Bad max lookbehind length was calculated when a back reference contained a

recursion.

ChangeLog

@@ -252,6 +252,9 @@ beyond the end of the replacement string.
 lookbehind involved an out-of-bounds pointer, which could potentially cause 
 trouble in some environments.
 
+73. The maximum lookbehind length was incorrectly calculated for patterns such
+as /(?<=(a)(?-1))x/ which have a recursion within a backreference.
+
 
 Version 10.20 30-June-2015
 --------------------------

src/pcre2_compile.c

@@ -8378,7 +8378,7 @@ re->first_codeunit = 0;
 re->last_codeunit = 0;
 re->bsr_convention = bsr;
 re->newline_convention = newline;
-re->max_lookbehind =
+re->max_lookbehind = 0;
 re->minlength = 0;
 re->top_bracket = 0;
 re->top_backref = 0;
@@ -8587,6 +8587,13 @@ if (errorcode == 0 && cb.check_lookbehind)
       }
     cc += 1 + LINK_SIZE;
     }
+
+  /* The previous value of the maximum lookbehind was transferred to the
+  compiled regex block above. We could have updated this value in the loop
+  above, but keep the two values in step, just in case some later code below
+  uses the cb value. */
+
+  re->max_lookbehind = cb.max_lookbehind;
   }
 
 /* Failed to compile, or error while post-processing. Earlier errors get here

testdata/testinput10

@@ -440,4 +440,7 @@
 /abc/utf,replace=Ã
     abc
 
+/(?<=(a)(?-1))x/I,utf
+    a\x80zx\=offset=3
+
 # End of testinput10

testdata/testoutput10

@@ -1527,4 +1527,13 @@ Subject length lower bound = 2
     abc
 Failed: error -3: UTF-8 error: 1 byte missing at end
 
+/(?<=(a)(?-1))x/I,utf
+Capturing subpattern count = 1
+Max lookbehind = 2
+Options: utf
+First code unit = 'x'
+Subject length lower bound = 1
+    a\x80zx\=offset=3
+Failed: error -22: UTF-8 error: isolated 0x80 byte at offset 1
+
 # End of testinput10