Avoid the need for an integer overflow check in pcre2_substitute() by adding a

check for a number greater than the largest capturing group.

ChangeLog

@@ -236,6 +236,10 @@ string was zero-terminated.
 68. In pcre2_substitute() in UTF mode, PCRE2_NO_UTF_CHECK can be set for the 
 second and subsequent calls to pcre2_match().
 
+69. There was no check for integer overflow for a replacement group number in 
+pcre2_substitute(). An added check for a number greater than the largest group 
+number in the pattern means this is not now needed.
+
 
 Version 10.20 30-June-2015
 --------------------------

src/pcre2_substitute.c

@@ -409,6 +409,15 @@ do
           next = *ptr;
           if (next < CHAR_0 || next > CHAR_9) break;
           group = group * 10 + next - CHAR_0;
+          
+          /* A check for a number greater than the hightest captured group
+          is sufficient here; no need for a separate overflow check. */
+            
+          if (group > code->top_bracket)
+            {
+            rc = PCRE2_ERROR_NOSUBSTRING;
+            goto PTREXIT;   
+            }
           }
         }
       else

testdata/testinput2

@@ -4587,4 +4587,7 @@ B)x/alt_verbnames,mark
 
 /((p(?'K/no_auto_capture
 
+/abc/replace=A$3123456789Z
+    abc
+
 # End of testinput2 

testdata/testoutput2

@@ -14674,4 +14674,8 @@ Failed: error 142 at offset 7: syntax error in subpattern name (missing terminat
 /((p(?'K/no_auto_capture
 Failed: error 142 at offset 7: syntax error in subpattern name (missing terminator)
 
+/abc/replace=A$3123456789Z
+    abc
+Failed: error -49 at offset 3 in replacement: unknown substring
+
 # End of testinput2