regcomp.c: Fix recursive parsing bug

In certain cases, regex compilation will use a substitute input string
when parsing what it thinks is a bracketed character class /[ ... ] /.
The substitute automatically had a ']' appended to it, even if the
original didn't have one, leading to wrong results.

I did not add a test for this, as the next commit causes current tests
to fail if this one isn't done.

diff --git a/regcomp.c b/regcomp.c
index cdf1c38..d1fb8ac 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -15731,7 +15731,12 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth,
             sv_catpv(substitute_parse, "|[");
             prefix_end = SvCUR(substitute_parse);
             sv_catpvn(substitute_parse, orig_parse, RExC_parse - orig_parse);
-            sv_catpv(substitute_parse, "]");
+
+            /* Put in a closing ']' only if not going off the end, as otherwise
+             * we are adding something that really isn't there */
+            if (RExC_parse < RExC_end) {
+                sv_catpv(substitute_parse, "]");
+            }
         }
 
         sv_catpv(substitute_parse, ")");