From e881ed5028622959cf8859c053501fb1b16387f1 Mon Sep 17 00:00:00 2001
From: Hitendra Prajapati <hprajapati@mvista.com>
Date: Mon, 23 May 2022 13:52:39 +0530
Subject: [PATCH] CVE-2022-1586

Upstream-Status: Backport from https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 ChangeLog               | 3 +++
 src/pcre2_jit_compile.c | 2 +-
 src/pcre2_jit_test.c    | 3 +++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index d27542d..cd3da65 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -63,6 +63,9 @@ Version 10.39 29-October-2021
 
   Reformat slightly to make it C89 compatible again.
 
+23. Fixed a unicode properrty matching issue in JIT. The character was not
+fully read in caseless matching.
+
 
 Version 10.38 01-October-2021
 -----------------------------
diff --git a/src/pcre2_jit_compile.c b/src/pcre2_jit_compile.c
index db2ce65..5baca9b 100644
--- a/src/pcre2_jit_compile.c
+++ b/src/pcre2_jit_compile.c
@@ -7473,7 +7473,7 @@ while (*cc != XCL_END)
     {
     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
     cc++;
-    if (*cc == PT_CLIST)
+    if (*cc == PT_CLIST && *cc == XCL_PROP)
       {
       other_cases = PRIV(ucd_caseless_sets) + cc[1];
       while (*other_cases != NOTACHAR)
diff --git a/src/pcre2_jit_test.c b/src/pcre2_jit_test.c
index 8dee16e..7bb307e 100644
--- a/src/pcre2_jit_test.c
+++ b/src/pcre2_jit_test.c
@@ -412,6 +412,9 @@ static struct regression_test_case regression_test_cases[] = {
 	{ MUP, A, 0, 0 | F_PROPERTY, "[\\P{L&}]{2}[^\xc2\x85-\xc2\x89\\p{Ll}\\p{Lu}]{2}", "\xc3\xa9\xe6\x92\xad.a\xe6\x92\xad|\xc2\x8a#" },
 	{ PCRE2_UCP, 0, 0, 0 | F_PROPERTY, "[a-b\\s]{2,5}[^a]", "AB  baaa" },
 	{ MUP, 0, 0, 0 | F_NOMATCH, "[^\\p{Hangul}\\p{Z}]", " " },
+	{ MUP, 0, 0, 0, "[\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
+	{ MUP, 0, 0, 0, "[\\x{a92e}\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
+	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
 
 	/* Possible empty brackets. */
 	{ MU, A, 0, 0, "(?:|ab||bc|a)+d", "abcxabcabd" },
-- 
2.35.3

