regmatch(): fix out bounds array access

The code for EXACTF and similar tests that

    UCHARAT(s) != fold_array[nextchr]

but doesn't check first that nextchr != NEXTCHR_EOS (-10), so it can
access the byte 10 bytes before the start of one of the PL_fold_latin1 or
similar arrays. Although undesirable, it's harmless, as the worst it can
achieve is a false positive match of the first char of the EXACTF string,
which will then still fail on a full compare of the string.

1 files changed, 3 insertions, 2 deletions

diff --git a/regexec.c b/regexec.c
index 0ee1c5abd4..8ee8a8f26b 100644
--- a/regexec.c
+++ b/regexec.c
@@ -4206,8 +4206,9 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char *startpos, regnode *prog)
 	    }
 
 	    /* Neither the target nor the pattern are utf8 */
-	    if (UCHARAT(s) != nextchr &&
-		UCHARAT(s) != fold_array[nextchr])
+	    if (UCHARAT(s) != nextchr
+                && !NEXTCHR_IS_EOS
+		&& UCHARAT(s) != fold_array[nextchr])
 	    {
 		sayNO;
 	    }