PATCH: GH #17371

This was caused by a character being counted as both the first delimiter
of a pattern, and the final one, which led to the pattern's length being
negative, which was turned into a very large unsigned number.

Author: khwilliamson

regcomp.c

@@ -23332,7 +23332,11 @@ Perl_parse_uniprop_string(pTHX_
 
                 if (    i >= name_len
                     ||  name[name_len-1] != close
-                    || (escaped && name[name_len-2] != '\\'))
+                    || (escaped && name[name_len-2] != '\\')
+                        /* Also make sure that there are enough characters.
+                         * e.g., '\\\' would show up incorrectly as legal even
+                         * though it is too short */
+                    || (SSize_t) (name_len - i - 1 - escaped) < 0)
                 {
                     sv_catpvs(msg, "Unicode property wildcard not terminated");
                     goto append_name_to_msg;

t/re/pat.t

@@ -24,7 +24,7 @@ BEGIN {
 
 skip_all_without_unicode_tables();
 
-plan tests => 1013;  # Update this when adding/deleting tests.
+plan tests => 1014;  # Update this when adding/deleting tests.
 
 run_tests() unless caller;
 
@@ -2087,6 +2087,9 @@ CODE
     {   # GH #17370, ASAN/valgrind out-of-bounds access
         fresh_perl_like('qr/\p{nv:qnan}/', qr/Can't find Unicode property definition/, {}, "GH #17370");
     }
+    {   # GH #17371, segfault
+        fresh_perl_like('qr/\p{nv=\\\\\}(?0)|\337ss|\337ss//', qr/Unicode property wildcard not terminated/, {}, "GH #17371");
+    }
 
   SKIP:
     {   # [perl #133921], segfault