Store NULL in match_data->subject when subject was NULL.

Previously, match_data->subject would store a pointer to a stack
allocated string, but that pointer would be dangling as soon as
pcre2_match/pcre2_dfa_match returned. These pointers were than memcpy'd
(with a size of 0), which is technically undefined behaviour, despite
ot causing any observable problems, even with valgrind.

(cherry picked from commit d714d98)

Co-authored-by: Nicholas Wilson <[email protected]>

Author: IsaacOscar

src/pcre2_dfa_match.c

@@ -3347,6 +3347,7 @@ int was_zero_terminated = 0;
 const pcre2_real_code *re = (const pcre2_real_code *)code;
 
 PCRE2_UCHAR null_str[1] = { 0xcd };
+PCRE2_SPTR original_subject = subject;
 PCRE2_SPTR start_match;
 PCRE2_SPTR end_subject;
 PCRE2_SPTR bumpalong_limit;
@@ -4059,7 +4060,8 @@ for (;;)
       }
     else
       {
-      if (rc >= 0 || rc == PCRE2_ERROR_PARTIAL) match_data->subject = subject;
+      if (rc >= 0 || rc == PCRE2_ERROR_PARTIAL)
+        match_data->subject = original_subject;
       }
     goto EXIT;
     }

src/pcre2_match.c

@@ -6969,6 +6969,7 @@ PCRE2_UCHAR req_cu = 0;
 PCRE2_UCHAR req_cu2 = 0;
 
 PCRE2_UCHAR null_str[1] = { 0xcd };
+PCRE2_SPTR original_subject = subject;
 PCRE2_SPTR bumpalong_limit;
 PCRE2_SPTR end_subject;
 PCRE2_SPTR true_end_subject;
@@ -7184,7 +7185,6 @@ if (use_jit)
     match_data, mcontext);
   if (rc != PCRE2_ERROR_JIT_BADOPTION)
     {
-    match_data->subject_length = length;
     if (rc >= 0 && (options & PCRE2_COPY_MATCHED_SUBJECT) != 0)
       {
       length = CU2BYTES(length + was_zero_terminated);
@@ -7194,6 +7194,12 @@ if (use_jit)
       memcpy((void *)match_data->subject, subject, length);
       match_data->flags |= PCRE2_MD_COPIED_SUBJECT;
       }
+    else
+      {
+      /* When pcre2_jit_match sets the subject, it doesn't know what the
+      original passed-in pointer was. */
+      if (match_data->subject != NULL) match_data->subject = original_subject;
+      }
     return rc;
     }
   }
@@ -8148,7 +8154,7 @@ if (rc == MATCH_MATCH)
     memcpy((void *)match_data->subject, subject, length);
     match_data->flags |= PCRE2_MD_COPIED_SUBJECT;
     }
-  else match_data->subject = subject;
+  else match_data->subject = original_subject;
 
   return match_data->rc;
   }
@@ -8170,7 +8176,7 @@ PCRE2_ERROR_PARTIAL. */
 
 else if (match_partial != NULL)
   {
-  match_data->subject = subject;
+  match_data->subject = original_subject;
   match_data->subject_length = length;
   match_data->start_offset = start_offset;
   match_data->ovector[0] = match_partial - subject;

src/pcre2_substring.c

@@ -122,7 +122,7 @@ PCRE2_SIZE size;
 rc = pcre2_substring_length_bynumber(match_data, stringnumber, &size);
 if (rc < 0) return rc;
 if (size + 1 > *sizeptr) return PCRE2_ERROR_NOMEMORY;
-memcpy(buffer, match_data->subject + match_data->ovector[stringnumber*2],
+if (size != 0) memcpy(buffer, match_data->subject + match_data->ovector[stringnumber*2],
   CU2BYTES(size));
 buffer[size] = 0;
 *sizeptr = size;
@@ -214,7 +214,7 @@ yield = PRIV(memctl_malloc)(sizeof(pcre2_memctl) +
   (size + 1)*PCRE2_CODE_UNIT_WIDTH, (pcre2_memctl *)match_data);
 if (yield == NULL) return PCRE2_ERROR_NOMEMORY;
 yield = (PCRE2_UCHAR *)(((char *)yield) + sizeof(pcre2_memctl));
-memcpy(yield, match_data->subject + match_data->ovector[stringnumber*2],
+if (size != 0) memcpy(yield, match_data->subject + match_data->ovector[stringnumber*2],
   CU2BYTES(size));
 yield[size] = 0;
 *stringptr = yield;

testdata/testinput2

@@ -8113,4 +8113,8 @@ a)"xI
     foo\=copy_matched_subject
     foo\=global,copy_matched_subject
 
+# Tests for reading matches from NULL subjects
+/(.?)/
+    \=null_subject,copy=0,copy=1,get=0,get=1,getall
+
 # End of testinput2

testdata/testinput6

@@ -5251,4 +5251,8 @@
 /^(?1(2))(?(DEFINE)(a(.)b))/
    axb
 
+# Tests for reading matches from NULL subjects
+/(.?)/
+    \=null_subject,copy=0,get=0,getall
+
 # End of testinput6

testdata/testoutput2

@@ -23241,6 +23241,18 @@ Failed: error -51: NULL argument passed with non-zero length
     foo\=global,copy_matched_subject
  1: bar
 
+# Tests for reading matches from NULL subjects
+/(.?)/
+    \=null_subject,copy=0,copy=1,get=0,get=1,getall
+ 0: 
+ 1: 
+ 0C  (0)
+ 1C  (0)
+ 0G  (0)
+ 1G  (0)
+ 0L 
+ 1L 
+
 # End of testinput2
 Error -80: PCRE2_ERROR_BADDATA (unknown error number)
 Error -62: bad serialized data

testdata/testoutput6

@@ -8218,4 +8218,12 @@ No match
    axb
 Failed: error -42: pattern contains an item that is not supported for DFA matching
 
+# Tests for reading matches from NULL subjects
+/(.?)/
+    \=null_subject,copy=0,get=0,getall
+ 0: 
+ 0C  (0)
+ 0G  (0)
+ 0L 
+
 # End of testinput6