--- gnulib/lib/regex_internal.c 2018-08-24 17:16:59.161610807 -0600 +++ lib/regex_internal.c 2018-08-24 17:08:07.985496439 -0600 @@ -317,7 +317,11 @@ mbclen = __mbrtowc (&wc, ((const char *) pstr->raw_mbs + pstr->raw_mbs_idx + byte_idx), remain_len, &pstr->cur_state); +#ifdef REGEX_FIX + if (BE (mbclen + 2 > 2, 1)) +#else if (BE (mbclen < (size_t) -2, 1)) +#endif { wchar_t wcu = __towupper (wc); if (wcu != wc) @@ -386,7 +390,11 @@ else p = (const char *) pstr->raw_mbs + pstr->raw_mbs_idx + src_idx; mbclen = __mbrtowc (&wc, p, remain_len, &pstr->cur_state); +#ifdef REGEX_FIX + if (BE (mbclen + 2 > 2, 1)) +#else if (BE (mbclen < (size_t) -2, 1)) +#endif { wchar_t wcu = __towupper (wc); if (wcu != wc) @@ -409,6 +417,7 @@ if (pstr->offsets == NULL) { pstr->offsets = re_malloc (Idx, pstr->bufs_len); + memset (pstr->offsets, 0xBC, sizeof(Idx)*pstr->bufs_len); if (pstr->offsets == NULL) return REG_ESPACE;