regcomp.c: Fix a panic

I haven't figured out a way to get this to panic with existing code
(hence no tests), but chanes I'm working on triggered it.

An inversion list has elements that indicate a range that matches code
points in the list; and elements for ranges that do not match code
points in the list.  This code was assuming that the final range in the
inversion list was in the list; it might not be, and so an extra test is
needed.

diff --git a/regcomp.c b/regcomp.c
index f50bd90..14c141d 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -7903,10 +7903,11 @@ Perl__add_range_to_invlist(pTHX_ SV* invlist, const UV start, const UV end)
        len = _invlist_len(invlist);
     }
 
-    /* If comes after the final entry, can just append it to the end */
+    /* If comes after the final entry actually in the list, can just append it
+     * to the end, */
     if (len == 0
-       || start >= invlist_array(invlist)
-                                   [len - 1])
+       || (! ELEMENT_RANGE_MATCHES_INVLIST(len - 1)
+            && start >= invlist_array(invlist)[len - 1]))
     {
        _append_range_to_invlist(invlist, start, end);
        return invlist;