue;   /* Mutual recursion */
+       }
+     /* Completed reference; scan the referenced group, remembering it on the
+     stack chain to detect mutual recursions. */
+     empty_branch = FALSE;
+     this_recurse.prev = recurses;
+     this_recurse.group = scode;
+     do
+       {
+       if (could_be_empty_branch(scode, endcode, utf, cd, &this_recurse))
+         {
+         empty_branch = TRUE;
+         break;
+         }
+       scode += GET(scode, 1);
+       }
+     while (*scode == OP_ALT);
+     if (!empty_branch) return FALSE;  /* All branches are non-empty */
+     continue;
+     }
    /* Groups with zero repeats can of course be empty; skip them. */
-   if (c == OP_BRAZERO || c == OP_BRAMINZERO || c == OP_SKIPZERO)
+   if (c == OP_BRAZERO || c == OP_BRAMINZERO || c == OP_SKIPZERO ||
+       c == OP_BRAPOSZERO)
+     {
+     code += PRIV(OP_lengths)[c];
+     do code += GET(code, 1); while (*code == OP_ALT);
+     c = *code;
+     continue;
+     }
+   /* A nested group that is already marked as "could be empty" can just be
+   skipped. */
+   if (c == OP_SBRA  || c == OP_SBRAPOS ||
+       c == OP_SCBRA || c == OP_SCBRAPOS)
      {
-     code += _pcre_OP_lengths[c];
      do code += GET(code, 1); while (*code == OP_ALT);
      c = *code;
      continue;
-Line 1815 
 for (code = first_significant_code(code
+Line 2478 
 for (code = first_significant_code(code
    /* For other groups, scan the branches. */
-   if (c == OP_BRA || c == OP_CBRA || c == OP_ONCE || c == OP_COND)
+   if (c == OP_BRA  || c == OP_BRAPOS ||
+       c == OP_CBRA || c == OP_CBRAPOS ||
+       c == OP_ONCE || c == OP_ONCE_NC ||
+       c == OP_COND)
      {
      BOOL empty_branch;
      if (GET(code, 1) == 0) return TRUE;    /* Hit unclosed bracket */
-Line 1831 
 for (code = first_significant_code(code
+Line 2497 
 for (code = first_significant_code(code
        empty_branch = FALSE;
        do
          {
-         if (!empty_branch && could_be_empty_branch(code, endcode, utf8))
+         if (!empty_branch && could_be_empty_branch(code, endcode, utf, cd,
-           empty_branch = TRUE;
+           recurses)) empty_branch = TRUE;
          code += GET(code, 1);
          }
        while (*code == OP_ALT);
-Line 1849 
 for (code = first_significant_code(code
+Line 2515 
 for (code = first_significant_code(code
      {
      /* Check for quantifiers after a class. XCLASS is used for classes that
      cannot be represented just by a bit map. This includes negated single
-     high-valued characters. The length in _pcre_OP_lengths[] is zero; the
+     high-valued characters. The length in PRIV(OP_lengths)[] is zero; the
      actual length is stored in the compiled code, so we must update "code"
      here. */
- #ifdef SUPPORT_UTF8
+ #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
      case OP_XCLASS:
      ccode = code += GET(code, 1);
      goto CHECK_CLASS_REPEAT;
-Line 1861 
 for (code = first_significant_code(code
+Line 2527 
 for (code = first_significant_code(code
      case OP_CLASS:
      case OP_NCLASS:
-     ccode = code + 33;
+     ccode = code + PRIV(OP_lengths)[OP_CLASS];
- #ifdef SUPPORT_UTF8
+ #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
      CHECK_CLASS_REPEAT:
  #endif
-Line 1873 
 for (code = first_significant_code(code
+Line 2539 
 for (code = first_significant_code(code
        case OP_CRMINSTAR:
        case OP_CRQUERY:
        case OP_CRMINQUERY:
+       case OP_CRPOSSTAR:
+       case OP_CRPOSQUERY:
        break;
        default:                   /* Non-repeat => class must match */
        case OP_CRPLUS:            /* These repeats aren't empty */
        case OP_CRMINPLUS:
+       case OP_CRPOSPLUS:
        return FALSE;
        case OP_CRRANGE:
        case OP_CRMINRANGE:
+       case OP_CRPOSRANGE:
        if (GET2(ccode, 1) > 0) return FALSE;  /* Minimum > 0 */
        break;
        }
-Line 1889 
 for (code = first_significant_code(code
+Line 2559 
 for (code = first_significant_code(code
      /* Opcodes that must match a character */
+     case OP_ANY:
+     case OP_ALLANY:
+     case OP_ANYBYTE:
      case OP_PROP:
      case OP_NOTPROP:
+     case OP_ANYNL:
+     case OP_NOT_HSPACE:
+     case OP_HSPACE:
+     case OP_NOT_VSPACE:
+     case OP_VSPACE:
      case OP_EXTUNI:
      case OP_NOT_DIGIT:
      case OP_DIGIT:
      case OP_NOT_WHITESPACE:
      case OP_WHITESPACE:
      case OP_NOT_WORDCHAR:
      case OP_WORDCHAR:
-     case OP_ANY:
-     case OP_ALLANY:
-     case OP_ANYBYTE:
      case OP_CHAR:
-     case OP_CHARNC:
+     case OP_CHARI:
      case OP_NOT:
+     case OP_NOTI:
      case OP_PLUS:
+     case OP_PLUSI:
      case OP_MINPLUS:
-     case OP_POSPLUS:
+     case OP_MINPLUSI:
-     case OP_EXACT:
      case OP_NOTPLUS:
+     case OP_NOTPLUSI:
      case OP_NOTMINPLUS:
+     case OP_NOTMINPLUSI:
+     case OP_POSPLUS:
+     case OP_POSPLUSI:
      case OP_NOTPOSPLUS:
+     case OP_NOTPOSPLUSI:
+     case OP_EXACT:
+     case OP_EXACTI:
      case OP_NOTEXACT:
+     case OP_NOTEXACTI:
      case OP_TYPEPLUS:
      case OP_TYPEMINPLUS:
      case OP_TYPEPOSPLUS:
      case OP_TYPEEXACT:
+     return FALSE;
+     /* These are going to continue, as they may be empty, but we have to
+     fudge the length for the \p and \P cases. */
+     case OP_TYPESTAR:
+     case OP_TYPEMINSTAR:
+     case OP_TYPEPOSSTAR:
+     case OP_TYPEQUERY:
+     case OP_TYPEMINQUERY:
+     case OP_TYPEPOSQUERY:
+     if (code[1] == OP_PROP || code[1] == OP_NOTPROP) code += 2;
+     break;
+     /* Same for these */
+     case OP_TYPEUPTO:
+     case OP_TYPEMINUPTO:
+     case OP_TYPEPOSUPTO:
+     if (code[1 + IMM2_SIZE] == OP_PROP || code[1 + IMM2_SIZE] == OP_NOTPROP)
+       code += 2;
+     break;
+     /* End of branch */
+     case OP_KET:
+     case OP_KETRMAX:
+     case OP_KETRMIN:
+     case OP_KETRPOS:
+     case OP_ALT:
+     return TRUE;
+     /* In UTF-8 mode, STAR, MINSTAR, POSSTAR, QUERY, MINQUERY, POSQUERY, UPTO,
+     MINUPTO, and POSUPTO and their caseless and negative versions may be
+     followed by a multibyte character. */
+ #if defined SUPPORT_UTF && !defined COMPILE_PCRE32
+     case OP_STAR:
+     case OP_STARI:
+     case OP_NOTSTAR:
+     case OP_NOTSTARI:
+     case OP_MINSTAR:
+     case OP_MINSTARI:
+     case OP_NOTMINSTAR:
+     case OP_NOTMINSTARI:
+     case OP_POSSTAR:
+     case OP_POSSTARI:
+     case OP_NOTPOSSTAR:
+     case OP_NOTPOSSTARI:
+     case OP_QUERY:
+     case OP_QUERYI:
+     case OP_NOTQUERY:
+     case OP_NOTQUERYI:
+     case OP_MINQUERY:
+     case OP_MINQUERYI:
+     case OP_NOTMINQUERY:
+     case OP_NOTMINQUERYI:
+     case OP_POSQUERY:
+     case OP_POSQUERYI:
+     case OP_NOTPOSQUERY:
+     case OP_NOTPOSQUERYI:
+     if (utf && HAS_EXTRALEN(code[1])) code += GET_EXTRALEN(code[1]);
+     break;
+     case OP_UPTO:
+     case OP_UPTOI:
+     case OP_NOTUPTO:
+     case OP_NOTUPTOI:
+     case OP_MINUPTO:
+     case OP_MINUPTOI:
+     case OP_NOTMINUPTO:
+     case OP_NOTMINUPTOI:
+     case OP_POSUPTO:
+     case OP_POSUPTOI:
+     case OP_NOTPOSUPTO:
+     case OP_NOTPOSUPTOI:
+     if (utf && HAS_EXTRALEN(code[1 + IMM2_SIZE])) code += GET_EXTRALEN(code[1 + IMM2_SIZE]);
+     break;
+ #endif
+     /* MARK, and PRUNE/SKIP/THEN with an argument must skip over the argument
+     string. */
+     case OP_MARK:
+     case OP_PRUNE_ARG:
+     case OP_SKIP_ARG:
+     case OP_THEN_ARG:
+     code += code[1];
+     break;
+     /* None of the remaining opcodes are required to match a character. */
+     default:
+     break;
+     }
+   }
+ return TRUE;
+ }
+ /*************************************************
+ *    Scan compiled regex for non-emptiness       *
+ *************************************************/
+ /* This function is called to check for left recursive calls. We want to check
+ the current branch of the current pattern to see if it could match the empty
+ string. If it could, we must look outwards for branches at other levels,
+ stopping when we pass beyond the bracket which is the subject of the recursion.
+ This function is called only during the real compile, not during the
+ pre-compile.
+ Arguments:
+   code        points to start of the recursion
+   endcode     points to where to stop (current RECURSE item)
+   bcptr       points to the chain of current (unclosed) branch starts
+   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
+   cd          pointers to tables etc
+ Returns:      TRUE if what is matched could be empty
+ */
+ static BOOL
+ could_be_empty(const pcre_uchar *code, const pcre_uchar *endcode,
+   branch_chain *bcptr, BOOL utf, compile_data *cd)
+ {
+ while (bcptr != NULL && bcptr->current_branch >= code)
+   {
+   if (!could_be_empty_branch(bcptr->current_branch, endcode, utf, cd, NULL))
      return FALSE;
+   bcptr = bcptr->outer;
+   }
+ return TRUE;
+ }
+ /*************************************************
+ *        Base opcode of repeated opcodes         *
+ *************************************************/
+ /* Returns the base opcode for repeated single character type opcodes. If the
+ opcode is not a repeated character type, it returns with the original value.
+ Arguments:  c opcode
+ Returns:    base opcode for the type
+ */
+ static pcre_uchar
+ get_repeat_base(pcre_uchar c)
+ {
+ return (c > OP_TYPEPOSUPTO)? c :
+        (c >= OP_TYPESTAR)?   OP_TYPESTAR :
+        (c >= OP_NOTSTARI)?   OP_NOTSTARI :
+        (c >= OP_NOTSTAR)?    OP_NOTSTAR :
+        (c >= OP_STARI)?      OP_STARI :
+                              OP_STAR;
+ }
+ #ifdef SUPPORT_UCP
+ /*************************************************
+ *        Check a character and a property        *
+ *************************************************/
+ /* This function is called by check_auto_possessive() when a property item
+ is adjacent to a fixed character.
+ Arguments:
+   c            the character
+   ptype        the property type
+   pdata        the data for the type
+   negated      TRUE if it's a negated property (\P or \p{^)
+ Returns:       TRUE if auto-possessifying is OK
+ */
+ static BOOL
+ check_char_prop(pcre_uint32 c, unsigned int ptype, unsigned int pdata,
+   BOOL negated)
+ {
+ const pcre_uint32 *p;
+ const ucd_record *prop = GET_UCD(c);
+ switch(ptype)
+   {
+   case PT_LAMP:
+   return (prop->chartype == ucp_Lu ||
+           prop->chartype == ucp_Ll ||
+           prop->chartype == ucp_Lt) == negated;
+   case PT_GC:
+   return (pdata == PRIV(ucp_gentype)[prop->chartype]) == negated;
+   case PT_PC:
+   return (pdata == prop->chartype) == negated;
+   case PT_SC:
+   return (pdata == prop->script) == negated;
+   /* These are specials */
+   case PT_ALNUM:
+   return (PRIV(ucp_gentype)[prop->chartype] == ucp_L ||
+           PRIV(ucp_gentype)[prop->chartype] == ucp_N) == negated;
+   /* Perl space used to exclude VT, but from Perl 5.18 it is included, which
+   means that Perl space and POSIX space are now identical. PCRE was changed
+   at release 8.34. */
+   case PT_SPACE:    /* Perl space */
+   case PT_PXSPACE:  /* POSIX space */
+   switch(c)
+     {
+     HSPACE_CASES:
+     VSPACE_CASES:
+     return negated;
+     default:
+     return (PRIV(ucp_gentype)[prop->chartype] == ucp_Z) == negated;
+     }
+   break;  /* Control never reaches here */
+   case PT_WORD:
+   return (PRIV(ucp_gentype)[prop->chartype] == ucp_L ||
+           PRIV(ucp_gentype)[prop->chartype] == ucp_N ||
+           c == CHAR_UNDERSCORE) == negated;
+   case PT_CLIST:
+   p = PRIV(ucd_caseless_sets) + prop->caseset;
+   for (;;)
+     {
+     if (c < *p) return !negated;
+     if (c == *p++) return negated;
+     }
+   break;  /* Control never reaches here */
+   }
+ return FALSE;
+ }
+ #endif  /* SUPPORT_UCP */
+ /*************************************************
+ *        Fill the character property list        *
+ *************************************************/
+ /* Checks whether the code points to an opcode that can take part in auto-
+ possessification, and if so, fills a list with its properties.
+ Arguments:
+   code        points to start of expression
+   utf         TRUE if in UTF-8 / UTF-16 / UTF-32 mode
+   fcc         points to case-flipping table
+   list        points to output list
+               list[0] will be filled with the opcode
+               list[1] will be non-zero if this opcode
+                 can match an empty character string
+               list[2..7] depends on the opcode
+ Returns:      points to the start of the next opcode if *code is accepted
+               NULL if *code is not accepted
+ */
+ static const pcre_uchar *
+ get_chr_property_list(const pcre_uchar *code, BOOL utf,
+   const pcre_uint8 *fcc, pcre_uint32 *list)
+ {
+ pcre_uchar c = *code;
+ pcre_uchar base;
+ const pcre_uchar *end;
+ pcre_uint32 chr;
+ #ifdef SUPPORT_UCP
+ pcre_uint32 *clist_dest;
+ const pcre_uint32 *clist_src;
+ #else
+ utf = utf;  /* Suppress "unused parameter" compiler warning */
+ #endif
+ list[0] = c;
+ list[1] = FALSE;
+ code++;
+ if (c >= OP_STAR && c <= OP_TYPEPOSUPTO)
+   {
+   base = get_repeat_base(c);
+   c -= (base - OP_STAR);
+   if (c == OP_UPTO || c == OP_MINUPTO || c == OP_EXACT || c == OP_POSUPTO)
+     code += IMM2_SIZE;
+   list[1] = (c != OP_PLUS && c != OP_MINPLUS && c != OP_EXACT && c != OP_POSPLUS);
+   switch(base)
+     {
+     case OP_STAR:
+     list[0] = OP_CHAR;
+     break;
+     case OP_STARI:
+     list[0] = OP_CHARI;
+     break;
+     case OP_NOTSTAR:
+     list[0] = OP_NOT;
+     break;
+     case OP_NOTSTARI:
+     list[0] = OP_NOTI;
+     break;
+     case OP_TYPESTAR:
+     list[0] = *code;
+     code++;
+     break;
+     }
+   c = list[0];
+   }
+ switch(c)
+   {
+   case OP_NOT_DIGIT:
+   case OP_DIGIT:
+   case OP_NOT_WHITESPACE:
+   case OP_WHITESPACE:
+   case OP_NOT_WORDCHAR:
+   case OP_WORDCHAR:
+   case OP_ANY:
+   case OP_ALLANY:
+   case OP_ANYNL:
+   case OP_NOT_HSPACE:
+   case OP_HSPACE:
+   case OP_NOT_VSPACE:
+   case OP_VSPACE:
+   case OP_EXTUNI:
+   case OP_EODN:
+   case OP_EOD:
+   case OP_DOLL:
+   case OP_DOLLM:
+   return code;
+   case OP_CHAR:
+   case OP_NOT:
+   GETCHARINCTEST(chr, code);
+   list[2] = chr;
+   list[3] = NOTACHAR;
+   return code;
+   case OP_CHARI:
+   case OP_NOTI:
+   list[0] = (c == OP_CHARI) ? OP_CHAR : OP_NOT;
+   GETCHARINCTEST(chr, code);
+   list[2] = chr;
+ #ifdef SUPPORT_UCP
+   if (chr < 128 || (chr < 256 && !utf))
+     list[3] = fcc[chr];
+   else
+     list[3] = UCD_OTHERCASE(chr);
+ #elif defined SUPPORT_UTF || !defined COMPILE_PCRE8
+   list[3] = (chr < 256) ? fcc[chr] : chr;
+ #else
+   list[3] = fcc[chr];
+ #endif
+   /* The othercase might be the same value. */
+   if (chr == list[3])
+     list[3] = NOTACHAR;
+   else
+     list[4] = NOTACHAR;
+   return code;
+ #ifdef SUPPORT_UCP
+   case OP_PROP:
+   case OP_NOTPROP:
+   if (code[0] != PT_CLIST)
+     {
+     list[2] = code[0];
+     list[3] = code[1];
+     return code + 2;
+     }
+   /* Convert only if we have enough space. */
+   clist_src = PRIV(ucd_caseless_sets) + code[1];
+   clist_dest = list + 2;
+   code += 2;
+   do {
+      if (clist_dest >= list + 8)
+        {
+        /* Early return if there is not enough space. This should never
+        happen, since all clists are shorter than 5 character now. */
+        list[2] = code[0];
+        list[3] = code[1];
+        return code;
+        }
+      *clist_dest++ = *clist_src;
+      }
+   while(*clist_src++ != NOTACHAR);
+   /* All characters are stored. The terminating NOTACHAR
+   is copied form the clist itself. */
+   list[0] = (c == OP_PROP) ? OP_CHAR : OP_NOT;
+   return code;
+ #endif
+   case OP_NCLASS:
+   case OP_CLASS:
+ #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
+   case OP_XCLASS:
+   if (c == OP_XCLASS)
+     end = code + GET(code, 0) - 1;
+   else
+ #endif
+     end = code + 32 / sizeof(pcre_uchar);
+   switch(*end)
+     {
+     case OP_CRSTAR:
+     case OP_CRMINSTAR:
+     case OP_CRQUERY:
+     case OP_CRMINQUERY:
+     case OP_CRPOSSTAR:
+     case OP_CRPOSQUERY:
+     list[1] = TRUE;
+     end++;
+     break;
+     case OP_CRPLUS:
+     case OP_CRMINPLUS:
+     case OP_CRPOSPLUS:
+     end++;
+     break;
+     case OP_CRRANGE:
+     case OP_CRMINRANGE:
+     case OP_CRPOSRANGE:
+     list[1] = (GET2(end, 1) == 0);
+     end += 1 + 2 * IMM2_SIZE;
+     break;
+     }
+   list[2] = (pcre_uint32)(end - code);
+   return end;
+   }
+ return NULL;    /* Opcode not accepted */
+ }
+ /*************************************************
+ *    Scan further character sets for match       *
+ *************************************************/
+ /* Checks whether the base and the current opcode have a common character, in
+ which case the base cannot be possessified.
+ Arguments:
+   code        points to the byte code
+   utf         TRUE in UTF-8 / UTF-16 / UTF-32 mode
+   cd          static compile data
+   base_list   the data list of the base opcode
+ Returns:      TRUE if the auto-possessification is possible
+ */
+ static BOOL
+ compare_opcodes(const pcre_uchar *code, BOOL utf, const compile_data *cd,
+   const pcre_uint32 *base_list, const pcre_uchar *base_end, int *rec_limit)
+ {
+ pcre_uchar c;
+ pcre_uint32 list[8];
+ const pcre_uint32 *chr_ptr;
+ const pcre_uint32 *ochr_ptr;
+ const pcre_uint32 *list_ptr;
+ const pcre_uchar *next_code;
+ #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
+ const pcre_uchar *xclass_flags;
+ #endif
+ const pcre_uint8 *class_bitset;
+ const pcre_uint8 *set1, *set2, *set_end;
+ pcre_uint32 chr;
+ BOOL accepted, invert_bits;
+ BOOL entered_a_group = FALSE;
+ if (*rec_limit == 0) return FALSE;
+ --(*rec_limit);
+ /* Note: the base_list[1] contains whether the current opcode has greedy
+ (represented by a non-zero value) quantifier. This is a different from
+ other character type lists, which stores here that the character iterator
+ matches to an empty string (also represented by a non-zero value). */
+ for(;;)
+   {
+   /* All operations move the code pointer forward.
+   Therefore infinite recursions are not possible. */
+   c = *code;
+   /* Skip over callouts */
+   if (c == OP_CALLOUT)
+     {
+     code += PRIV(OP_lengths)[c];
+     continue;
+     }
+   if (c == OP_ALT)
+     {
+     do code += GET(code, 1); while (*code == OP_ALT);
+     c = *code;
+     }
+   switch(c)
+     {
+     case OP_END:
+     case OP_KETRPOS:
+     /* TRUE only in greedy case. The non-greedy case could be replaced by
+     an OP_EXACT, but it is probably not worth it. (And note that OP_EXACT
+     uses more memory, which we cannot get at this stage.) */
+     return base_list[1] != 0;
+     case OP_KET:
+     /* If the bracket is capturing, and referenced by an OP_RECURSE, or
+     it is an atomic sub-pattern (assert, once, etc.) the non-greedy case
+     cannot be converted to a possessive form. */
+     if (base_list[1] == 0) return FALSE;
+     switch(*(code - GET(code, 1)))
+       {
+       case OP_ASSERT:
+       case OP_ASSERT_NOT:
+       case OP_ASSERTBACK:
+       case OP_ASSERTBACK_NOT:
+       case OP_ONCE:
+       case OP_ONCE_NC:
+       /* Atomic sub-patterns and assertions can always auto-possessify their
+       last iterator. However, if the group was entered as a result of checking
+       a previous iterator, this is not possible. */
+       return !entered_a_group;
+       }
+     code += PRIV(OP_lengths)[c];
+     continue;
+     case OP_ONCE:
+     case OP_ONCE_NC:
+     case OP_BRA:
+     case OP_CBRA:
+     next_code = code + GET(code, 1);
+     code += PRIV(OP_lengths)[c];
+     while (*next_code == OP_ALT)
+       {
+       if (!compare_opcodes(code, utf, cd, base_list, base_end, rec_limit))
+         return FALSE;
+       code = next_code + 1 + LINK_SIZE;
+       next_code += GET(next_code, 1);
+       }
+     entered_a_group = TRUE;
+     continue;
+     case OP_BRAZERO:
+     case OP_BRAMINZERO:
+     next_code = code + 1;
+     if (*next_code != OP_BRA && *next_code != OP_CBRA
+         && *next_code != OP_ONCE && *next_code != OP_ONCE_NC) return FALSE;
+     do next_code += GET(next_code, 1); while (*next_code == OP_ALT);
+     /* The bracket content will be checked by the
+     OP_BRA/OP_CBRA case above. */
+     next_code += 1 + LINK_SIZE;
+     if (!compare_opcodes(next_code, utf, cd, base_list, base_end, rec_limit))
+       return FALSE;
+     code += PRIV(OP_lengths)[c];
+     continue;
+     default:
+     break;
+     }
+   /* Check for a supported opcode, and load its properties. */
+   code = get_chr_property_list(code, utf, cd->fcc, list);
+   if (code == NULL) return FALSE;    /* Unsupported */
+   /* If either opcode is a small character list, set pointers for comparing
+   characters from that list with another list, or with a property. */
+   if (base_list[0] == OP_CHAR)
+     {
+     chr_ptr = base_list + 2;
+     list_ptr = list;
+     }
+   else if (list[0] == OP_CHAR)
+     {
+     chr_ptr = list + 2;
+     list_ptr = base_list;
+     }
+   /* Character bitsets can also be compared to certain opcodes. */
+   else if (base_list[0] == OP_CLASS || list[0] == OP_CLASS
+ #ifdef COMPILE_PCRE8
+       /* In 8 bit, non-UTF mode, OP_CLASS and OP_NCLASS are the same. */
+       || (!utf && (base_list[0] == OP_NCLASS || list[0] == OP_NCLASS))
+ #endif
+       )
+     {
+ #ifdef COMPILE_PCRE8
+     if (base_list[0] == OP_CLASS || (!utf && base_list[0] == OP_NCLASS))
+ #else
+     if (base_list[0] == OP_CLASS)
+ #endif
+       {
+       set1 = (pcre_uint8 *)(base_end - base_list[2]);
+       list_ptr = list;
+       }
+     else
+       {
+       set1 = (pcre_uint8 *)(code - list[2]);
+       list_ptr = base_list;
+       }
+     invert_bits = FALSE;
+     switch(list_ptr[0])
+       {
+       case OP_CLASS:
+       case OP_NCLASS:
+       set2 = (pcre_uint8 *)
+         ((list_ptr == list ? code : base_end) - list_ptr[2]);
+       break;
+ #if defined SUPPORT_UTF || !defined COMPILE_PCRE8
+       case OP_XCLASS:
+       xclass_flags = (list_ptr == list ? code : base_end) - list_ptr[2] + LINK_SIZE;
+       if ((*xclass_flags & XCL_HASPROP) != 0) return FALSE;
+       if ((*xclass_flags & XCL_MAP) == 0)
+         {
+         /* No bits are set for characters < 256. */
+         if (list[1] == 0) return TRUE;
+         /* Might be an empty repeat. */
+         continue;
+         }
+       set2 = (pcre_uint8 *)(xclass_flags + 1);
+       break;
+ #endif
+       case OP_NOT_DIGIT:
+       invert_bits = TRUE;
+       /* Fall through */
+       case OP_DIGIT:
+       set2 = (pcre_uint8 *)(cd->cbits + cbit_digit);
+       break;
+       case OP_NOT_WHITESPACE:
+       invert_bits = TRUE;
+       /* Fall through */
+       case OP_WHITESPACE:
+       set2 = (pcre_uint8 *)(cd->cbits + cbit_space);
+       break;
+       case OP_NOT_WORDCHAR:
+       invert_bits = TRUE;
+       /* Fall through */
+       case OP_WORDCHAR:
+       set2 = (pcre_uint8 *)(cd->cbits + cbit_word);
+       break;
+       default:
+       return FALSE;
+       }
+     /* Because the sets are unaligned, we need
+     to perform byte comparison here. */
+     set_end = set1 + 32;
+     if (invert_bits)
+       {
+       do
+         {
+         if ((*set1++ & ~(*set2++)) != 0) return FALSE;
+         }
+       while (set1 < set_end);
+       }
+     else
+       {
+       do
+         {
+         if ((*set1++ & *set2++) != 0) return FALSE;
+         }
+       while (set1 < set_end);
+       }
+     if (list[1] == 0) return TRUE;
+     /* Might be an empty repeat. */
+     continue;
+     }
+   /* Some property combinations also acceptable. Unicode property opcodes are
+   processed specially; the rest can be handled with a lookup table. */
+   else
+     {
+     pcre_uint32 leftop, rightop;
+     leftop = base_list[0];
+     rightop = list[0];
+ #ifdef SUPPORT_UCP
+     accepted = FALSE; /* Always set in non-unicode case. */
+     if (leftop == OP_PROP || leftop == OP_NOTPROP)
+       {
+       if (rightop == OP_EOD)
+         accepted = TRUE;
+       else if (rightop == OP_PROP || rightop == OP_NOTPROP)
+         {
+         int n;
+         const pcre_uint8 *p;
+         BOOL same = leftop == rightop;
+         BOOL lisprop = leftop == OP_PROP;
+         BOOL risprop = rightop == OP_PROP;
+         BOOL bothprop = lisprop && risprop;
+         /* There's a table that specifies how each combination is to be
+         processed:
+  Always return FALSE (never auto-possessify)
+  Character groups are distinct (possessify if both are OP_PROP)
+  Check character categories in the same group (general or particular)
+  Return TRUE if the two opcodes are not the same
+           ... see comments below
+         */
+         n = propposstab[base_list[2]][list[2]];
+         switch(n)
+           {
+           case 0: break;
+           case 1: accepted = bothprop; break;
+           case 2: accepted = (base_list[3] == list[3]) != same; break;
+           case 3: accepted = !same; break;
+           case 4:  /* Left general category, right particular category */
+           accepted = risprop && catposstab[base_list[3]][list[3]] == same;
+           break;
+           case 5:  /* Right general category, left particular category */
+           accepted = lisprop && catposstab[list[3]][base_list[3]] == same;
+           break;
+           /* This code is logically tricky. Think hard before fiddling with it.
+           The posspropstab table has four entries per row. Each row relates to
+           one of PCRE's special properties such as ALNUM or SPACE or WORD.
+           Only WORD actually needs all four entries, but using repeats for the
+           others means they can all use the same code below.
+           The first two entries in each row are Unicode general categories, and
+           apply always, because all the characters they include are part of the
+           PCRE character set. The third and fourth entries are a general and a
+           particular category, respectively, that include one or more relevant
+           characters. One or the other is used, depending on whether the check
+           is for a general or a particular category. However, in both cases the
+           category contains more characters than the specials that are defined
+           for the property being tested against. Therefore, it cannot be used
+           in a NOTPROP case.
+           Example: the row for WORD contains ucp_L, ucp_N, ucp_P, ucp_Po.
+           Underscore is covered by ucp_P or ucp_Po. */
+           case 6:  /* Left alphanum vs right general category */
+           case 7:  /* Left space vs right general category */
+           case 8:  /* Left word vs right general category */
+           p = posspropstab[n-6];
+           accepted = risprop && lisprop ==
+             (list[3] != p[0] &&
+              list[3] != p[1] &&
+             (list[3] != p[2] || !lisprop));
+           break;
+           case 9:   /* Right alphanum vs left general category */
+           case 10:  /* Right space vs left general category */
+           case 11:  /* Right word vs left general category */
+           p = posspropstab[n-9];
+           accepted = lisprop && risprop ==
+             (base_list[3] != p[0] &&
+              base_list[3] != p[1] &&
+             (base_list[3] != p[2] || !risprop));
+           break;
+           case 12:  /* Left alphanum vs right particular category */
+           case 13:  /* Left space vs right particular category */
+           case 14:  /* Left word vs right particular category */
+           p = posspropstab[n-12];
+           accepted = risprop && lisprop ==
+             (catposstab[p[0]][list[3]] &&
+              catposstab[p[1]][list[3]] &&
+             (list[3] != p[3] || !lisprop));
+           break;
+           case 15:  /* Right alphanum vs left particular category */
+           case 16:  /* Right space vs left particular category */
+           case 17:  /* Right word vs left particular category */
+           p = posspropstab[n-15];
+           accepted = lisprop && risprop ==
+             (catposstab[p[0]][base_list[3]] &&
+              catposstab[p[1]][base_list[3]] &&
+             (base_list[3] != p[3] || !risprop));
+           break;
+           }
+         }
+       }
+     else
+ #endif  /* SUPPORT_UCP */
+     accepted = leftop >= FIRST_AUTOTAB_OP && leftop <= LAST_AUTOTAB_LEFT_OP &&
+            rightop >= FIRST_AUTOTAB_OP && rightop <= LAST_AUTOTAB_RIGHT_OP &&
+            autoposstab[leftop - FIRST_AUTOTAB_OP][rightop - FIRST_AUTOTAB_OP];
+     if (!accepted) return FALSE;
+     if (list[1] == 0) return TRUE;
+     /* Might be an empty repeat. */
+     continue;
+     }
+   /* Control reaches here only if one of the items is a small character list.
+   All characters are checked against the other side. */
+   do
+     {
+     chr = *chr_ptr;
+     switch(list_ptr[0])
+       {
+       case OP_CHAR:
+       ochr_ptr = list_ptr + 2;
+       do
+         {
+         if (chr == *ochr_ptr) return FALSE;
+         ochr_ptr++;
+         }
+       while(*ochr_ptr != NOTACHAR);
+       break;
+       case OP_NOT:
+       ochr_ptr = list_ptr + 2;
+       do
+         {
+         if (chr == *ochr_ptr)
+           break;
+         ochr_ptr++;
+         }
+       while(*ochr_ptr != NOTACHAR);
+       if (*ochr_ptr == NOTACHAR) return FALSE;   /* Not found */
+       break;
+       /* Note that OP_DIGIT etc. are generated only when PCRE_UCP is *not*
+       set. When it is set, \d etc. are converted into OP_(NOT_)PROP codes. */
+       case OP_DIGIT:
+       if (chr < 256 && (cd->ctypes[chr] & ctype_digit) != 0) return FALSE;
+       break;
+       case OP_NOT_DIGIT:
+       if (chr > 255 || (cd->ctypes[chr] & ctype_digit) == 0) return FALSE;
+       break;
+       case OP_WHITESPACE:
+       if (chr < 256 && (cd->ctypes[chr] & ctype_space) != 0) return FALSE;
+       break;
+       case OP_NOT_WHITESPACE:
+       if (chr > 255 || (cd->ctypes[chr] & ctype_space) == 0) return FALSE;
+       break;
+       case OP_WORDCHAR:
+       if (chr < 255 && (cd->ctypes[chr] & ctype_word) != 0) return FALSE;
+       break;
+       case OP_NOT_WORDCHAR:
+       if (chr > 255 || (cd->ctypes[chr] & ctype_word) == 0) return FALSE;
+       break;
+       case OP_HSPACE:
+       switch(chr)
+         {
+         HSPACE_CASES: return FALSE;
+         default: break;
+         }
+       break;
+       case OP_NOT_HSPACE:
+       switch(chr)
+         {
+         HSPACE_CASES: break;
+         default: return FALSE;
+         }
+       break;
+       case OP_ANYNL:
+       case OP_VSPACE:
+       switch(chr)
+         {
+         VSPACE_CASES: return FALSE;
+         default: break;
+         }
+       break;
+       case OP_NOT_VSPACE:
+       switch(chr)
+         {
+         VSPACE_CASES: break;
+         default: return FALSE;
+         }
+       break;
+       case OP_DOLL:
+       case OP_EODN:
+       switch (chr)
+         {
+         case CHAR_CR:
+         case CHAR_LF:
+         case CHAR_VT:
+         case CHAR_FF:
+         case CHAR_NEL:
+ #ifndef EBCDIC
+         case 0x2028:
+         case 0x2029:
+ #endif  /* Not EBCDIC */
+         return FALSE;
+         }
+       break;
+       case OP_EOD:    /* Can always possessify before \z */
+       break;