Fixed a couple of double frees.

Specifically, these occured when using PCRE2_COPY_MATCHED_SUBJECT and PCRE2_SUBSTITUTE_MATCHED.

(cherry picked from commit dd1a5ed)

Author: IsaacOscar

src/pcre2_substitute.c

@@ -852,6 +852,8 @@ else if (use_existing_match)
     + 2*pairs*sizeof(PCRE2_SIZE));
   internal_match_data->heapframes = NULL;
   internal_match_data->heapframes_size = 0;
+  /* Ensure that the subject is not freed when internal_match_data is */
+  internal_match_data->flags &= ~PCRE2_MD_COPIED_SUBJECT;
   match_data = internal_match_data;
   }
 

testdata/testinput2

@@ -8108,4 +8108,9 @@ a)"xI
 /x/replace=r,substitute_matched
     x\=null_subject
 
+# Test that a couple of double frees have been fixed
+/foo/replace=bar,substitute_matched
+    foo\=copy_matched_subject
+    foo\=global,copy_matched_subject
+
 # End of testinput2

testdata/testoutput2

@@ -23234,6 +23234,13 @@ Failed: error 217 at offset 27: expected capture group number or name
     x\=null_subject
 Failed: error -51: NULL argument passed with non-zero length
 
+# Test that a couple of double frees have been fixed
+/foo/replace=bar,substitute_matched
+    foo\=copy_matched_subject
+ 1: bar
+    foo\=global,copy_matched_subject
+ 1: bar
+
 # End of testinput2
 Error -80: PCRE2_ERROR_BADDATA (unknown error number)
 Error -62: bad serialized data