Fix bad behaviour for isolated \E before qualifier with auto-callout.

ChangeLog

@@ -340,6 +340,10 @@ offset as zero instead of where the invalidity was found.
 101. Further to 97 above, negated classes such as [^[:^ascii:]\d] were also not 
 working correctly in UCP mode.
 
+102. Similar to 99 above, if an isolated \E was present between an item and its 
+qualifier when PCRE2_AUTO_CALLOUT was set, pcre2_compile() misbehaved. This bug
+was found by the LLVM fuzzer.
+
 
 Version 10.20 30-June-2015
 --------------------------

src/pcre2_compile.c

@@ -3947,9 +3947,10 @@ for (;; ptr++)
     last_code = code;
     }
 
-  /* If in \Q...\E, check for the end; if not, we have a literal */
+  /* If in \Q...\E, check for the end; if not, we have a literal. If not in
+  \Q...\E, an isolated \E is ignored. */
 
-  if (inescq && (c != CHAR_NULL || ptr < cb->end_pattern))
+  if (c != CHAR_NULL || ptr < cb->end_pattern)
     {
     if (c == CHAR_BACKSLASH && ptr[1] == CHAR_E)
       {
@@ -3957,7 +3958,7 @@ for (;; ptr++)
       ptr++;
       continue;
       }
-    else
+    else if (inescq)
       {
       if (previous_callout != NULL)
         {
@@ -3972,7 +3973,6 @@ for (;; ptr++)
         }
       goto NORMAL_CHAR;
       }
-    /* Control does not reach here. */
     }
 
   /* In extended mode, skip white space and comments. We need a loop in order

testdata/testinput2

@@ -4697,4 +4697,6 @@ a)"xI
 
 /L(?#(|++<!(2)?/B,no_auto_possess,auto_callout
 
+/(A*)\E+/B,auto_callout
+
 # End of testinput2 

testdata/testoutput2

@@ -14942,4 +14942,18 @@ Subject length lower bound = 0
         End
 ------------------------------------------------------------------
 
+/(A*)\E+/B,auto_callout
+------------------------------------------------------------------
+        Bra
+        Callout 255 0 7
+        SCBra 1
+        Callout 255 1 2
+        A*
+        Callout 255 3 0
+        KetRmax
+        Callout 255 7 0
+        Ket
+        End
+------------------------------------------------------------------
+
 # End of testinput2