Fix hyphen after \E after POSIX class causing an error.

ChangeLog

@@ -126,6 +126,9 @@ fully released code, but are noted here for the record.
       a lookbehind that was within another lookbehind, the calculation of the
       lookbehind length went wrong and could provoke an internal error.
       
+  (t) The sequence \E- or \Q\E- after a POSIX class in a character class caused
+      an internal error. Now the hyphen is treated as a literal.  
+
 4. Back references are now permitted in lookbehind assertions when there are
 no duplicated group numbers (that is, (?| has not been used), and, if the
 reference is by name, there is only one group of that name. The referenced

src/pcre2_compile.c

@@ -3010,6 +3010,14 @@ while (ptr < ptrend)
           goto FAILED;
           }
 
+        /* Set "a hyphen is not the start of a range" just in case the POSIX
+        class is followed by \E or \Q\E (possibly repeated - fuzzers do that
+        kind of thing) and *then* a hyphen. This causes that hyphen to be
+        treated as a literal. I don't think it's worth setting up special
+        apparatus to do otherwise. */
+
+        class_range_state = RANGE_NO;
+
         /* When PCRE2_UCP is set, some of the POSIX classes are converted to
         use Unicode properties \p or \P or, in one case, \h or \H. The
         substitutes table has two values per class, containing the type and

testdata/testinput1

@@ -5820,4 +5820,10 @@ ef) x/x,mark
 
 /(?'c')XX(?'YYYYYYYYYYYYYYYYYYYYYYYCl')/
 
+/[s[:digit:]\E-H]+/
+    s09-H
+
+/[s[:digit:]\Q\E-H]+/
+    s09-H
+
 # End of testinput1 

testdata/testoutput1

@@ -9297,4 +9297,12 @@ No match
 
 /(?'c')XX(?'YYYYYYYYYYYYYYYYYYYYYYYCl')/
 
+/[s[:digit:]\E-H]+/
+    s09-H
+ 0: s09-H
+
+/[s[:digit:]\Q\E-H]+/
+    s09-H
+ 0: s09-H
+
 # End of testinput1