/*************************************************

*      Perl-Compatible Regular Expressions       *

*************************************************/

/* PCRE is a library of functions to support regular expressions whose syntax

and semantics are as close as possible to those of the Perl 5 language.

                       Written by Philip Hazel

     Original API code Copyright (c) 1997-2012 University of Cambridge

          New API code Copyright (c) 2015-2024 University of Cambridge

-----------------------------------------------------------------------------

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright notice,

      this list of conditions and the following disclaimer.

    * Redistributions in binary form must reproduce the above copyright

      notice, this list of conditions and the following disclaimer in the

      documentation and/or other materials provided with the distribution.

    * Neither the name of the University of Cambridge nor the names of its

      contributors may be used to endorse or promote products derived from

      this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

-----------------------------------------------------------------------------

*/

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#include "pcre2_internal.h"

/* These defines enable debugging code */

/* #define DEBUG_FRAMES_DISPLAY */

/* #define DEBUG_SHOW_OPS */

/* #define DEBUG_SHOW_RMATCH */

#ifdef DEBUG_FRAMES_DISPLAY

#include <stdarg.h>

#endif

#ifdef DEBUG_SHOW_OPS

static const char *OP_names[] = { OP_NAME_LIST };

#endif

/* These defines identify the name of the block containing "static"

information, and fields within it. */

#define NLBLOCK mb              /* Block containing newline information */

#define PSSTART start_subject   /* Field containing processed string start */

#define PSEND   end_subject     /* Field containing processed string end */

#define RECURSE_UNSET 0xffffffffu  /* Bigger than max group number */

/* Masks for identifying the public options that are permitted at match time. */

#define PUBLIC_MATCH_OPTIONS \

  (PCRE2_ANCHORED|PCRE2_ENDANCHORED|PCRE2_NOTBOL|PCRE2_NOTEOL|PCRE2_NOTEMPTY| \

   PCRE2_NOTEMPTY_ATSTART|PCRE2_NO_UTF_CHECK|PCRE2_PARTIAL_HARD| \

   PCRE2_PARTIAL_SOFT|PCRE2_NO_JIT|PCRE2_COPY_MATCHED_SUBJECT| \

   PCRE2_DISABLE_RECURSELOOP_CHECK)

#define PUBLIC_JIT_MATCH_OPTIONS \

   (PCRE2_NO_UTF_CHECK|PCRE2_NOTBOL|PCRE2_NOTEOL|PCRE2_NOTEMPTY|\

    PCRE2_NOTEMPTY_ATSTART|PCRE2_PARTIAL_SOFT|PCRE2_PARTIAL_HARD|\

    PCRE2_COPY_MATCHED_SUBJECT)

/* Non-error returns from and within the match() function. Error returns are

externally defined PCRE2_ERROR_xxx codes, which are all negative. */

#define MATCH_MATCH        1

#define MATCH_NOMATCH      0

/* Special internal returns used in the match() function. Make them

sufficiently negative to avoid the external error codes. */

#define MATCH_ACCEPT       (-999)

#define MATCH_KETRPOS      (-998)

/* The next 5 must be kept together and in sequence so that a test that checks

for any one of them can use a range. */

#define MATCH_COMMIT       (-997)

#define MATCH_PRUNE        (-996)

#define MATCH_SKIP         (-995)

#define MATCH_SKIP_ARG     (-994)

#define MATCH_THEN         (-993)

#define MATCH_BACKTRACK_MAX MATCH_THEN

#define MATCH_BACKTRACK_MIN MATCH_COMMIT

/* Group frame type values. Zero means the frame is not a group frame. The

lower 16 bits are used for data (e.g. the capture number). Group frames are

used for most groups so that information about the start is easily available at

the end without having to scan back through intermediate frames (backtrack

points). */

#define GF_CAPTURE     0x00010000u

#define GF_NOCAPTURE   0x00020000u

#define GF_CONDASSERT  0x00030000u

#define GF_RECURSE     0x00040000u

/* Masks for the identity and data parts of the group frame type. */

#define GF_IDMASK(a)   ((a) & 0xffff0000u)

#define GF_DATAMASK(a) ((a) & 0x0000ffffu)

/* Repetition types */

enum { REPTYPE_MIN, REPTYPE_MAX, REPTYPE_POS };

/* Min and max values for the common repeats; a maximum of UINT32_MAX =>

infinity. */

static const uint32_t rep_min[] = {

  0, 0,       /* * and *? */

  1, 1,       /* + and +? */

  0, 0,       /* ? and ?? */

  0, 0,       /* dummy placefillers for OP_CR[MIN]RANGE */

  0, 1, 0 };  /* OP_CRPOS{STAR, PLUS, QUERY} */

static const uint32_t rep_max[] = {

  UINT32_MAX, UINT32_MAX,      /* * and *? */

  UINT32_MAX, UINT32_MAX,      /* + and +? */

  1, 1,                        /* ? and ?? */

  0, 0,                        /* dummy placefillers for OP_CR[MIN]RANGE */

  UINT32_MAX, UINT32_MAX, 1 }; /* OP_CRPOS{STAR, PLUS, QUERY} */

/* Repetition types - must include OP_CRPOSRANGE (not needed above) */

static const uint32_t rep_typ[] = {

  REPTYPE_MAX, REPTYPE_MIN,    /* * and *? */

  REPTYPE_MAX, REPTYPE_MIN,    /* + and +? */

  REPTYPE_MAX, REPTYPE_MIN,    /* ? and ?? */

  REPTYPE_MAX, REPTYPE_MIN,    /* OP_CRRANGE and OP_CRMINRANGE */

  REPTYPE_POS, REPTYPE_POS,    /* OP_CRPOSSTAR, OP_CRPOSPLUS */

  REPTYPE_POS, REPTYPE_POS };  /* OP_CRPOSQUERY, OP_CRPOSRANGE */

/* Numbers for RMATCH calls at backtracking points. When these lists are

changed, the code at RETURN_SWITCH below must be updated in sync.  */

enum { RM1=1, RM2,  RM3,  RM4,  RM5,  RM6,  RM7,  RM8,  RM9,  RM10,

       RM11,  RM12, RM13, RM14, RM15, RM16, RM17, RM18, RM19, RM20,

       RM21,  RM22, RM23, RM24, RM25, RM26, RM27, RM28, RM29, RM30,

       RM31,  RM32, RM33, RM34, RM35, RM36, RM37 };

#ifdef SUPPORT_WIDE_CHARS

enum { RM100=100, RM101 };

#endif

#ifdef SUPPORT_UNICODE

enum { RM200=200, RM201, RM202, RM203, RM204, RM205, RM206, RM207,

       RM208,     RM209, RM210, RM211, RM212, RM213, RM214, RM215,

       RM216,     RM217, RM218, RM219, RM220, RM221, RM222, RM223,

       RM224,     RM225 };

#endif

/* Define short names for general fields in the current backtrack frame, which

is always pointed to by the F variable. Occasional references to fields in

other frames are written out explicitly. There are also some fields in the

current frame whose names start with "temp" that are used for short-term,

localised backtracking memory. These are #defined with Lxxx names at the point

of use and undefined afterwards. */

#define Fback_frame        F->back_frame

#define Fcapture_last      F->capture_last

#define Fcurrent_recurse   F->current_recurse

#define Fecode             F->ecode

#define Feptr              F->eptr

#define Fgroup_frame_type  F->group_frame_type

#define Flast_group_offset F->last_group_offset

#define Flength            F->length

#define Fmark              F->mark

#define Frdepth            F->rdepth

#define Fstart_match       F->start_match

#define Foffset_top        F->offset_top

#define Foccu              F->occu

#define Fop                F->op

#define Fovector           F->ovector

#define Freturn_id         F->return_id

#ifdef DEBUG_FRAMES_DISPLAY

/*************************************************

*      Display current frames and contents       *

*************************************************/

/* This debugging function displays the current set of frames and their

contents. It is not called automatically from anywhere, the intention being

that calls can be inserted where necessary when debugging frame-related

problems.

Arguments:

  f           the file to write to

  F           the current top frame

  P           a previous frame of interest

  frame_size  the frame size

  mb          points to the match block

  match_data  points to the match data block

  s           identification text

Returns:    nothing

*/

static void

display_frames(FILE *f, heapframe *F, heapframe *P, PCRE2_SIZE frame_size,

  match_block *mb, pcre2_match_data *match_data, const char *s, ...)

{

uint32_t i;

heapframe *Q;

va_list ap;

va_start(ap, s);

fprintf(f, "FRAMES ");

vfprintf(f, s, ap);

va_end(ap);

if (P != NULL) fprintf(f, " P=%lu",

  ((char *)P - (char *)(match_data->heapframes))/frame_size);

fprintf(f, "\n");

for (i = 0, Q = match_data->heapframes;

     Q <= F;

     i++, Q = (heapframe *)((char *)Q + frame_size))

  {

  fprintf(f, "Frame %d type=%x subj=%lu code=%d back=%lu id=%d",

    i, Q->group_frame_type, Q->eptr - mb->start_subject, *(Q->ecode),

    Q->back_frame, Q->return_id);

  if (Q->last_group_offset == PCRE2_UNSET)

    fprintf(f, " lgoffset=unset\n");

  else

    fprintf(f, " lgoffset=%lu\n",  Q->last_group_offset/frame_size);

  }

}

#endif

/*************************************************

*                Process a callout               *

*************************************************/

/* This function is called for all callouts, whether "standalone" or at the

start of a conditional group. Feptr will be pointing to either OP_CALLOUT or

OP_CALLOUT_STR. A callout block is allocated in pcre2_match() and initialized

with fixed values.

Arguments:

  F          points to the current backtracking frame

  mb         points to the match block

  lengthptr  where to return the length of the callout item

Returns:     the return from the callout

             or 0 if no callout function exists

*/

static int

do_callout(heapframe *F, match_block *mb, PCRE2_SIZE *lengthptr)

{

int rc;

PCRE2_SIZE save0, save1;

PCRE2_SIZE *callout_ovector;

pcre2_callout_block *cb;

*lengthptr = (*Fecode == OP_CALLOUT)?

  PRIV(OP_lengths)[OP_CALLOUT] : GET(Fecode, 1 + 2*LINK_SIZE);

if (mb->callout == NULL) return 0;   /* No callout function provided */

/* The original matching code (pre 10.30) worked directly with the ovector

passed by the user, and this was passed to callouts. Now that the working

ovector is in the backtracking frame, it no longer needs to reserve space for

the overall match offsets (which would waste space in the frame). For backward

compatibility, however, we pass capture_top and offset_vector to the callout as

if for the extended ovector, and we ensure that the first two slots are unset

by preserving and restoring their current contents. Picky compilers complain if

references such as Fovector[-2] are use directly, so we set up a separate

pointer. */

callout_ovector = (PCRE2_SIZE *)(Fovector) - 2;

/* The cb->version, cb->subject, cb->subject_length, and cb->start_match fields

are set externally. The first 3 never change; the last is updated for each

bumpalong. */

cb = mb->cb;

cb->capture_top      = (uint32_t)Foffset_top/2 + 1;

cb->capture_last     = Fcapture_last;

cb->offset_vector    = callout_ovector;

cb->mark             = mb->nomatch_mark;

cb->current_position = (PCRE2_SIZE)(Feptr - mb->start_subject);

cb->pattern_position = GET(Fecode, 1);

cb->next_item_length = GET(Fecode, 1 + LINK_SIZE);

if (*Fecode == OP_CALLOUT)  /* Numerical callout */

  {

  cb->callout_number = Fecode[1 + 2*LINK_SIZE];

  cb->callout_string_offset = 0;

  cb->callout_string = NULL;

  cb->callout_string_length = 0;

  }

else  /* String callout */

  {

  cb->callout_number = 0;

  cb->callout_string_offset = GET(Fecode, 1 + 3*LINK_SIZE);

  cb->callout_string = Fecode + (1 + 4*LINK_SIZE) + 1;

  cb->callout_string_length =

    *lengthptr - (1 + 4*LINK_SIZE) - 2;

  }

save0 = callout_ovector[0];

save1 = callout_ovector[1];

callout_ovector[0] = callout_ovector[1] = PCRE2_UNSET;

rc = mb->callout(cb, mb->callout_data);

callout_ovector[0] = save0;

callout_ovector[1] = save1;

cb->callout_flags = 0;

return rc;

}

/*************************************************

*          Match a back-reference                *

*************************************************/

/* This function is called only when it is known that the offset lies within

the offsets that have so far been used in the match. Note that in caseless

UTF-8 mode, the number of subject bytes matched may be different to the number

of reference bytes. (In theory this could also happen in UTF-16 mode, but it

seems unlikely.)

Arguments:

  offset      index into the offset vector

  caseless    TRUE if caseless

  F           the current backtracking frame pointer

  mb          points to match block

  lengthptr   pointer for returning the length matched

Returns:      = 0 sucessful match; number of code units matched is set

              < 0 no match

              > 0 partial match

*/

static int

match_ref(PCRE2_SIZE offset, BOOL caseless, heapframe *F, match_block *mb,

  PCRE2_SIZE *lengthptr)

{

PCRE2_SPTR p;

PCRE2_SIZE length;

PCRE2_SPTR eptr;

PCRE2_SPTR eptr_start;

/* Deal with an unset group. The default is no match, but there is an option to

match an empty string. */

if (offset >= Foffset_top || Fovector[offset] == PCRE2_UNSET)

  {

  if ((mb->poptions & PCRE2_MATCH_UNSET_BACKREF) != 0)

    {

    *lengthptr = 0;

    return 0;      /* Match */

    }

  else return -1;  /* No match */

  }

/* Separate the caseless and UTF cases for speed. */

eptr = eptr_start = Feptr;

p = mb->start_subject + Fovector[offset];

length = Fovector[offset+1] - Fovector[offset];

if (caseless)

  {

#if defined SUPPORT_UNICODE

  BOOL utf = (mb->poptions & PCRE2_UTF) != 0;

  if (utf || (mb->poptions & PCRE2_UCP) != 0)

    {

    PCRE2_SPTR endptr = p + length;

    /* Match characters up to the end of the reference. NOTE: the number of

    code units matched may differ, because in UTF-8 there are some characters

    whose upper and lower case codes have different numbers of bytes. For

    example, U+023A (2 bytes in UTF-8) is the upper case version of U+2C65 (3

    bytes in UTF-8); a sequence of 3 of the former uses 6 bytes, as does a

    sequence of two of the latter. It is important, therefore, to check the

    length along the reference, not along the subject (earlier code did this

    wrong). UCP without uses Unicode properties but without UTF encoding. */

    while (p < endptr)

      {

      uint32_t c, d;

      const ucd_record *ur;

      if (eptr >= mb->end_subject) return 1;   /* Partial match */

      if (utf)

        {

        GETCHARINC(c, eptr);

        GETCHARINC(d, p);

        }

      else

        {

        c = *eptr++;

        d = *p++;

        }

      ur = GET_UCD(d);

      if (c != d && c != (uint32_t)((int)d + ur->other_case))

        {

        const uint32_t *pp = PRIV(ucd_caseless_sets) + ur->caseset;

        for (;;)

          {

          if (c < *pp) return -1;  /* No match */

          if (c == *pp++) break;

          }

        }

      }

    }

  else

#endif

  /* Not in UTF or UCP mode */

    {

    for (; length > 0; length--)

      {

      uint32_t cc, cp;

      if (eptr >= mb->end_subject) return 1;   /* Partial match */

      cc = UCHAR21TEST(eptr);

      cp = UCHAR21TEST(p);

      if (TABLE_GET(cp, mb->lcc, cp) != TABLE_GET(cc, mb->lcc, cc))

        return -1;  /* No match */

      p++;

      eptr++;

      }

    }

  }

/* In the caseful case, we can just compare the code units, whether or not we

are in UTF and/or UCP mode. When partial matching, we have to do this unit by

unit. */

else

  {

  if (mb->partial != 0)

    {

    for (; length > 0; length--)

      {

      if (eptr >= mb->end_subject) return 1;   /* Partial match */

      if (UCHAR21INCTEST(p) != UCHAR21INCTEST(eptr)) return -1;  /* No match */

      }

    }

  /* Not partial matching */

  else

    {

    if ((PCRE2_SIZE)(mb->end_subject - eptr) < length) return 1; /* Partial */

    if (memcmp(p, eptr, CU2BYTES(length)) != 0) return -1;  /* No match */

    eptr += length;

    }

  }

*lengthptr = eptr - eptr_start;

return 0;  /* Match */

}

/******************************************************************************

*******************************************************************************

                   "Recursion" in the match() function

The original match() function was highly recursive, but this proved to be the

source of a number of problems over the years, mostly because of the relatively

small system stacks that are commonly found. As new features were added to

patterns, various kludges were invented to reduce the amount of stack used,

making the code hard to understand in places.

A version did exist that used individual frames on the heap instead of calling

match() recursively, but this ran substantially slower. The current version is

a refactoring that uses a vector of frames to remember backtracking points.

This runs no slower, and possibly even a bit faster than the original recursive

implementation.

At first, an initial vector of size START_FRAMES_SIZE (enough for maybe 50

frames) was allocated on the system stack. If this was not big enough, the heap

was used for a larger vector. However, it turns out that there are environments

where taking as little as 20KiB from the system stack is an embarrassment.

After another refactoring, the heap is used exclusively, but a pointer the

frames vector and its size are cached in the match_data block, so that there is

no new memory allocation if the same match_data block is used for multiple

matches (unless the frames vector has to be extended).

*******************************************************************************

******************************************************************************/

/*************************************************

*       Macros for the match() function          *

*************************************************/

/* These macros pack up tests that are used for partial matching several times

in the code. The second one is used when we already know we are past the end of

the subject. We set the "hit end" flag if the pointer is at the end of the

subject and either (a) the pointer is past the earliest inspected character

(i.e. something has been matched, even if not part of the actual matched

string), or (b) the pattern contains a lookbehind. These are the conditions for

which adding more characters may allow the current match to continue.

For hard partial matching, we immediately return a partial match. Otherwise,

carrying on means that a complete match on the current subject will be sought.

A partial match is returned only if no complete match can be found. */

#define CHECK_PARTIAL()\

  if (Feptr >= mb->end_subject) \

    { \

    SCHECK_PARTIAL(); \

    }

#define SCHECK_PARTIAL()\

  if (mb->partial != 0 && \

      (Feptr > mb->start_used_ptr || mb->allowemptypartial)) \

    { \

    mb->hitend = TRUE; \

    if (mb->partial > 1) return PCRE2_ERROR_PARTIAL; \

    }

/* These macros are used to implement backtracking. They simulate a recursive

call to the match() function by means of a local vector of frames which

remember the backtracking points. */

#define RMATCH(ra,rb)\

  {\

  start_ecode = ra;\

  Freturn_id = rb;\

  goto MATCH_RECURSE;\

  L_##rb:;\

  }

#define RRETURN(ra)\

  {\

  rrc = ra;\

  goto RETURN_SWITCH;\

  }

/*************************************************

*         Match from current position            *

*************************************************/

/* This function is called to run one match attempt at a single starting point

in the subject.

Performance note: It might be tempting to extract commonly used fields from the

mb structure (e.g. end_subject) into individual variables to improve

performance. Tests using gcc on a SPARC disproved this; in the first case, it

made performance worse.

Arguments:

   start_eptr   starting character in subject

   start_ecode  starting position in compiled code

   top_bracket  number of capturing parentheses in the pattern

   frame_size   size of each backtracking frame

   match_data   pointer to the match_data block

   mb           pointer to "static" variables block

Returns:        MATCH_MATCH if matched            )  these values are >= 0

                MATCH_NOMATCH if failed to match  )

                negative MATCH_xxx value for PRUNE, SKIP, etc

                negative PCRE2_ERROR_xxx value if aborted by an error condition

                (e.g. stopped by repeated call or depth limit)

*/

static int

match(PCRE2_SPTR start_eptr, PCRE2_SPTR start_ecode, uint16_t top_bracket,

  PCRE2_SIZE frame_size, pcre2_match_data *match_data, match_block *mb)

{

/* Frame-handling variables */

heapframe *F;           /* Current frame pointer */

heapframe *N = NULL;    /* Temporary frame pointers */

heapframe *P = NULL;

heapframe *frames_top;  /* End of frames vector */

heapframe *assert_accept_frame = NULL;  /* For passing back a frame with captures */

PCRE2_SIZE frame_copy_size;   /* Amount to copy when creating a new frame */

/* Local variables that do not need to be preserved over calls to RRMATCH(). */

PCRE2_SPTR branch_end = NULL;

PCRE2_SPTR branch_start;

PCRE2_SPTR bracode;     /* Temp pointer to start of group */

PCRE2_SIZE offset;      /* Used for group offsets */

PCRE2_SIZE length;      /* Used for various length calculations */

int rrc;                /* Return from functions & backtracking "recursions" */

#ifdef SUPPORT_UNICODE

int proptype;           /* Type of character property */

#endif

uint32_t i;             /* Used for local loops */

uint32_t fc;            /* Character values */

uint32_t number;        /* Used for group and other numbers */

uint32_t reptype = 0;   /* Type of repetition (0 to avoid compiler warning) */

uint32_t group_frame_type;  /* Specifies type for new group frames */

BOOL condition;         /* Used in conditional groups */

BOOL cur_is_word;       /* Used in "word" tests */

BOOL prev_is_word;      /* Used in "word" tests */

/* UTF and UCP flags */

#ifdef SUPPORT_UNICODE

BOOL utf = (mb->poptions & PCRE2_UTF) != 0;

BOOL ucp = (mb->poptions & PCRE2_UCP) != 0;

#else

BOOL utf = FALSE;  /* Required for convenience even when no Unicode support */

#endif

/* This is the length of the last part of a backtracking frame that must be

copied when a new frame is created. */

frame_copy_size = frame_size - offsetof(heapframe, eptr);

/* Set up the first frame and the end of the frames vector. */

F = match_data->heapframes;

frames_top = (heapframe *)((char *)F + match_data->heapframes_size);

Frdepth = 0;                        /* "Recursion" depth */

Fcapture_last = 0;                  /* Number of most recent capture */

Fcurrent_recurse = RECURSE_UNSET;   /* Not pattern recursing. */

Fstart_match = Feptr = start_eptr;  /* Current data pointer and start match */

Fmark = NULL;                       /* Most recent mark */

Foffset_top = 0;                    /* End of captures within the frame */

Flast_group_offset = PCRE2_UNSET;   /* Saved frame of most recent group */

group_frame_type = 0;               /* Not a start of group frame */

goto NEW_FRAME;                     /* Start processing with this frame */

/* Come back here when we want to create a new frame for remembering a

backtracking point. */

MATCH_RECURSE:

/* Set up a new backtracking frame. If the vector is full, get a new one,

doubling the size, but constrained by the heap limit (which is in KiB). */

N = (heapframe *)((char *)F + frame_size);

if ((heapframe *)((char *)N + frame_size) >= frames_top)

  {

  heapframe *new;

  PCRE2_SIZE newsize;

  PCRE2_SIZE usedsize = (char *)N - (char *)(match_data->heapframes);

  if (match_data->heapframes_size >= PCRE2_SIZE_MAX / 2)

    {

    if (match_data->heapframes_size == PCRE2_SIZE_MAX - 1)

      return PCRE2_ERROR_NOMEMORY;

    newsize = PCRE2_SIZE_MAX - 1;

    }

  else

    newsize = match_data->heapframes_size * 2;

  if (newsize / 1024 >= mb->heap_limit)

    {

    PCRE2_SIZE old_size = match_data->heapframes_size / 1024;

    if (mb->heap_limit <= old_size)

      return PCRE2_ERROR_HEAPLIMIT;

    else

      {

      PCRE2_SIZE max_delta = 1024 * (mb->heap_limit - old_size);

      int over_bytes = match_data->heapframes_size % 1024;

      if (over_bytes) max_delta -= (1024 - over_bytes);

      newsize = match_data->heapframes_size + max_delta;

      }

    }

  /* With a heap limit set, the permitted additional size may not be enough for

  another frame, so do a final check. */

  if (newsize - usedsize < frame_size) return PCRE2_ERROR_HEAPLIMIT;

  new = match_data->memctl.malloc(newsize, match_data->memctl.memory_data);

  if (new == NULL) return PCRE2_ERROR_NOMEMORY;

  memcpy(new, match_data->heapframes, usedsize);

  N = (heapframe *)((char *)new + usedsize);

  F = (heapframe *)((char *)N - frame_size);

  match_data->memctl.free(match_data->heapframes, match_data->memctl.memory_data);

  match_data->heapframes = new;

  match_data->heapframes_size = newsize;

  frames_top = (heapframe *)((char *)new + newsize);

  }

#ifdef DEBUG_SHOW_RMATCH

fprintf(stderr, "++ RMATCH %d frame=%d", Freturn_id, Frdepth + 1);

if (group_frame_type != 0)

  {

  fprintf(stderr, " type=%x ", group_frame_type);

  switch (GF_IDMASK(group_frame_type))

    {

    case GF_CAPTURE:

    fprintf(stderr, "capture=%d", GF_DATAMASK(group_frame_type));

    break;

    case GF_NOCAPTURE:

    fprintf(stderr, "nocapture op=%d", GF_DATAMASK(group_frame_type));

    break;

    case GF_CONDASSERT:

    fprintf(stderr, "condassert op=%d", GF_DATAMASK(group_frame_type));

    break;

    case GF_RECURSE:

    fprintf(stderr, "recurse=%d", GF_DATAMASK(group_frame_type));

    break;

    default:

    fprintf(stderr, "*** unknown ***");

    break;

    }

  }

fprintf(stderr, "\n");

#endif

/* Copy those fields that must be copied into the new frame, increase the

"recursion" depth (i.e. the new frame's index) and then make the new frame

current. */

memcpy((char *)N + offsetof(heapframe, eptr),

       (char *)F + offsetof(heapframe, eptr),

       frame_copy_size);

N->rdepth = Frdepth + 1;

F = N;

/* Carry on processing with a new frame. */

NEW_FRAME:

Fgroup_frame_type = group_frame_type;

Fecode = start_ecode;      /* Starting code pointer */

Fback_frame = frame_size;  /* Default is go back one frame */

/* If this is a special type of group frame, remember its offset for quick

access at the end of the group. If this is a recursion, set a new current

recursion value. */

if (group_frame_type != 0)

  {

  Flast_group_offset = (char *)F - (char *)match_data->heapframes;

  if (GF_IDMASK(group_frame_type) == GF_RECURSE)

    Fcurrent_recurse = GF_DATAMASK(group_frame_type);

  group_frame_type = 0;

  }

/* ========================================================================= */

/* This is the main processing loop. First check that we haven't recorded too

many backtracks (search tree is too large), or that we haven't exceeded the

recursive depth limit (used too many backtracking frames). If not, process the

opcodes. */

if (mb->match_call_count++ >= mb->match_limit) return PCRE2_ERROR_MATCHLIMIT;

if (Frdepth >= mb->match_limit_depth) return PCRE2_ERROR_DEPTHLIMIT;

#ifdef DEBUG_SHOW_OPS

fprintf(stderr, "\n++ New frame: type=0x%x subject offset %ld\n",

  GF_IDMASK(Fgroup_frame_type), Feptr - mb->start_subject);

#endif

for (;;)

  {

#ifdef DEBUG_SHOW_OPS

fprintf(stderr, "++ %2ld op=%3d %s\n", Fecode - mb->start_code, *Fecode,

  OP_names[*Fecode]);

#endif

  Fop = (uint8_t)(*Fecode);  /* Cast needed for 16-bit and 32-bit modes */

  switch(Fop)

    {

    /* ===================================================================== */

    /* Before OP_ACCEPT there may be any number of OP_CLOSE opcodes, to close

    any currently open capturing brackets. Unlike reaching the end of a group,

    where we know the starting frame is at the top of the chained frames, in

    this case we have to search back for the relevant frame in case other types

    of group that use chained frames have intervened. Multiple OP_CLOSEs always

    come innermost first, which matches the chain order. We can ignore this in

    a recursion, because captures are not passed out of recursions. */

    case OP_CLOSE:

    if (Fcurrent_recurse == RECURSE_UNSET)

      {

      number = GET2(Fecode, 1);

      offset = Flast_group_offset;

      for(;;)

        {

        if (offset == PCRE2_UNSET) return PCRE2_ERROR_INTERNAL;

        N = (heapframe *)((char *)match_data->heapframes + offset);

        P = (heapframe *)((char *)N - frame_size);

        if (N->group_frame_type == (GF_CAPTURE | number)) break;

        offset = P->last_group_offset;

        }

      offset = (number << 1) - 2;

      Fcapture_last = number;

      Fovector[offset] = P->eptr - mb->start_subject;

      Fovector[offset+1] = Feptr - mb->start_subject;

      if (offset >= Foffset_top) Foffset_top = offset + 2;

      }

    Fecode += PRIV(OP_lengths)[*Fecode];

    break;

    /* ===================================================================== */

    /* Real or forced end of the pattern, assertion, or recursion. In an

    assertion ACCEPT, update the last used pointer and remember the current

    frame so that the captures and mark can be fished out of it. */

    case OP_ASSERT_ACCEPT:

    if (Feptr > mb->last_used_ptr) mb->last_used_ptr = Feptr;

    assert_accept_frame = F;

    RRETURN(MATCH_ACCEPT);

    /* For ACCEPT within a recursion, we have to find the most recent

    recursion. If not in a recursion, fall through to code that is common with

    OP_END. */

    case OP_ACCEPT:

    if (Fcurrent_recurse != RECURSE_UNSET)

      {

#ifdef DEBUG_SHOW_OPS

      fprintf(stderr, "++ Accept within recursion\n");

#endif

      offset = Flast_group_offset;

      for(;;)

        {

        if (offset == PCRE2_UNSET) return PCRE2_ERROR_INTERNAL;

        N = (heapframe *)((char *)match_data->heapframes + offset);

        P = (heapframe *)((char *)N - frame_size);

        if (GF_IDMASK(N->group_frame_type) == GF_RECURSE) break;

        offset = P->last_group_offset;

        }

      /* N is now the frame of the recursion; the previous frame is at the

      OP_RECURSE position. Go back there, copying the current subject position

      and mark, and the start_match position (\K might have changed it), and

      then move on past the OP_RECURSE. */

      P->eptr = Feptr;

      P->mark = Fmark;

      P->start_match = Fstart_match;

      F = P;

      Fecode += 1 + LINK_SIZE;

      continue;

      }

    /* Fall through */

    /* OP_END itself can never be reached within a recursion because that is

    picked up when the OP_KET that always precedes OP_END is reached. */

    case OP_END:

    /* Fail for an empty string match if either PCRE2_NOTEMPTY is set, or if

    PCRE2_NOTEMPTY_ATSTART is set and we have matched at the start of the

    subject. In both cases, backtracking will then try other alternatives, if

    any. */

    if (Feptr == Fstart_match &&

         ((mb->moptions & PCRE2_NOTEMPTY) != 0 ||

           ((mb->moptions & PCRE2_NOTEMPTY_ATSTART) != 0 &&

             Fstart_match == mb->start_subject + mb->start_offset)))

      {

#ifdef DEBUG_SHOW_OPS

      fprintf(stderr, "++ Backtrack because empty string\n");

#endif

      RRETURN(MATCH_NOMATCH);

      }

    /* Fail if PCRE2_ENDANCHORED is set and the end of the match is not

    the end of the subject. After (*ACCEPT) we fail the entire match (at this

    position) but backtrack if we've reached the end of the pattern. This

    applies whether or not we are in a recursion. */

    if (Feptr < mb->end_subject &&

        ((mb->moptions | mb->poptions) & PCRE2_ENDANCHORED) != 0)

      {

      if (Fop == OP_END)

        {

#ifdef DEBUG_SHOW_OPS

        fprintf(stderr, "++ Backtrack because not at end (endanchored set)\n");

#endif

        RRETURN(MATCH_NOMATCH);

        }

#ifdef DEBUG_SHOW_OPS

      fprintf(stderr, "++ Failed ACCEPT not at end (endanchnored set)\n");

#endif

      return MATCH_NOMATCH;   /* (*ACCEPT) */

      }

    /* We have a successful match of the whole pattern. Record the result and

    then do a direct return from the function. If there is space in the offset

    vector, set any pairs that follow the highest-numbered captured string but

    are less than the number of capturing groups in the pattern to PCRE2_UNSET.

    It is documented that this happens. "Gaps" are set to PCRE2_UNSET

    dynamically. It is only those at the end that need setting here. */

    mb->end_match_ptr = Feptr;           /* Record where we ended */

    mb->end_offset_top = Foffset_top;    /* and how many extracts were taken */

    mb->mark = Fmark;                    /* and the last success mark */

    if (Feptr > mb->last_used_ptr) mb->last_used_ptr = Feptr;

    match_data->ovector[0] = Fstart_match - mb->start_subject;

    match_data->ovector[1] = Feptr - mb->start_subject;

    /* Set i to the smaller of the sizes of the external and frame ovectors. */

    i = 2 * ((top_bracket + 1 > match_data->oveccount)?

      match_data->oveccount : top_bracket + 1);

    memcpy(match_data->ovector + 2, Fovector, (i - 2) * sizeof(PCRE2_SIZE));

    while (--i >= Foffset_top + 2) match_data->ovector[i] = PCRE2_UNSET;

    return MATCH_MATCH;  /* Note: NOT RRETURN */

    /*===================================================================== */

    /* Match any single character type except newline; have to take care with

    CRLF newlines and partial matching. */

    case OP_ANY:

    if (IS_NEWLINE(Feptr)) RRETURN(MATCH_NOMATCH);

    if (mb->partial != 0 &&

        Feptr == mb->end_subject - 1 &&

        NLBLOCK->nltype == NLTYPE_FIXED &&

        NLBLOCK->nllen == 2 &&

        UCHAR21TEST(Feptr) == NLBLOCK->nl[0])

      {

      mb->hitend = TRUE;