Check for too many replacements (more than INT_MAX) in pcre2_substitute()

ChangeLog

@@ -288,6 +288,8 @@ a factor of the size of the compiling workspace (it currently is).
 
 84. Test for error code <= 0 in regerror().
 
+85. Check for too many replacements (more than INT_MAX) in pcre2_substitute().
+
 
 Version 10.20 30-June-2015
 --------------------------

src/pcre2.h

@@ -241,6 +241,7 @@ numbers must not be changed. */
 #define PCRE2_ERROR_REPMISSINGBRACE   (-58)
 #define PCRE2_ERROR_BADSUBSTITUTION   (-59)
 #define PCRE2_ERROR_BADSUBSPATTERN    (-60)
+#define PCRE2_ERROR_TOOMANYREPLACE    (-61)
 
 /* Request types for pcre2_pattern_info() */
 

src/pcre2.h.in

@@ -241,6 +241,7 @@ numbers must not be changed. */
 #define PCRE2_ERROR_REPMISSINGBRACE   (-58)
 #define PCRE2_ERROR_BADSUBSTITUTION   (-59)
 #define PCRE2_ERROR_BADSUBSPATTERN    (-60)
+#define PCRE2_ERROR_TOOMANYREPLACE    (-61)
 
 /* Request types for pcre2_pattern_info() */
 

src/pcre2_error.c

@@ -251,6 +251,7 @@ static const char match_error_texts[] =
   "bad substitution in replacement string\0"
   /* 60 */
   "match with end before start is not supported\0"
+  "too many replacements (more than INT_MAX)\0" 
   ;
 
 

src/pcre2_substitute.c

@@ -329,6 +329,17 @@ do
     goto EXIT;
     }
 
+  /* Paranoid check for integer overflow; surely no real call to this function
+  would ever hit this! */
+
+  if (subs == INT_MAX)
+    {
+    rc = PCRE2_ERROR_TOOMANYREPLACE;
+    goto EXIT;
+    }
+
+  /* Count substitutions and proceed */
+
   subs++;
   if (rc == 0) rc = ovector_count;
   fraglength = ovector[0] - start_offset;