/*************************************************

*      Perl-Compatible Regular Expressions       *

*************************************************/

/* PCRE is a library of functions to support regular expressions whose syntax

and semantics are as close as possible to those of the Perl 5 language.

                       Written by Philip Hazel

     Original API code Copyright (c) 1997-2012 University of Cambridge

          New API code Copyright (c) 2015-2024 University of Cambridge

-----------------------------------------------------------------------------

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright notice,

      this list of conditions and the following disclaimer.

    * Redistributions in binary form must reproduce the above copyright

      notice, this list of conditions and the following disclaimer in the

      documentation and/or other materials provided with the distribution.

    * Neither the name of the University of Cambridge nor the names of its

      contributors may be used to endorse or promote products derived from

      this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

-----------------------------------------------------------------------------

*/

#include "pcre2_internal.h"

/* These defines enable debugging code */

/* #define DEBUG_FRAMES_DISPLAY */

/* #define DEBUG_SHOW_OPS */

/* #define DEBUG_SHOW_RMATCH */

#ifdef DEBUG_FRAMES_DISPLAY

#include <stdarg.h>

#endif

#ifdef DEBUG_SHOW_OPS

static const char *OP_names[] = { OP_NAME_LIST };

#endif

/* These defines identify the name of the block containing "static"

information, and fields within it. */

#define NLBLOCK mb            /* Block containing newline information */

#define PSSTART start_subject /* Field containing processed string start */

#define PSEND   end_subject   /* Field containing processed string end */

#define RECURSE_UNSET 0xffffffffu /* Bigger than max group number */

/* Masks for identifying the public options that are permitted at match time. */

#define PUBLIC_MATCH_OPTIONS                                                               \

  (PCRE2_ANCHORED | PCRE2_ENDANCHORED | PCRE2_NOTBOL | PCRE2_NOTEOL | PCRE2_NOTEMPTY |     \

   PCRE2_NOTEMPTY_ATSTART | PCRE2_NO_UTF_CHECK | PCRE2_PARTIAL_HARD | PCRE2_PARTIAL_SOFT | \

   PCRE2_NO_JIT | PCRE2_COPY_MATCHED_SUBJECT | PCRE2_DISABLE_RECURSELOOP_CHECK)

#define PUBLIC_JIT_MATCH_OPTIONS                                                                \

  (PCRE2_NO_UTF_CHECK | PCRE2_NOTBOL | PCRE2_NOTEOL | PCRE2_NOTEMPTY | PCRE2_NOTEMPTY_ATSTART | \

   PCRE2_PARTIAL_SOFT | PCRE2_PARTIAL_HARD | PCRE2_COPY_MATCHED_SUBJECT)

/* Non-error returns from and within the match() function. Error returns are

externally defined PCRE2_ERROR_xxx codes, which are all negative. */

#define MATCH_MATCH   1

#define MATCH_NOMATCH 0

/* Special internal returns used in the match() function. Make them

sufficiently negative to avoid the external error codes. */

#define MATCH_ACCEPT  (-999)

#define MATCH_KETRPOS (-998)

/* The next 5 must be kept together and in sequence so that a test that checks

for any one of them can use a range. */

#define MATCH_COMMIT        (-997)

#define MATCH_PRUNE         (-996)

#define MATCH_SKIP          (-995)

#define MATCH_SKIP_ARG      (-994)

#define MATCH_THEN          (-993)

#define MATCH_BACKTRACK_MAX MATCH_THEN

#define MATCH_BACKTRACK_MIN MATCH_COMMIT

/* Group frame type values. Zero means the frame is not a group frame. The

lower 16 bits are used for data (e.g. the capture number). Group frames are

used for most groups so that information about the start is easily available at

the end without having to scan back through intermediate frames (backtrack

points). */

#define GF_CAPTURE    0x00010000u

#define GF_NOCAPTURE  0x00020000u

#define GF_CONDASSERT 0x00030000u

#define GF_RECURSE    0x00040000u

/* Masks for the identity and data parts of the group frame type. */

#define GF_IDMASK(a)   ((a) & 0xffff0000u)

#define GF_DATAMASK(a) ((a) & 0x0000ffffu)

/* Repetition types */

enum { REPTYPE_MIN, REPTYPE_MAX, REPTYPE_POS };

/* Min and max values for the common repeats; a maximum of UINT32_MAX =>

infinity. */

static const uint32_t rep_min[] = {

  // clang-format off

  0, 0,       /* * and *? */

  1, 1,       /* + and +? */

  0, 0,       /* ? and ?? */

  0, 0,       /* dummy placefillers for OP_CR[MIN]RANGE */

  0, 1, 0,    /* OP_CRPOS{STAR, PLUS, QUERY} */

  // clang-format on

};

static const uint32_t rep_max[] = {

  // clang-format off

  UINT32_MAX, UINT32_MAX,      /* * and *? */

  UINT32_MAX, UINT32_MAX,      /* + and +? */

  1, 1,                        /* ? and ?? */

  0, 0,                        /* dummy placefillers for OP_CR[MIN]RANGE */

  UINT32_MAX, UINT32_MAX, 1,   /* OP_CRPOS{STAR, PLUS, QUERY} */

  // clang-format on

};

/* Repetition types - must include OP_CRPOSRANGE (not needed above) */

static const uint32_t rep_typ[] = {

  // clang-format off

  REPTYPE_MAX, REPTYPE_MIN,    /* * and *? */

  REPTYPE_MAX, REPTYPE_MIN,    /* + and +? */

  REPTYPE_MAX, REPTYPE_MIN,    /* ? and ?? */

  REPTYPE_MAX, REPTYPE_MIN,    /* OP_CRRANGE and OP_CRMINRANGE */

  REPTYPE_POS, REPTYPE_POS,    /* OP_CRPOSSTAR, OP_CRPOSPLUS */

  REPTYPE_POS, REPTYPE_POS,    /* OP_CRPOSQUERY, OP_CRPOSRANGE */

  // clang-format on

};

/* Numbers for RMATCH calls at backtracking points. When these lists are

changed, the code at RETURN_SWITCH below must be updated in sync.  */

enum {

  // clang-format off

  RM1=1, RM2,  RM3,  RM4,  RM5,  RM6,  RM7,  RM8,  RM9,  RM10,

  RM11,  RM12, RM13, RM14, RM15, RM16, RM17, RM18, RM19, RM20,

  RM21,  RM22, RM23, RM24, RM25, RM26, RM27, RM28, RM29, RM30,

  RM31,  RM32, RM33, RM34, RM35, RM36, RM37, RM38, RM39,

  // clang-format on

};

#ifdef SUPPORT_WIDE_CHARS

enum {

  // clang-format off

  RM100=100, RM101, RM102, RM103,

  // clang-format on

};

#endif

#ifdef SUPPORT_UNICODE

enum {

  // clang-format off

  RM200=200, RM201, RM202, RM203, RM204, RM205, RM206, RM207,

  RM208,     RM209, RM210, RM211, RM212, RM213, RM214, RM215,

  RM216,     RM217, RM218, RM219, RM220, RM221, RM222, RM223,

  RM224,

  // clang-format on

};

#endif

/* Define short names for general fields in the current backtrack frame, which

is always pointed to by the F variable. Occasional references to fields in

other frames are written out explicitly. There are also some fields in the

current frame that are used for short-term, localised backtracking memory.

These are members of the fields union and #defined with Lxxx names at the

point of use and undefined afterwards. */

#define Fback_frame        F->back_frame

#define Fcapture_last      F->capture_last

#define Fcurrent_recurse   F->current_recurse

#define Fecode             F->ecode

#define Feptr              F->eptr

#define Fgroup_frame_type  F->group_frame_type

#define Flast_group_offset F->last_group_offset

#define Fmark              F->mark

#define Frdepth            F->rdepth

#define Fstart_match       F->start_match

#define Foffset_top        F->offset_top

#define Fop                F->op

#define Fovector           F->ovector

#define Freturn_id         F->return_id

#ifdef DEBUG_FRAMES_DISPLAY

/*************************************************

*      Display current frames and contents       *

*************************************************/

/* This debugging function displays the current set of frames and their

contents. It is not called automatically from anywhere, the intention being

that calls can be inserted where necessary when debugging frame-related

problems.

Arguments:

  f           the file to write to

  F           the current top frame

  P           a previous frame of interest

  frame_size  the frame size

  mb          points to the match block

  match_data  points to the match data block

  s           identification text

Returns:    nothing

*/

static void

display_frames(FILE *f, heapframe *F, heapframe *P, PCRE2_SIZE frame_size, match_block *mb,

               pcre2_match_data *match_data, const char *s, ...)

{

  uint32_t i;

  heapframe *Q;

  va_list ap;

  va_start(ap, s);

  fprintf(f, "FRAMES ");

  vfprintf(f, s, ap);

  va_end(ap);

  if (P != NULL)

    fprintf(f, " P=%lu", ((char *)P - (char *)(match_data->heapframes)) / frame_size);

  fprintf(f, "\n");

  for (i = 0, Q = match_data->heapframes; Q <= F; i++, Q = (heapframe *)((char *)Q + frame_size))

  {

    fprintf(f, "Frame %d type=%x subj=%lu code=%d back=%lu id=%d", i, Q->group_frame_type,

            Q->eptr - mb->start_subject, *(Q->ecode), Q->back_frame, Q->return_id);

    if (Q->last_group_offset == PCRE2_UNSET)

      fprintf(f, " lgoffset=unset\n");

    else

      fprintf(f, " lgoffset=%lu\n", Q->last_group_offset / frame_size);

  }

}

#endif

/*************************************************

*                Process a callout               *

*************************************************/

/* This function is called for all callouts, whether "standalone" or at the

start of a conditional group. Feptr will be pointing to either OP_CALLOUT or

OP_CALLOUT_STR. A callout block is allocated in pcre2_match() and initialized

with fixed values.

Arguments:

  F          points to the current backtracking frame

  mb         points to the match block

  lengthptr  where to return the length of the callout item

Returns:     the return from the callout

             or 0 if no callout function exists

*/

static int

do_callout(heapframe *F, match_block *mb, PCRE2_SIZE *lengthptr)

{

  int rc;

  PCRE2_SIZE save0, save1;

  PCRE2_SIZE *callout_ovector;

  pcre2_callout_block *cb;

  *lengthptr =

      (*Fecode == OP_CALLOUT) ? PRIV(OP_lengths)[OP_CALLOUT] : GET(Fecode, 1 + 2 * LINK_SIZE);

  if (mb->callout == NULL)

    return 0; // No callout function provided

  /* The original matching code (pre 10.30) worked directly with the ovector

  passed by the user, and this was passed to callouts. Now that the working

  ovector is in the backtracking frame, it no longer needs to reserve space for

  the overall match offsets (which would waste space in the frame). For backward

  compatibility, however, we pass capture_top and offset_vector to the callout as

  if for the extended ovector, and we ensure that the first two slots are unset

  by preserving and restoring their current contents. Picky compilers complain if

  references such as Fovector[-2] are use directly, so we set up a separate

  pointer. */

  callout_ovector = (PCRE2_SIZE *)(Fovector)-2;

  /* The cb->version, cb->subject, cb->subject_length, and cb->start_match fields

  are set externally. The first 3 never change; the last is updated for each

  bumpalong. */

  cb = mb->cb;

  cb->capture_top = (uint32_t)Foffset_top / 2 + 1;

  cb->capture_last = Fcapture_last;

  cb->offset_vector = callout_ovector;

  cb->mark = mb->nomatch_mark;

  cb->current_position = (PCRE2_SIZE)(Feptr - mb->start_subject);

  cb->pattern_position = GET(Fecode, 1);

  cb->next_item_length = GET(Fecode, 1 + LINK_SIZE);

  if (*Fecode == OP_CALLOUT) // Numerical callout

  {

    cb->callout_number = Fecode[1 + 2 * LINK_SIZE];

    cb->callout_string_offset = 0;

    cb->callout_string = NULL;

    cb->callout_string_length = 0;

  }

  else // String callout

  {

    cb->callout_number = 0;

    cb->callout_string_offset = GET(Fecode, 1 + 3 * LINK_SIZE);

    cb->callout_string = Fecode + (1 + 4 * LINK_SIZE) + 1;

    cb->callout_string_length = *lengthptr - (1 + 4 * LINK_SIZE) - 2;

  }

  save0 = callout_ovector[0];

  save1 = callout_ovector[1];

  callout_ovector[0] = callout_ovector[1] = PCRE2_UNSET;

  rc = mb->callout(cb, mb->callout_data);

  callout_ovector[0] = save0;

  callout_ovector[1] = save1;

  cb->callout_flags = 0;

  return rc;

}

/*************************************************

*          Match a back-reference                *

*************************************************/

/* This function is called only when it is known that the offset lies within

the offsets that have so far been used in the match. Note that in caseless

UTF-8 mode, the number of subject bytes matched may be different to the number

of reference bytes. (In theory this could also happen in UTF-16 mode, but it

seems unlikely.)

Arguments:

  offset      index into the offset vector

  caseless    TRUE if caseless

  caseopts    bitmask of REFI_FLAG_XYZ values

  F           the current backtracking frame pointer

  mb          points to match block

  lengthptr   pointer for returning the length matched

Returns:      = 0 sucessful match; number of code units matched is set

              < 0 no match

              > 0 partial match

*/

static int

match_ref(PCRE2_SIZE offset, BOOL caseless, int caseopts, heapframe *F, match_block *mb,

          PCRE2_SIZE *lengthptr)

{

  PCRE2_SPTR p;

  PCRE2_SIZE length;

  PCRE2_SPTR eptr;

  PCRE2_SPTR eptr_start;

#ifndef SUPPORT_UNICODE

  (void)caseopts; // Avoid compiler warning.

#endif

  /* Deal with an unset group. The default is no match, but there is an option to

  match an empty string. */

  if (offset >= Foffset_top || Fovector[offset] == PCRE2_UNSET)

  {

    if ((mb->poptions & PCRE2_MATCH_UNSET_BACKREF) != 0)

    {

      *lengthptr = 0;

      return 0; // Match

    }

    else

    {

      return -1; // No match

    }

  }

  /* Separate the caseless and UTF cases for speed. */

  eptr = eptr_start = Feptr;

  p = mb->start_subject + Fovector[offset];

  length = Fovector[offset + 1] - Fovector[offset];

  PCRE2_ASSERT(eptr <= mb->end_subject);

  if (caseless)

  {

#if defined SUPPORT_UNICODE

    BOOL utf = (mb->poptions & PCRE2_UTF) != 0;

    BOOL caseless_restrict = (caseopts & REFI_FLAG_CASELESS_RESTRICT) != 0;

    BOOL turkish_casing = !caseless_restrict && (caseopts & REFI_FLAG_TURKISH_CASING) != 0;

    if (utf || (mb->poptions & PCRE2_UCP) != 0)

    {

      PCRE2_SPTR endptr = p + length;

      /* Match characters up to the end of the reference. NOTE: the number of

      code units matched may differ, because in UTF-8 there are some characters

      whose upper and lower case codes have different numbers of bytes. For

      example, U+023A (2 bytes in UTF-8) is the upper case version of U+2C65 (3

      bytes in UTF-8); a sequence of 3 of the former uses 6 bytes, as does a

      sequence of two of the latter. It is important, therefore, to check the

      length along the reference, not along the subject (earlier code did this

      wrong). UCP uses Unicode properties but without UTF encoding. */

      while (p < endptr)

      {

        uint32_t c, d;

        const ucd_record *ur;

        if (eptr >= mb->end_subject)

          return 1; // Partial match

        if (utf)

        {

          GETCHARINC(c, eptr);

          GETCHARINC(d, p);

        }

        else

        {

          c = *eptr++;

          d = *p++;

        }

        if (turkish_casing && UCD_ANY_I(d))

        {

          c = UCD_FOLD_I_TURKISH(c);

          d = UCD_FOLD_I_TURKISH(d);

          if (c != d)

            return -1; // No match

        }

        else if (c != d && c != (uint32_t)((int)d + (ur = GET_UCD(d))->other_case))

        {

          const uint32_t *pp = PRIV(ucd_caseless_sets) + ur->caseset;

          /* When PCRE2_EXTRA_CASELESS_RESTRICT is set, ignore any caseless sets

          that start with an ASCII character. */

          if (caseless_restrict && *pp < 128)

            return -1; // No match

          for (;;)

          {

            if (c < *pp)

              return -1; // No match

            if (c == *pp++)

              break;

          }

        }

      }

    }

    else

#endif

    /* Not in UTF or UCP mode */

    {

      for (; length > 0; length--)

      {

        uint32_t cc, cp;

        if (eptr >= mb->end_subject)

          return 1; // Partial match

        cc = *eptr;

        cp = *p;

        if (TABLE_GET(cp, mb->lcc, cp) != TABLE_GET(cc, mb->lcc, cc))

          return -1; // No match

        p++;

        eptr++;

      }

    }

  }

  /* In the caseful case, we can just compare the code units, whether or not we

  are in UTF and/or UCP mode. When partial matching, we have to do this unit by

  unit. */

  else

  {

    if (mb->partial != 0)

    {

      for (; length > 0; length--)

      {

        if (eptr >= mb->end_subject)

          return 1; // Partial match

        if (*p++ != *eptr++)

          return -1; // No match

      }

    }

    /* Not partial matching */

    else

    {

      if ((PCRE2_SIZE)(mb->end_subject - eptr) < length || memcmp(p, eptr, CU2BYTES(length)) != 0)

        return -1; // No match

      eptr += length;

    }

  }

  *lengthptr = eptr - eptr_start;

  return 0; // Match

}

/*************************************************

*     Restore offsets after a recurse            *

*************************************************/

/* This function restores the ovector values when

a recursive block reaches its end, and the triggering

recurse has and argument list.

Arguments:

  F           the current backtracking frame pointer

  P           the previous backtracking frame pointer

*/

static void

recurse_update_offsets(heapframe *F, heapframe *P)

{

  PCRE2_SIZE *dst = F->ovector;

  PCRE2_SIZE *src = P->ovector;

  /* The first bracket has offset 2, because

  offset 0 is reserved for the full match. */

  PCRE2_SIZE offset = 2;

  PCRE2_SIZE offset_top = Foffset_top + 2;

  PCRE2_SIZE diff;

  PCRE2_SPTR ecode = Fecode;

  do

  {

    diff = (GET2(ecode, 1) << 1) - offset;

    ecode += 1 + IMM2_SIZE;

    if (offset + diff >= offset_top)

    {

      /* Some OP_CREF opcodes are not

      processed, they must be skipped. */

      while (*ecode == OP_CREF)

        ecode += 1 + IMM2_SIZE;

      break;

    }

    if (diff == 2)

    {

      dst[0] = src[0];

      dst[1] = src[1];

    }

    else if (diff >= 4)

    {

      memcpy(dst, src, diff * sizeof(PCRE2_SIZE));

    }

    /* Skip the unmodified entry. */

    diff += 2;

    offset += diff;

    dst += diff;

    src += diff;

  } while (*ecode == OP_CREF);

  diff = offset_top - offset;

  if (diff == 2)

  {

    dst[0] = src[0];

    dst[1] = src[1];

  }

  else if (diff >= 4)

  {

    memcpy(dst, src, diff * sizeof(PCRE2_SIZE));

  }

  Fecode = ecode;

  Foffset_top = (offset <= P->offset_top) ? P->offset_top : (offset - 2);

}

/******************************************************************************

*******************************************************************************

                   "Recursion" in the match() function

The original match() function was highly recursive, but this proved to be the

source of a number of problems over the years, mostly because of the relatively

small system stacks that are commonly found. As new features were added to

patterns, various kludges were invented to reduce the amount of stack used,

making the code hard to understand in places.

A version did exist that used individual frames on the heap instead of calling

match() recursively, but this ran substantially slower. The current version is

a refactoring that uses a vector of frames to remember backtracking points.

This runs no slower, and possibly even a bit faster than the original recursive

implementation.

At first, an initial vector of size START_FRAMES_SIZE (enough for maybe 50

frames) was allocated on the system stack. If this was not big enough, the heap

was used for a larger vector. However, it turns out that there are environments

where taking as little as 20KiB from the system stack is an embarrassment.

After another refactoring, the heap is used exclusively, but a pointer the

frames vector and its size are cached in the match_data block, so that there is

no new memory allocation if the same match_data block is used for multiple

matches (unless the frames vector has to be extended).

*******************************************************************************

******************************************************************************/

/*************************************************

*       Macros for the match() function          *

*************************************************/

/* These macros pack up tests that are used for partial matching several times

in the code. The second one is used when we already know we are past the end of

the subject. We set the "hit end" flag if the pointer is at the end of the

subject and either (a) the pointer is past the earliest inspected character

(i.e. something has been matched, even if not part of the actual matched

string), or (b) the pattern contains a lookbehind. These are the conditions for

which adding more characters may allow the current match to continue.

For hard partial matching, we immediately return a partial match. Otherwise,

carrying on means that a complete match on the current subject will be sought.

A partial match is returned only if no complete match can be found. */

#define CHECK_PARTIAL()           \

  do                              \

  {                               \

    if (Feptr >= mb->end_subject) \

    {                             \

      SCHECK_PARTIAL();           \

    }                             \

  } while (0)

#define SCHECK_PARTIAL()                                                           \

  do                                                                               \

  {                                                                                \

    if (mb->partial != 0 && (Feptr > mb->start_used_ptr || mb->allowemptypartial)) \

    {                                                                              \

      mb->hitend = TRUE;                                                           \

      if (mb->partial > 1)                                                         \

        return PCRE2_ERROR_PARTIAL;                                                \

    }                                                                              \

  } while (0)

/* These macros are used to implement backtracking. They simulate a recursive

call to the match() function by means of a local vector of frames which

remember the backtracking points. */

#define RMATCH(ra, rb)  \

  do                    \

  {                     \

    start_ecode = ra;   \

    Freturn_id = rb;    \

    goto MATCH_RECURSE; \

    L_##rb :;           \

  } while (0)

#define RRETURN(ra)     \

  do                    \

  {                     \

    rrc = ra;           \

    goto RETURN_SWITCH; \

  } while (0)

/*************************************************

*         Match from current position            *

*************************************************/

/* This function is called to run one match attempt at a single starting point

in the subject.

Performance note: It might be tempting to extract commonly used fields from the

mb structure (e.g. end_subject) into individual variables to improve

performance. Tests using gcc on a SPARC disproved this; in the first case, it

made performance worse.

Arguments:

   start_eptr   starting character in subject

   start_ecode  starting position in compiled code

   top_bracket  number of capturing parentheses in the pattern

   frame_size   size of each backtracking frame

   match_data   pointer to the match_data block

   mb           pointer to "static" variables block

Returns:        MATCH_MATCH if matched            )  these values are >= 0

                MATCH_NOMATCH if failed to match  )

                negative MATCH_xxx value for PRUNE, SKIP, etc

                negative PCRE2_ERROR_xxx value if aborted by an error condition

                (e.g. stopped by repeated call or depth limit)

*/

static int

match(PCRE2_SPTR start_eptr, PCRE2_SPTR start_ecode, uint16_t top_bracket, PCRE2_SIZE frame_size,

      pcre2_match_data *match_data, match_block *mb)

{

  /* Frame-handling variables */

  heapframe *F;        // Current frame pointer

  heapframe *N = NULL; // Temporary frame pointers

  heapframe *P = NULL;

  heapframe *frames_top;                 // End of frames vector

  heapframe *assert_accept_frame = NULL; // For passing back a frame with captures

  PCRE2_SIZE frame_copy_size;            // Amount to copy when creating a new frame

  /* Local variables that do not need to be preserved over calls to RMATCH(). */

  PCRE2_SPTR branch_end = NULL;

  PCRE2_SPTR branch_start;

  PCRE2_SPTR bracode; // Temp pointer to start of group

  PCRE2_SIZE offset;  // Used for group offsets

  PCRE2_SIZE length;  // Used for various length calculations

  int rrc; // Return from functions & backtracking "recursions"

#ifdef SUPPORT_UNICODE

  int proptype; // Type of character property

#endif

  uint32_t i;                // Used for local loops

  uint32_t fc;               // Character values

  uint32_t number;           // Used for group and other numbers

  uint32_t reptype = 0;      // Type of repetition (0 to avoid compiler warning)

  uint32_t group_frame_type; // Specifies type for new group frames

  BOOL condition;    // Used in conditional groups

  BOOL cur_is_word;  // Used in "word" tests

  BOOL prev_is_word; // Used in "word" tests

  /* UTF and UCP flags */

#ifdef SUPPORT_UNICODE

  BOOL utf = (mb->poptions & PCRE2_UTF) != 0;

  BOOL ucp = (mb->poptions & PCRE2_UCP) != 0;

#else

  BOOL utf = FALSE; // Required for convenience even when no Unicode support

#endif

  /* This is the length of the last part of a backtracking frame that must be

  copied when a new frame is created. */

  frame_copy_size = frame_size - offsetof(heapframe, eptr);

  /* Set up the first frame and the end of the frames vector. */

  F = match_data->heapframes;

  frames_top = (heapframe *)((char *)F + match_data->heapframes_size);

  Frdepth = 0;                       // "Recursion" depth

  Fcapture_last = 0;                 // Number of most recent capture

  Fcurrent_recurse = RECURSE_UNSET;  // Not pattern recursing.

  Fstart_match = Feptr = start_eptr; // Current data pointer and start match

  Fmark = NULL;                      // Most recent mark

  Foffset_top = 0;                   // End of captures within the frame

  Flast_group_offset = PCRE2_UNSET;  // Saved frame of most recent group

  group_frame_type = 0;              // Not a start of group frame

  goto NEW_FRAME;                    // Start processing with this frame

  /* Come back here when we want to create a new frame for remembering a

  backtracking point. */

MATCH_RECURSE:

  /* Set up a new backtracking frame. If the vector is full, get a new one,

  doubling the size, but constrained by the heap limit (which is in KiB). */

  N = (heapframe *)((char *)F + frame_size);

  if ((heapframe *)((char *)N + frame_size) >= frames_top)

  {

    heapframe *new;

    PCRE2_SIZE newsize;

    PCRE2_SIZE usedsize = (char *)N - (char *)(match_data->heapframes);

    if (match_data->heapframes_size >= PCRE2_SIZE_MAX / 2)

    {

      if (match_data->heapframes_size == PCRE2_SIZE_MAX - 1)

        return PCRE2_ERROR_NOMEMORY;

      newsize = PCRE2_SIZE_MAX - 1;

    }

    else

    {

      newsize = match_data->heapframes_size * 2;

    }

    if (newsize / 1024 >= mb->heap_limit)

    {

      PCRE2_SIZE old_size = match_data->heapframes_size / 1024;

      if (mb->heap_limit <= old_size)

      {

        return PCRE2_ERROR_HEAPLIMIT;

      }

      else

      {

        PCRE2_SIZE max_delta = 1024 * (mb->heap_limit - old_size);

        int over_bytes = match_data->heapframes_size % 1024;

        if (over_bytes)

          max_delta -= (1024 - over_bytes);

        newsize = match_data->heapframes_size + max_delta;

      }

    }

    /* With a heap limit set, the permitted additional size may not be enough for

    another frame, so do a final check. */

    if (newsize - usedsize < frame_size)

      return PCRE2_ERROR_HEAPLIMIT;

    new = match_data->memctl.malloc(newsize, match_data->memctl.memory_data);

    if (new == NULL)

      return PCRE2_ERROR_NOMEMORY;

    memcpy(new, match_data->heapframes, usedsize);

    N = (heapframe *)((char *)new + usedsize);

    F = (heapframe *)((char *)N - frame_size);

    match_data->memctl.free(match_data->heapframes, match_data->memctl.memory_data);

    match_data->heapframes = new;

    match_data->heapframes_size = newsize;

    frames_top = (heapframe *)((char *)new + newsize);

  }

#ifdef DEBUG_SHOW_RMATCH

  fprintf(stderr, "++ RMATCH %d frame=%d", Freturn_id, Frdepth + 1);

  if (group_frame_type != 0)

  {

    fprintf(stderr, " type=%x ", group_frame_type);

    switch (GF_IDMASK(group_frame_type))

    {

    case GF_CAPTURE:

      fprintf(stderr, "capture=%d", GF_DATAMASK(group_frame_type));

      break;

    case GF_NOCAPTURE:

      fprintf(stderr, "nocapture op=%d", Fop);

      break;

    case GF_CONDASSERT:

      fprintf(stderr, "condassert op=%d", Fop);

      break;

    case GF_RECURSE:

      fprintf(stderr, "recurse=%d", GF_DATAMASK(group_frame_type));

      break;

    default:

      fprintf(stderr, "*** unknown ***");

      break;

    }

  }

  fprintf(stderr, "\n");

#endif

  /* Copy those fields that must be copied into the new frame, increase the

  "recursion" depth (i.e. the new frame's index) and then make the new frame

  current. */

  memcpy((char *)N + offsetof(heapframe, eptr), (char *)F + offsetof(heapframe, eptr),

         frame_copy_size);

  N->rdepth = Frdepth + 1;

  F = N;

  /* Carry on processing with a new frame. */

NEW_FRAME:

  Fgroup_frame_type = group_frame_type;

  Fecode = start_ecode;     // Starting code pointer

  Fback_frame = frame_size; // Default is go back one frame

  /* If this is a special type of group frame, remember its offset for quick

  access at the end of the group. If this is a recursion, set a new current

  recursion value. */

  if (group_frame_type != 0)

  {

    Flast_group_offset = (char *)F - (char *)match_data->heapframes;

    if (GF_IDMASK(group_frame_type) == GF_RECURSE)

      Fcurrent_recurse = GF_DATAMASK(group_frame_type);

    group_frame_type = 0;

  }

  /* ========================================================================= */

  /* This is the main processing loop. First check that we haven't recorded too

  many backtracks (search tree is too large), or that we haven't exceeded the

  recursive depth limit (used too many backtracking frames). If not, process the

  opcodes. */

  if (mb->match_call_count++ >= mb->match_limit)

    return PCRE2_ERROR_MATCHLIMIT;

  if (Frdepth >= mb->match_limit_depth)

    return PCRE2_ERROR_DEPTHLIMIT;

#ifdef DEBUG_SHOW_OPS

  fprintf(stderr, "\n++ New frame: type=0x%x subject offset %ld\n", GF_IDMASK(Fgroup_frame_type),

          Feptr - mb->start_subject);

#endif

  for (;;)

  {

#ifdef DEBUG_SHOW_OPS

    fprintf(stderr, "++ %2ld op=%3d %s\n", Fecode - mb->start_code, *Fecode, OP_names[*Fecode]);

#endif

    Fop = (uint8_t)(*Fecode); // Cast needed for 16-bit and 32-bit modes

    switch (Fop)

    {

      /* ===================================================================== */

      /* Before OP_ACCEPT there may be any number of OP_CLOSE opcodes, to close

      any currently open capturing brackets. Unlike reaching the end of a group,

      where we know the starting frame is at the top of the chained frames, in

      this case we have to search back for the relevant frame in case other types

      of group that use chained frames have intervened. Multiple OP_CLOSEs always

      come innermost first, which matches the chain order. We can ignore this in

      a recursion, because captures are not passed out of recursions. */

    case OP_CLOSE:

      if (Fcurrent_recurse == RECURSE_UNSET)

      {

        number = GET2(Fecode, 1);

        offset = Flast_group_offset;

        for (;;)

        {

          /* Corrupted heapframes?. Trigger an assert and return an error */

          PCRE2_ASSERT(offset != PCRE2_UNSET);

          if (offset == PCRE2_UNSET)

            return PCRE2_ERROR_INTERNAL;

          N = (heapframe *)((char *)match_data->heapframes + offset);

          P = (heapframe *)((char *)N - frame_size);

          if (N->group_frame_type == (GF_CAPTURE | number))

            break;

          offset = P->last_group_offset;

        }

        offset = (number << 1) - 2;

        Fcapture_last = number;

        Fovector[offset] = P->eptr - mb->start_subject;

        Fovector[offset + 1] = Feptr - mb->start_subject;

        if (offset >= Foffset_top)

          Foffset_top = offset + 2;

      }

      Fecode += PRIV(OP_lengths)[*Fecode];

      break;

      /* ===================================================================== */

      /* Real or forced end of the pattern, assertion, or recursion. In an

      assertion ACCEPT, update the last used pointer and remember the current

      frame so that the captures and mark can be fished out of it. */

    case OP_ASSERT_ACCEPT:

      if (Feptr > mb->last_used_ptr)

        mb->last_used_ptr = Feptr;

      assert_accept_frame = F;

      RRETURN(MATCH_ACCEPT);

      /* For ACCEPT within a recursion, we have to find the most recent

      recursion. If not in a recursion, fall through to code that is common with

      OP_END. */

    case OP_ACCEPT:

      if (Fcurrent_recurse != RECURSE_UNSET)

      {

#ifdef DEBUG_SHOW_OPS

        fprintf(stderr, "++ Accept within recursion\n");

#endif

        offset = Flast_group_offset;

        for (;;)

        {

          /* Corrupted heapframes?. Trigger an assert and return an error */

          PCRE2_ASSERT(offset != PCRE2_UNSET);

          if (offset == PCRE2_UNSET)

            return PCRE2_ERROR_INTERNAL;

          N = (heapframe *)((char *)match_data->heapframes + offset);

          P = (heapframe *)((char *)N - frame_size);

          if (GF_IDMASK(N->group_frame_type) == GF_RECURSE)

            break;

          offset = P->last_group_offset;

        }

        /* N is now the frame of the recursion; the previous frame is at the

        OP_RECURSE position. Go back there, copying the current subject position

        and mark, and the start_match position (\K might have changed it), and

        then move on past the OP_RECURSE. */

        P->eptr = Feptr;

        P->mark = Fmark;

        P->start_match = Fstart_match;

        F = P;

        Fecode += 1 + LINK_SIZE;

        continue;

      }

      PCRE2_FALLTHROUGH /* Fall through */

      /* OP_END itself can never be reached within a recursion because that is

      picked up when the OP_KET that always precedes OP_END is reached. */

    case OP_END:

      /* Fail for an empty string match if either PCRE2_NOTEMPTY is set, or if

      PCRE2_NOTEMPTY_ATSTART is set and we have matched at the start of the

      subject. In both cases, backtracking will then try other alternatives, if

      any. */

      if (Feptr == Fstart_match && ((mb->moptions & PCRE2_NOTEMPTY) != 0 ||

                                    ((mb->moptions & PCRE2_NOTEMPTY_ATSTART) != 0 &&

                                     Fstart_match == mb->start_subject + mb->start_offset)))

      {

#ifdef DEBUG_SHOW_OPS

        fprintf(stderr, "++ Backtrack because empty string\n");

#endif

        RRETURN(MATCH_NOMATCH);

      }

      /* Fail if PCRE2_ENDANCHORED is set and the end of the match is not

      the end of the subject. After (*ACCEPT) we fail the entire match (at this

      position) but backtrack if we've reached the end of the pattern. This

      applies whether or not we are in a recursion. */

      if (Feptr < mb->end_subject && ((mb->moptions | mb->poptions) & PCRE2_ENDANCHORED) != 0)

      {

        if (Fop == OP_END)

        {

#ifdef DEBUG_SHOW_OPS

          fprintf(stderr, "++ Backtrack because not at end (endanchored set)\n");

#endif

          RRETURN(MATCH_NOMATCH);

        }

#ifdef DEBUG_SHOW_OPS

        fprintf(stderr, "++ Failed ACCEPT not at end (endanchored set)\n");

#endif

        return MATCH_NOMATCH; // (*ACCEPT)

      }

      /* Fail if we detect that the start position was moved to be either after

      the end position (\K in lookahead) or before the start offset (\K in

      lookbehind). If this occurs, the pattern must have used \K in a somewhat

      sneaky way (e.g. by pattern recursion), because if the \K is actually

      syntactically inside the lookaround, it's blocked at compile-time. */

      if (Fstart_match < mb->start_subject + mb->start_offset || Fstart_match > Feptr)