regex: duplicate character range crash fix.

* regex.c (L1_fill_range, L2_fill_range, L3_fill_range): Bug:
when the arguments ch0 and ch1 indicate that a block is to be
filled entirely, we assume that the pointer is either null
or else a pointer to an allocated block, either of which we can
free and replace with a -1 pointer to indicate a full block.
However the pointer may already be -1, in which case we
wrongly pass that to free(). We must check for it.

0 files changed, 0 insertions, 0 deletions