Upgrade to version 3.92.

1 files changed, 1614 insertions, 796 deletions

diff --git a/ext/pcre/pcrelib/pcre.c b/ext/pcre/pcrelib/pcre.c
index ad3ddc7c57..9d18d989bf 100644
--- a/ext/pcre/pcrelib/pcre.c
+++ b/ext/pcre/pcrelib/pcre.c
@@ -9,7 +9,7 @@ the file Tech.Notes for some information on the internals.
 
 Written by: Philip Hazel <ph10@cam.ac.uk>
 
-           Copyright (c) 1997-2001 University of Cambridge
+           Copyright (c) 1997-2002 University of Cambridge
 
 -----------------------------------------------------------------------------
 Permission is granted to anyone to use this software for any purpose on any
@@ -69,6 +69,14 @@ compile time. */
 #define BRASTACK_SIZE 200
 
 
+
+/* Maximum number of ints of offset to save on the stack for recursive calls.
+If the offset vector is bigger, malloc is used. This should be a multiple of 3,
+because the offset vector is always a multiple of 3 long. */
+
+#define REC_STACK_SAVE_MAX 30
+
+
 /* The number of bytes in a literal character string above which we can't add
 any more is different when UTF-8 characters may be encountered. */
 
@@ -79,29 +87,16 @@ any more is different when UTF-8 characters may be encountered. */
 #endif
 
 
+/* Table of sizes for the fixed-length opcodes. It's defined in a macro so that
+the definition is next to the definition of the opcodes in internal.h. */
+
+static uschar OP_lengths[] = { OP_LENGTHS };
+
 /* Min and max values for the common repeats; for the maxima, 0 => infinity */
 
 static const char rep_min[] = { 0, 0, 1, 1, 0, 0 };
 static const char rep_max[] = { 0, 0, 0, 0, 1, 1 };
 
-/* Text forms of OP_ values and things, for debugging (not all used) */
-
-#ifdef DEBUG
-static const char *OP_names[] = {
-  "End", "\\A", "\\B", "\\b", "\\D", "\\d",
-  "\\S", "\\s", "\\W", "\\w", "\\Z", "\\z",
-  "Opt", "^", "$", "Any", "chars", "not",
-  "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
-  "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
-  "*", "*?", "+", "+?", "?", "??", "{", "{", "{",
-  "*", "*?", "+", "+?", "?", "??", "{", "{",
-  "class", "Ref", "Recurse",
-  "Alt", "Ket", "KetRmax", "KetRmin", "Assert", "Assert not",
-  "AssertB", "AssertB not", "Reverse", "Once", "Cond", "Cref",
-  "Brazero", "Braminzero", "Branumber", "Bra"
-};
-#endif
-
 /* Table for handling escaped characters in the range '0'-'z'. Positive returns
 are simple data values; negative values are for special things like \d and so
 on. Zero means further processing is needed (for things like \x), or the escape
@@ -110,13 +105,13 @@ is invalid. */
 static const short int escapes[] = {
     0,      0,      0,      0,      0,      0,      0,      0,   /* 0 - 7 */
     0,      0,    ':',    ';',    '<',    '=',    '>',    '?',   /* 8 - ? */
-  '@', -ESC_A, -ESC_B,      0, -ESC_D,      0,      0,      0,   /* @ - G */
+  '@', -ESC_A, -ESC_B, -ESC_C, -ESC_D, -ESC_E,      0, -ESC_G,   /* @ - G */
     0,      0,      0,      0,      0,      0,      0,      0,   /* H - O */
-    0,      0,      0, -ESC_S,      0,      0,      0, -ESC_W,   /* P - W */
+    0, -ESC_Q,      0, -ESC_S,      0,      0,      0, -ESC_W,   /* P - W */
     0,      0, -ESC_Z,    '[',   '\\',    ']',    '^',    '_',   /* X - _ */
-  '`',      7, -ESC_b,      0, -ESC_d,  ESC_E,  ESC_F,      0,   /* ` - g */
-    0,      0,      0,      0,      0,      0,  ESC_N,      0,   /* h - o */
-    0,      0,  ESC_R, -ESC_s,  ESC_T,      0,      0, -ESC_w,   /* p - w */
+  '`',      7, -ESC_b,      0, -ESC_d,  ESC_e,  ESC_f,      0,   /* ` - g */
+    0,      0,      0,      0,      0,      0,  ESC_n,      0,   /* h - o */
+    0,      0,  ESC_r, -ESC_s,  ESC_t,      0,      0, -ESC_w,   /* p - w */
     0,      0, -ESC_z                                            /* x - z */
 };
 
@@ -126,14 +121,15 @@ as this is assumed for handling case independence. */
 
 static const char *posix_names[] = {
   "alpha", "lower", "upper",
-  "alnum", "ascii", "cntrl", "digit", "graph",
+  "alnum", "ascii", "blank", "cntrl", "digit", "graph",
   "print", "punct", "space", "word",  "xdigit" };
 
 static const uschar posix_name_lengths[] = {
-  5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
+  5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 4, 6, 0 };
 
 /* Table of class bit maps for each POSIX class; up to three may be combined
-to form the class. */
+to form the class. The table for [:blank:] is dynamically modified to remove
+the vertical space characters. */
 
 static const int posix_class_maps[] = {
   cbit_lower, cbit_upper, -1,             /* alpha */
@@ -141,13 +137,14 @@ static const int posix_class_maps[] = {
   cbit_upper, -1,         -1,             /* upper */
   cbit_digit, cbit_lower, cbit_upper,     /* alnum */
   cbit_print, cbit_cntrl, -1,             /* ascii */
+  cbit_space, -1,         -1,             /* blank - a GNU extension */
   cbit_cntrl, -1,         -1,             /* cntrl */
   cbit_digit, -1,         -1,             /* digit */
   cbit_graph, -1,         -1,             /* graph */
   cbit_print, -1,         -1,             /* print */
   cbit_punct, -1,         -1,             /* punct */
   cbit_space, -1,         -1,             /* space */
-  cbit_word,  -1,         -1,             /* word */
+  cbit_word,  -1,         -1,             /* word - a Perl extension */
   cbit_xdigit,-1,         -1              /* xdigit */
 };
 
@@ -156,7 +153,7 @@ static const int posix_class_maps[] = {
 
 static BOOL
   compile_regex(int, int, int *, uschar **, const uschar **, const char **,
-    BOOL, int, int *, int *, compile_data *);
+    BOOL, int, int *, int *, branch_chain *, compile_data *);
 
 /* Structure for building a chain of data that actually lives on the
 stack, for holding the values of the subject pointer at the start of each
@@ -181,12 +178,15 @@ typedef struct eptrblock {
 
 /* PCRE is thread-clean and doesn't use any global variables in the normal
 sense. However, it calls memory allocation and free functions via the two
-indirections below, which are can be changed by the caller, but are shared
-between all threads. */
+indirections below, and it can optionally do callouts. These values can be
+changed by the caller, but are shared between all threads. However, when
+compiling for Virtual Pascal, things are done differently (see pcre.in). */
 
+#ifndef VPCOMPAT
 void *(*pcre_malloc)(size_t) = malloc;
 void  (*pcre_free)(void *) = free;
-
+int   (*pcre_callout)(pcre_callout_block *) = NULL;
+#endif
 
 
 /*************************************************
@@ -323,6 +323,19 @@ return i + 1;
 
 
 /*************************************************
+*         Print compiled regex                   *
+*************************************************/
+
+/* The code for doing this is held in a separate file that is also included in
+pcretest.c. It defines a function called print_internals(). */
+
+#ifdef DEBUG
+#include "printint.c"
+#endif
+
+
+
+/*************************************************
 *          Return version string                 *
 *************************************************/
 
@@ -436,6 +449,18 @@ switch (what)
     ((re->options & PCRE_REQCHSET) != 0)? re->req_char : -1;
   break;
 
+  case PCRE_INFO_NAMEENTRYSIZE:
+  *((int *)where) = re->name_entry_size;
+  break;
+
+  case PCRE_INFO_NAMECOUNT:
+  *((int *)where) = re->name_count;
+  break;
+
+  case PCRE_INFO_NAMETABLE:
+  *((const uschar **)where) = (const uschar *)re + sizeof(real_pcre);
+  break;
+
   default: return PCRE_ERROR_BADOPTION;
   }
 
@@ -525,6 +550,20 @@ else
   const uschar *oldptr;
   switch (c)
     {
+    /* A number of Perl escapes are not handled by PCRE. We give an explicit
+    error. */
+
+    case 'l':
+    case 'L':
+    case 'N':
+    case 'p':
+    case 'P':
+    case 'u':
+    case 'U':
+    case 'X':
+    *errorptr = ERR37;
+    break;
+
     /* The handling of escape sequences consisting of a string of digits
     starting with one that is not zero is not straightforward. By experiment,
     the way Perl works seems to be as follows:
@@ -746,6 +785,60 @@ return p;
 
 
 /*************************************************
+*      Find first significant op code            *
+*************************************************/
+
+/* This is called by several functions that scan a compiled expression looking
+for a fixed first character, or an anchoring op code etc. It skips over things
+that do not influence this. For some calls, a change of option is important.
+
+Arguments:
+  code       pointer to the start of the group
+  options    pointer to external options
+  optbit     the option bit whose changing is significant, or
+               zero if none are
+
+Returns:     pointer to the first significant opcode
+*/
+
+static const uschar*
+first_significant_code(const uschar *code, int *options, int optbit)
+{
+for (;;)
+  {
+  switch ((int)*code)
+    {
+    case OP_OPT:
+    if (optbit > 0 && ((int)code[1] & optbit) != (*options & optbit))
+      *options = (int)code[1];
+    code += 2;
+    break;
+
+    case OP_ASSERT_NOT:
+    case OP_ASSERTBACK:
+    case OP_ASSERTBACK_NOT:
+    do code += GET(code, 1); while (*code == OP_ALT);
+    /* Fall through */
+
+    case OP_CALLOUT:
+    case OP_CREF:
+    case OP_BRANUMBER:
+    case OP_WORD_BOUNDARY:
+    case OP_NOT_WORD_BOUNDARY:
+    code += OP_lengths[*code];
+    break;
+
+    default:
+    return code;
+    }
+  }
+/* Control never reaches here */
+}
+
+
+
+
+/*************************************************
 *        Find the fixed length of a pattern      *
 *************************************************/
 
@@ -756,7 +849,8 @@ Arguments:
   code     points to the start of the pattern (the bracket)
   options  the compiling options
 
-Returns:   the fixed length, or -1 if there is no fixed length
+Returns:   the fixed length, or -1 if there is no fixed length,
+             or -2 if \C was encountered
 */
 
 static int
@@ -765,7 +859,7 @@ find_fixedlength(uschar *code, int options)
 int length = -1;
 
 register int branchlength = 0;
-register uschar *cc = code + 3;
+register uschar *cc = code + 1 + LINK_SIZE;
 
 /* Scan along the opcodes for this branch. If we get to the end of the
 branch, check the length against that of the other branches. */
@@ -782,10 +876,10 @@ for (;;)
     case OP_ONCE:
     case OP_COND:
     d = find_fixedlength(cc, options);
-    if (d < 0) return -1;
+    if (d < 0) return d;
     branchlength += d;
-    do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-    cc += 3;
+    do cc += GET(cc, 1); while (*cc == OP_ALT);
+    cc += 1 + LINK_SIZE;
     break;
 
     /* Reached end of a branch; if it's a ket it is the end of a nested
@@ -800,7 +894,7 @@ for (;;)
     if (length < 0) length = branchlength;
       else if (length != branchlength) return -1;
     if (*cc != OP_ALT) return length;
-    cc += 3;
+    cc += 1 + LINK_SIZE;
     branchlength = 0;
     break;
 
@@ -810,36 +904,31 @@ for (;;)
     case OP_ASSERT_NOT:
     case OP_ASSERTBACK:
     case OP_ASSERTBACK_NOT:
-    do cc += (cc[1] << 8) + cc[2]; while (*cc == OP_ALT);
-    cc += 3;
-    break;
+    do cc += GET(cc, 1); while (*cc == OP_ALT);
+    /* Fall through */
 
     /* Skip over things that don't match chars */
 
     case OP_REVERSE:
     case OP_BRANUMBER:
     case OP_CREF:
-    cc++;
-    /* Fall through */
-
     case OP_OPT:
-    cc++;
-    /* Fall through */
-
+    case OP_CALLOUT:
     case OP_SOD:
+    case OP_SOM:
     case OP_EOD:
     case OP_EODN:
     case OP_CIRC:
     case OP_DOLL:
     case OP_NOT_WORD_BOUNDARY:
     case OP_WORD_BOUNDARY:
-    cc++;
+    cc += OP_lengths[*cc];
     break;
 
     /* Handle char strings. In UTF-8 mode we must count characters, not bytes.
     This requires a scan of the string, unfortunately. We assume valid UTF-8
-    strings, so all we do is reduce the length by one for byte whose bits are
-    10xxxxxx. */
+    strings, so all we do is reduce the length by one for every byte whose bits
+    are 10xxxxxx. */
 
     case OP_CHARS:
     branchlength += *(++cc);
@@ -854,7 +943,7 @@ for (;;)
 
     case OP_EXACT:
     case OP_TYPEEXACT:
-    branchlength += (cc[1] << 8) + cc[2];
+    branchlength += GET2(cc,1);
     cc += 4;
     break;
 
@@ -871,6 +960,10 @@ for (;;)
     cc++;
     break;
 
+    /* The single-byte matcher isn't allowed */
+
+    case OP_ANYBYTE:
+    return -2;
 
     /* Check a class for variable quantification */
 
@@ -887,8 +980,8 @@ for (;;)
 
       case OP_CRRANGE:
       case OP_CRMINRANGE:
-      if ((cc[1] << 8) + cc[2] != (cc[3] << 8) + cc[4]) return -1;
-      branchlength += (cc[1] << 8) + cc[2];
+      if (GET2(cc,1) != GET2(cc,3)) return -1;
+      branchlength += GET2(cc,1);
       cc += 5;
       break;
 
@@ -910,6 +1003,184 @@ for (;;)
 
 
 /*************************************************
+*    Scan compiled regex for numbered bracket    *
+*************************************************/
+
+/* This little function scans through a compiled pattern until it finds a
+capturing bracket with the given number.
+
+Arguments:
+  code        points to start of expression
+  number      the required bracket number
+
+Returns:      pointer to the opcode for the bracket, or NULL if not found
+*/
+
+static const uschar *
+find_bracket(const uschar *code, int number)
+{
+for (;;)
+  {
+  register int c = *code;
+  if (c == OP_END) return NULL;
+  else if (c == OP_CHARS) code += code[1] + OP_lengths[c];
+  else if (c > OP_BRA)
+    {
+    int n = c - OP_BRA;
+    if (n > EXTRACT_BASIC_MAX) n = GET2(code, 2+LINK_SIZE);
+    if (n == number) return (uschar *)code;
+    code += OP_lengths[OP_BRA];
+    }
+  else code += OP_lengths[c];
+  }
+}
+
+
+
+/*************************************************
+*    Scan compiled branch for non-emptiness      *
+*************************************************/
+
+/* This function scans through a branch of a compiled pattern to see whether it
+can match the empty string or not. It is called only from could_be_empty()
+below. Note that first_significant_code() skips over assertions. If we hit an
+unclosed bracket, we return "empty" - this means we've struck an inner bracket
+whose current branch will already have been scanned.
+
+Arguments:
+  code        points to start of search
+  endcode     points to where to stop
+
+Returns:      TRUE if what is matched could be empty
+*/
+
+static BOOL
+could_be_empty_branch(const uschar *code, const uschar *endcode)
+{
+register int c;
+for (code = first_significant_code(code + 1 + LINK_SIZE, NULL, 0);
+     code < endcode;
+     code = first_significant_code(code + OP_lengths[c], NULL, 0))
+  {
+  c = *code;
+
+  if (c >= OP_BRA)
+    {
+    BOOL empty_branch;
+    if (GET(code, 1) == 0) return TRUE;    /* Hit unclosed bracket */
+
+    /* Scan a closed bracket */
+
+    empty_branch = FALSE;
+    do
+      {
+      if (!empty_branch && could_be_empty_branch(code, endcode))
+        empty_branch = TRUE;
+      code += GET(code, 1);
+      }
+    while (*code == OP_ALT);
+    if (!empty_branch) return FALSE;   /* All branches are non-empty */
+    code += 1 + LINK_SIZE;
+    c = *code;
+    }
+
+  /* Check for any quantifier after a class */
+
+  else if (c == OP_CLASS)
+    {
+    const uschar *ccode = code + 33;
+
+    switch (*ccode)
+      {
+      case OP_CRSTAR:            /* These could be empty; continue */
+      case OP_CRMINSTAR:
+      case OP_CRQUERY:
+      case OP_CRMINQUERY:
+      break;
+
+      default:                   /* Non-repeat => class must match */
+      case OP_CRPLUS:            /* These repeats aren't empty */
+      case OP_CRMINPLUS:
+      return FALSE;
+
+      case OP_CRRANGE:
+      case OP_CRMINRANGE:
+      if (GET2(ccode, 1) > 0) return FALSE;  /* Minimum > 0 */
+      break;
+      }
+    }
+
+  /* Test for an opcode that must match a character. */
+
+  else switch (c)
+    {
+    case OP_NOT_DIGIT:
+    case OP_DIGIT:
+    case OP_NOT_WHITESPACE:
+    case OP_WHITESPACE:
+    case OP_NOT_WORDCHAR:
+    case OP_WORDCHAR:
+    case OP_ANY:
+    case OP_ANYBYTE:
+    case OP_CHARS:
+    case OP_NOT:
+    case OP_PLUS:
+    case OP_MINPLUS:
+    case OP_EXACT:
+    case OP_NOTPLUS:
+    case OP_NOTMINPLUS:
+    case OP_NOTEXACT:
+    case OP_TYPEPLUS:
+    case OP_TYPEMINPLUS:
+    case OP_TYPEEXACT:
+    return FALSE;
+
+    /* End of branch */
+
+    case OP_KET:
+    case OP_KETRMAX:
+    case OP_KETRMIN:
+    case OP_ALT:
+    return TRUE;
+    }
+  }
+
+return TRUE;
+}
+
+
+
+/*************************************************
+*    Scan compiled regex for non-emptiness       *
+*************************************************/
+
+/* This function is called to check for left recursive calls. We want to check
+the current branch of the current pattern to see if it could match the empty
+string. If it could, we must look outwards for branches at other levels,
+stopping when we pass beyond the bracket which is the subject of the recursion.
+
+Arguments:
+  code        points to start of the recursion
+  endcode     points to where to stop (current RECURSE item)
+  bcptr       points to the chain of current (unclosed) branch starts
+
+Returns:      TRUE if what is matched could be empty
+*/
+
+static BOOL
+could_be_empty(const uschar *code, const uschar *endcode, branch_chain *bcptr)
+{
+while (bcptr != NULL && bcptr->current >= code)
+  {
+  if (!could_be_empty_branch(bcptr->current, endcode)) return FALSE;
+  bcptr = bcptr->outer;
+  }
+return TRUE;
+}
+
+
+
+/*************************************************
 *           Check for POSIX class syntax         *
 *************************************************/
 
@@ -978,38 +1249,45 @@ return -1;
 *           Compile one branch                   *
 *************************************************/
 
-/* Scan the pattern, compiling it into the code vector.
+/* Scan the pattern, compiling it into the code vector. If the options are
+changed during the branch, the pointer is used to change the external options
+bits.
 
 Arguments:
-  options      the option bits
-  brackets     points to number of extracting brackets used
-  code         points to the pointer to the current code point
-  ptrptr       points to the current pattern pointer
-  errorptr     points to pointer to error message
-  optchanged   set to the value of the last OP_OPT item compiled
-  reqchar      set to the last literal character required, else -1
-  countlits    set to count of mandatory literal characters
-  cd           contains pointers to tables
-
-Returns:       TRUE on success
-               FALSE, with *errorptr set on error
+  optionsptr     pointer to the option bits
+  brackets       points to number of extracting brackets used
+  code           points to the pointer to the current code point
+  ptrptr         points to the current pattern pointer
+  errorptr       points to pointer to error message
+  firstcharptr   set to initial literal character, or < 0 (REQ_UNSET, REQ_NONE)
+  reqcharptr     set to the last literal character required, else < 0
+  bcptr          points to current branch chain
+  cd             contains pointers to tables etc.
+
+Returns:         TRUE on success
+                 FALSE, with *errorptr set on error
 */
 
 static BOOL
-compile_branch(int options, int *brackets, uschar **codeptr,
-  const uschar **ptrptr, const char **errorptr, int *optchanged,
-  int *reqchar, int *countlits, compile_data *cd)
+compile_branch(int *optionsptr, int *brackets, uschar **codeptr,
+  const uschar **ptrptr, const char **errorptr, int *firstcharptr,
+  int *reqcharptr, branch_chain *bcptr, compile_data *cd)
 {
 int repeat_type, op_type;
-int repeat_min, repeat_max;
-int bravalue, length;
+int repeat_min = 0, repeat_max = 0;      /* To please picky compilers */
+int bravalue = 0;
+int length;
 int greedy_default, greedy_non_default;
-int prevreqchar;
+int firstchar, reqchar;
+int zeroreqchar, zerofirstchar;
+int req_caseopt;
 int condcount = 0;
-int subcountlits = 0;
+int options = *optionsptr;
 register int c;
 register uschar *code = *codeptr;
 uschar *tempcode;
+BOOL inescq = FALSE;
+BOOL groupsetfirstchar = FALSE;
 const uschar *ptr = *ptrptr;
 const uschar *tempptr;
 uschar *previous = NULL;
@@ -1020,23 +1298,42 @@ uschar class[32];
 greedy_default = ((options & PCRE_UNGREEDY) != 0);
 greedy_non_default = greedy_default ^ 1;
 
-/* Initialize no required char, and count of literals */
+/* Initialize no first char, no required char. REQ_UNSET means "no char
+matching encountered yet". It gets changed to REQ_NONE if we hit something that
+matches a non-fixed char first char; reqchar just remains unset if we never
+find one.
+
+When we hit a repeat whose minimum is zero, we may have to adjust these values
+to take the zero repeat into account. This is implemented by setting them to
+zerofirstchar and zeroreqchar when such a repeat is encountered. The individual
+item types that can be repeated set these backoff variables appropriately. */
+
+firstchar = reqchar = zerofirstchar = zeroreqchar = REQ_UNSET;
+
+/* The variable req_caseopt contains either the REQ_CASELESS value or zero,
+according to the current setting of the caseless flag. REQ_CASELESS is a bit
+value > 255. It is added into the firstchar or reqchar variables to record the
+case status of the value. */
 
-*reqchar = prevreqchar = -1;
-*countlits = 0;
+req_caseopt = ((options & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
 
 /* Switch on next character until the end of the branch */
 
 for (;; ptr++)
   {
   BOOL negate_class;
+  BOOL possessive_quantifier;
   int class_charcount;
   int class_lastchar;
   int newoptions;
+  int recno;
   int skipbytes;
   int subreqchar;
+  int subfirstchar;
 
   c = *ptr;
+  if (inescq && c != 0) goto NORMAL_CHAR;
+
   if ((options & PCRE_EXTENDED) != 0)
     {
     if ((cd->ctypes[c] & ctype_space) != 0) continue;
@@ -1045,7 +1342,7 @@ for (;; ptr++)
       /* The space before the ; is to avoid a warning on a silly compiler
       on the Macintosh. */
       while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
-      continue;
+      if (c != 0) continue;   /* Else fall through to handle end of string */
       }
     }
 
@@ -1056,13 +1353,20 @@ for (;; ptr++)
     case 0:
     case '|':
     case ')':
+    *firstcharptr = firstchar;
+    *reqcharptr = reqchar;
     *codeptr = code;
     *ptrptr = ptr;
     return TRUE;
 
-    /* Handle single-character metacharacters */
+    /* Handle single-character metacharacters. In multiline mode, ^ disables
+    the setting of any following char as a first character. */
 
     case '^':
+    if ((options & PCRE_MULTILINE) != 0)
+      {
+      if (firstchar == REQ_UNSET) firstchar = REQ_NONE;
+      }
     previous = NULL;
     *code++ = OP_CIRC;
     break;
@@ -1072,7 +1376,13 @@ for (;; ptr++)
     *code++ = OP_DOLL;
     break;
 
+    /* There can never be a first char if '.' is first, whatever happens about
+    repeats. The value of reqchar doesn't change either. */
+
     case '.':
+    if (firstchar == REQ_UNSET) firstchar = REQ_NONE;
+    zerofirstchar = firstchar;
+    zeroreqchar = reqchar;
     previous = code;
     *code++ = OP_ANY;
     break;
@@ -1086,6 +1396,16 @@ for (;; ptr++)
     previous = code;
     *code++ = OP_CLASS;
 
+    /* PCRE supports POSIX class stuff inside a class. Perl gives an error if
+    they are encountered at the top level, so we'll do that too. */
+
+    if ((ptr[1] == ':' || ptr[1] == '.' || ptr[1] == '=') &&
+        check_posix_syntax(ptr, &tempptr, cd))
+      {
+      *errorptr = (ptr[1] == ':')? ERR13 : ERR31;
+      goto FAILED;
+      }
+
     /* If the first character is '^', set the negation flag and skip it. */
 
     if ((c = *(++ptr)) == '^')
@@ -1109,21 +1429,16 @@ for (;; ptr++)
     memset(class, 0, 32 * sizeof(uschar));
 
     /* Process characters until ] is reached. By writing this as a "do" it
-    means that an initial ] is taken as a data character. */
+    means that an initial ] is taken as a data character. The first pass
+    checked the overall syntax. */
 
     do
       {
-      if (c == 0)
-        {
-        *errorptr = ERR6;
-        goto FAILED;
-        }
-
       /* Handle POSIX class names. Perl allows a negation extension of the
-      form [:^name]. A square bracket that doesn't match the syntax is
+      form [:^name:]. A square bracket that doesn't match the syntax is
       treated as a literal. We also recognize the POSIX constructions
       [.ch.] and [=ch=] ("collating elements") and fault them, as Perl
-      5.6 does. */
+      5.6 and 5.8 do. */
 
       if (c == '[' &&
           (ptr[1] == ':' || ptr[1] == '.' || ptr[1] == '=') &&
@@ -1161,17 +1476,26 @@ for (;; ptr++)
           posix_class = 0;
 
         /* Or into the map we are building up to 3 of the static class
-        tables, or their negations. */
+        tables, or their negations. The [:blank:] class sets up the same
+        chars as the [:space:] class (all white space). We remove the vertical
+        white space chars afterwards. */
 
         posix_class *= 3;
         for (i = 0; i < 3; i++)
           {
+          BOOL isblank = strncmp(ptr, "blank", 5) == 0;
           int taboffset = posix_class_maps[posix_class + i];
           if (taboffset < 0) break;
           if (local_negate)
+            {
             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+taboffset];
+            if (isblank) class[1] |= 0x3c;
+            }
           else
+            {
             for (c = 0; c < 32; c++) class[c] |= cbits[c+taboffset];
+            if (isblank) class[1] &= ~0x3c;
+            }
           }
 
         ptr = tempptr + 1;
@@ -1194,7 +1518,7 @@ for (;; ptr++)
         else if (c < 0)
           {
           register const uschar *cbits = cd->cbits;
-          class_charcount = 10;
+          class_charcount = 10;     /* Greater than 1 is what matters */
           switch (-c)
             {
             case ESC_d:
@@ -1215,10 +1539,12 @@ for (;; ptr++)
 
             case ESC_s:
             for (c = 0; c < 32; c++) class[c] |= cbits[c+cbit_space];
+            class[1] &= ~0x08;   /* Perl 5.004 onwards omits VT from \s */
             continue;
 
             case ESC_S:
             for (c = 0; c < 32; c++) class[c] |= ~cbits[c+cbit_space];
+            class[1] |= 0x08;    /* Perl 5.004 onwards omits VT from \s */
             continue;
 
             default:
@@ -1249,12 +1575,6 @@ for (;; ptr++)
         ptr += 2;
         d = *ptr;
 
-        if (d == 0)
-          {
-          *errorptr = ERR6;
-          goto FAILED;
-          }
-
         /* The second part of a range can be a single-character escape, but
         not any of the other escapes. Perl 5.6 treats a hyphen as a literal
         in such circumstances. */
@@ -1324,18 +1644,34 @@ for (;; ptr++)
     while ((c = *(++ptr)) != ']');
 
     /* If class_charcount is 1 and class_lastchar is not negative, we saw
-    precisely one character. This doesn't need the whole 32-byte bit map.
-    We turn it into a 1-character OP_CHAR if it's positive, or OP_NOT if
-    it's negative. */
+    precisely one character. This doesn't need the whole 32-byte bit map. We
+    turn it into a 1-character OP_CHARS if it's positive, or OP_NOT if it's
+    negative. In the positive case, it can cause firstchar to be set.
+    Otherwise, there can be no first char if this item is first, whatever
+    repeat count may follow. In the case of reqchar, save the previous value
+    for reinstating. */
 
     if (class_charcount == 1 && class_lastchar >= 0)
       {
+      zeroreqchar = reqchar;
       if (negate_class)
         {
+        if (firstchar == REQ_UNSET) firstchar = REQ_NONE;
+        zerofirstchar = firstchar;
         code[-1] = OP_NOT;
         }
       else
         {
+        if (firstchar == REQ_UNSET)
+          {
+          zerofirstchar = REQ_NONE;
+          firstchar = class_lastchar | req_caseopt;
+          }
+        else
+          {
+          zerofirstchar = firstchar;
+          reqchar = class_lastchar | req_caseopt;
+          }
         code[-1] = OP_CHARS;
         *code++ = 1;
         }
@@ -1343,10 +1679,15 @@ for (;; ptr++)
       }
 
     /* Otherwise, negate the 32-byte map if necessary, and copy it into
-    the code vector. */
+    the code vector. If this is the first thing in the branch, there can be
+    no first char setting, whatever the repeat count. Any reqchar setting
+    must remain unchanged after any kind of repeat. */
 
     else
       {
+      if (firstchar == REQ_UNSET) firstchar = REQ_NONE;
+      zerofirstchar = firstchar;
+      zeroreqchar = reqchar;
       if (negate_class)
         for (c = 0; c < 32; c++) code[c] = ~class[c];
       else
@@ -1384,47 +1725,86 @@ for (;; ptr++)
       goto FAILED;
       }
 
-    /* If the next character is '?' this is a minimizing repeat, by default,
-    but if PCRE_UNGREEDY is set, it works the other way round. Advance to the
-    next character. */
+    if (repeat_min == 0)
+      {
+      firstchar = zerofirstchar;   /* Adjust for zero repeat */
+      reqchar = zeroreqchar;       /* Ditto */
+      }
 
-    if (ptr[1] == '?')
-      { repeat_type = greedy_non_default; ptr++; }
+    op_type = 0;                    /* Default single-char op codes */
+    possessive_quantifier = FALSE;  /* Default not possessive quantifier */
+
+    /* Save start of previous item, in case we have to move it up to make space
+    for an inserted OP_ONCE for the additional '+' extension. */
+
+    tempcode = previous;
+
+    /* If the next character is '+', we have a possessive quantifier. This
+    implies greediness, whatever the setting of the PCRE_UNGREEDY option.
+    If the next character is '?' this is a minimizing repeat, by default,
+    but if PCRE_UNGREEDY is set, it works the other way round. We change the
+    repeat type to the non-default. */
+
+    if (ptr[1] == '+')
+      {
+      repeat_type = 0;                  /* Force greedy */
+      possessive_quantifier = TRUE;
+      ptr++;
+      }
+    else if (ptr[1] == '?')
+      {
+      repeat_type = greedy_non_default;
+      ptr++;
+      }
     else repeat_type = greedy_default;
 
+    /* If previous was a recursion, we need to wrap it inside brackets so that
+    it can be replicated if necessary. */
+
+    if (*previous == OP_RECURSE)
+      {
+      memmove(previous + 1 + LINK_SIZE, previous, 1 + LINK_SIZE);
+      code += 1 + LINK_SIZE;
+      *previous = OP_BRA;
+      PUT(previous, 1, code - previous);
+      *code = OP_KET;
+      PUT(code, 1, code - previous);
+      code += 1 + LINK_SIZE;
+      }
+
     /* If previous was a string of characters, chop off the last one and use it
     as the subject of the repeat. If there was only one character, we can
-    abolish the previous item altogether. A repeat with a zero minimum wipes
-    out any reqchar setting, backing up to the previous value. We must also
-    adjust the countlits value. */
+    abolish the previous item altogether. If a one-char item has a minumum of
+    more than one, ensure that it is set in reqchar - it might not be if a
+    sequence such as x{3} is the first thing in a branch because the x will
+    have gone into firstchar instead.  */
 
     if (*previous == OP_CHARS)
       {
       int len = previous[1];
-
-      if (repeat_min == 0) *reqchar = prevreqchar;
-      *countlits += repeat_min - 1;
-
       if (len == 1)
         {
         c = previous[2];
         code = previous;
+        if (repeat_min > 1) reqchar = c | req_caseopt;
         }
       else
         {
         c = previous[len+1];
         previous[1]--;
         code--;
+        tempcode = code;           /* Adjust position to be moved for '+' */
         }
-      op_type = 0;                 /* Use single-char op codes */
+
       goto OUTPUT_SINGLE_REPEAT;   /* Code shared with single character types */
       }
 
     /* If previous was a single negated character ([^a] or similar), we use
     one of the special opcodes, replacing it. The code is shared with single-
-    character repeats by adding a suitable offset into repeat_type. */
+    character repeats by setting opt_type to add a suitable offset into
+    repeat_type. */
 
-    else if ((int)*previous == OP_NOT)
+    else if (*previous == OP_NOT)
       {
       op_type = OP_NOTSTAR - OP_STAR;  /* Use "not" opcodes */
       c = previous[1];
@@ -1434,9 +1814,9 @@ for (;; ptr++)
 
     /* If previous was a character type match (\d or similar), abolish it and
     create a suitable repeat item. The code is shared with single-character
-    repeats by adding a suitable offset into repeat_type. */
+    repeats by setting op_type to add a suitable offset into repeat_type. */
 
-    else if ((int)*previous < OP_EODN || *previous == OP_ANY)
+    else if (*previous < OP_EODN)
       {
       op_type = OP_TYPESTAR - OP_STAR;  /* Use type opcodes */
       c = *previous;
@@ -1463,8 +1843,7 @@ for (;; ptr++)
         else
           {
           *code++ = OP_UPTO + repeat_type;
-          *code++ = repeat_max >> 8;
-          *code++ = (repeat_max & 255);
+          PUT2INC(code, 0, repeat_max);
           }
         }
 
@@ -1481,8 +1860,7 @@ for (;; ptr++)
         if (repeat_min != 1)
           {
           *code++ = OP_EXACT + op_type;  /* NB EXACT doesn't have repeat_type */
-          *code++ = repeat_min >> 8;
-          *code++ = (repeat_min & 255);
+          PUT2INC(code, 0, repeat_min);
           }
 
         /* If the mininum is 1 and the previous item was a character string,
@@ -1517,8 +1895,7 @@ for (;; ptr++)
           *code++ = c;
           repeat_max -= repeat_min;
           *code++ = OP_UPTO + repeat_type;
-          *code++ = repeat_max >> 8;
-          *code++ = (repeat_max & 255);
+          PUT2INC(code, 0, repeat_max);
           }
         }
 
@@ -1546,19 +1923,17 @@ for (;; ptr++)
       else
         {
         *code++ = OP_CRRANGE + repeat_type;
-        *code++ = repeat_min >> 8;
-        *code++ = repeat_min & 255;
+        PUT2INC(code, 0, repeat_min);
         if (repeat_max == -1) repeat_max = 0;  /* 2-byte encoding for max */
-        *code++ = repeat_max >> 8;
-        *code++ = repeat_max & 255;
+        PUT2INC(code, 0, repeat_max);
         }
       }
 
     /* If previous was a bracket group, we may have to replicate it in certain
     cases. */
 
-    else if ((int)*previous >= OP_BRA || (int)*previous == OP_ONCE ||
-             (int)*previous == OP_COND)
+    else if (*previous >= OP_BRA || *previous == OP_ONCE ||
+             *previous == OP_COND)
       {
       register int i;
       int ketoffset = 0;
@@ -1574,7 +1949,7 @@ for (;; ptr++)
       if (repeat_max == -1)
         {
         register uschar *ket = previous;
-        do ket += (ket[1] << 8) + ket[2]; while (*ket != OP_KET);
+        do ket += GET(ket, 1); while (*ket != OP_KET);
         ketoffset = code - ket;
         }
 
@@ -1587,15 +1962,6 @@ for (;; ptr++)
 
       if (repeat_min == 0)
         {
-        /* If we set up a required char from the bracket, we must back off
-        to the previous value and reset the countlits value too. */
-
-        if (subcountlits > 0)
-          {
-          *reqchar = prevreqchar;
-          *countlits -= subcountlits;
-          }
-
         /* If the maximum is also zero, we just omit the group from the output
         altogether. */
 
@@ -1625,8 +1991,8 @@ for (;; ptr++)
         else
           {
           int offset;
-          memmove(previous+4, previous, len);
-          code += 4;
+          memmove(previous + 2 + LINK_SIZE, previous, len);
+          code += 2 + LINK_SIZE;
           *previous++ = OP_BRAZERO + repeat_type;
           *previous++ = OP_BRA;
 
@@ -1635,8 +2001,7 @@ for (;; ptr++)
 
           offset = (bralink == NULL)? 0 : previous - bralink;
           bralink = previous;
-          *previous++ = offset >> 8;
-          *previous++ = offset & 255;
+          PUTINC(previous, 0, offset);
           }
 
         repeat_max--;
@@ -1644,14 +2009,19 @@ for (;; ptr++)
 
       /* If the minimum is greater than zero, replicate the group as many
       times as necessary, and adjust the maximum to the number of subsequent
-      copies that we need. */
+      copies that we need. If we set a first char from the group, and didn't
+      set a required char, copy the latter from the former. */
 
       else
         {
-        for (i = 1; i < repeat_min; i++)
+        if (repeat_min > 1)
           {
-          memcpy(code, previous, len);
-          code += len;
+          if (groupsetfirstchar && reqchar < 0) reqchar = firstchar;
+          for (i = 1; i < repeat_min; i++)
+            {
+            memcpy(code, previous, len);
+            code += len;
+            }
           }
         if (repeat_max > 0) repeat_max -= repeat_min;
         }
@@ -1677,8 +2047,7 @@ for (;; ptr++)
             *code++ = OP_BRA;
             offset = (bralink == NULL)? 0 : code - bralink;
             bralink = code;
-            *code++ = offset >> 8;
-            *code++ = offset & 255;
+            PUTINC(code, 0, offset);
             }
 
           memcpy(code, previous, len);
@@ -1693,11 +2062,11 @@ for (;; ptr++)
           int oldlinkoffset;
           int offset = code - bralink + 1;
           uschar *bra = code - offset;
-          oldlinkoffset = (bra[1] << 8) + bra[2];
+          oldlinkoffset = GET(bra, 1);
           bralink = (oldlinkoffset == 0)? NULL : bralink - oldlinkoffset;
           *code++ = OP_KET;
-          *code++ = bra[1] = offset >> 8;
-          *code++ = bra[2] = (offset & 255);
+          PUTINC(code, 0, offset);
+          PUT(bra, 1, offset);
           }
         }
 
@@ -1717,6 +2086,24 @@ for (;; ptr++)
       goto FAILED;
       }
 
+    /* If the character following a repeat is '+', we wrap the entire repeated
+    item inside OP_ONCE brackets. This is just syntactic sugar, taken from
+    Sun's Java package. The repeated item starts at tempcode, not at previous,
+    which might be the first part of a string whose (former) last char we
+    repeated. However, we don't support '+' after a greediness '?'. */
+
+    if (possessive_quantifier)
+      {
+      int len = code - tempcode;
+      memmove(tempcode + 1+LINK_SIZE, tempcode, len);
+      code += 1 + LINK_SIZE;
+      len += 1 + LINK_SIZE;
+      tempcode[0] = OP_ONCE;
+      *code++ = OP_KET;
+      PUTINC(code, 0, len);
+      PUT(tempcode, 1, len);
+      }
+
     /* In all case we no longer have a previous item. */
 
     END_REPEAT:
@@ -1754,9 +2141,22 @@ for (;; ptr++)
 
         case '(':
         bravalue = OP_COND;       /* Conditional group */
-        if ((cd->ctypes[*(++ptr)] & ctype_digit) != 0)
+
+        /* Condition to test for recursion */
+
+        if (ptr[1] == 'R')
           {
-          int condref = *ptr - '0';
+          code[1+LINK_SIZE] = OP_CREF;
+          PUT2(code, 2+LINK_SIZE, CREF_RECURSE);
+          skipbytes += 1+LINK_SIZE;
+          ptr += 3;
+          }
+
+        /* Condition to test for a numbered subpattern match */
+
+        else if ((cd->ctypes[ptr[1]] & ctype_digit) != 0)
+          {
+          int condref = *(++ptr) - '0';
           while (*(++ptr) != ')') condref = condref*10 + *ptr - '0';
           if (condref == 0)
             {
@@ -1764,12 +2164,12 @@ for (;; ptr++)
             goto FAILED;
             }
           ptr++;
-          code[3] = OP_CREF;
-          code[4] = condref >> 8;
-          code[5] = condref & 255;
+          code[1+LINK_SIZE] = OP_CREF;
+          PUT2(code, 2+LINK_SIZE, condref);
           skipbytes = 3;
           }
-        else ptr--;
+        /* For conditions that are assertions, we just fall through, having
+        set bravalue above. */
         break;
 
         case '=':                 /* Positive lookahead */
@@ -1794,10 +2194,6 @@ for (;; ptr++)
           bravalue = OP_ASSERTBACK_NOT;
           ptr++;
           break;
-
-          default:                /* Syntax error */
-          *errorptr = ERR24;
-          goto FAILED;
           }
         break;
 
@@ -1806,11 +2202,145 @@ for (;; ptr++)
         ptr++;
         break;
 
+        case 'C':                 /* Callout - may be followed by digits */
+        *code++ = OP_CALLOUT;
+          {
+          int n = 0;
+          while ((cd->ctypes[*(++ptr)] & ctype_digit) != 0)
+            n = n * 10 + *ptr - '0';
+          if (n > 255)
+            {
+            *errorptr = ERR38;
+            goto FAILED;
+            }
+          *code++ = n;
+          }
+        previous = NULL;
+        continue;
+
+        case 'P':                 /* Named subpattern handling */
+        if (*(++ptr) == '<')      /* Definition */
+          {
+          int i, namelen;
+          const uschar *name = ++ptr;
+          uschar *slot = cd->name_table;
+
+          while (*ptr++ != '>');
+          namelen = ptr - name - 1;
+
+          for (i = 0; i < cd->names_found; i++)
+            {
+            int c = strncmp(name, slot+2, namelen);
+            if (c == 0)
+              {
+              *errorptr = ERR43;
+              goto FAILED;
+              }
+            if (c < 0)
+              {
+              memmove(slot + cd->name_entry_size, slot,
+                (cd->names_found - i) * cd->name_entry_size);
+              break;
+              }
+            slot += cd->name_entry_size;
+            }
+
+          PUT2(slot, 0, *brackets + 1);
+          memcpy(slot + 2, name, namelen);
+          slot[2+namelen] = 0;
+          cd->names_found++;
+          goto NUMBERED_GROUP;
+          }
+
+        if (*ptr == '=' || *ptr == '>')  /* Reference or recursion */
+          {
+          int i, namelen;
+          int type = *ptr++;
+          const uschar *name = ptr;
+          uschar *slot = cd->name_table;
+
+          while (*ptr != ')') ptr++;
+          namelen = ptr - name;
+
+          for (i = 0; i < cd->names_found; i++)
+            {
+            if (strncmp(name, slot+2, namelen) == 0) break;
+            slot += cd->name_entry_size;
+            }
+          if (i >= cd->names_found)
+            {
+            *errorptr = ERR15;
+            goto FAILED;
+            }
+
+          recno = GET2(slot, 0);
+
+          if (type == '>') goto HANDLE_RECURSION;  /* A few lines below */
+
+          /* Back reference */
+
+          previous = code;
+          *code++ = OP_REF;
+          PUT2INC(code, 0, recno);
+          continue;
+          }
+
+        /* Should never happen */
+        break;
+
         case 'R':                 /* Pattern recursion */
-        *code++ = OP_RECURSE;
-        ptr++;
+        ptr++;                    /* Same as (?0)      */
+        /* Fall through */
+
+        /* Recursion or "subroutine" call */
+
+        case '0': case '1': case '2': case '3': case '4':
+        case '5': case '6': case '7': case '8': case '9':
+          {
+          const uschar *called;
+          recno = 0;
+
+          while ((cd->ctypes[*ptr] & ctype_digit) != 0)
+            recno = recno * 10 + *ptr++ - '0';
+
+          /* Come here from code above that handles a named recursion */
+
+          HANDLE_RECURSION:
+
+          previous = code;
+
+          /* Find the bracket that is being referenced. Temporarily end the
+          regex in case it doesn't exist. */
+
+          *code = OP_END;
+          called = (recno == 0)?
+            cd->start_code : find_bracket(cd->start_code, recno);
+          if (called == NULL)
+            {
+            *errorptr = ERR15;
+            goto FAILED;
+            }
+
+          /* If the subpattern is still open, this is a recursive call. We
+          check to see if this is a left recursion that could loop for ever,
+          and diagnose that case. */
+
+          if (GET(called, 1) == 0 && could_be_empty(called, code, bcptr))
+            {
+            *errorptr = ERR40;
+            goto FAILED;
+            }
+
+          /* Insert the recursion/subroutine item */
+
+          *code = OP_RECURSE;
+          PUT(code, 1, called - cd->start_code);
+          code += 1 + LINK_SIZE;
+          }
         continue;
 
+        /* Character after (? not specially recognized */
+
         default:                  /* Option setting */
         set = unset = 0;
         optset = &set;
@@ -1827,10 +2357,6 @@ for (;; ptr++)
             case 'x': *optset |= PCRE_EXTENDED; break;
             case 'U': *optset |= PCRE_UNGREEDY; break;
             case 'X': *optset |= PCRE_EXTRA; break;
-
-            default:
-            *errorptr = ERR12;
-            goto FAILED;
             }
           }
 
@@ -1839,23 +2365,33 @@ for (;; ptr++)
         newoptions = (options | set) & (~unset);
 
         /* If the options ended with ')' this is not the start of a nested
-        group with option changes, so the options change at this level. At top
-        level there is nothing else to be done (the options will in fact have
-        been set from the start of compiling as a result of the first pass) but
-        at an inner level we must compile code to change the ims options if
-        necessary, and pass the new setting back so that it can be put at the
-        start of any following branches, and when this group ends, a resetting
-        item can be compiled. */
+        group with option changes, so the options change at this level. Compile
+        code to change the ims options if this setting actually changes any of
+        them. We also pass the new setting back so that it can be put at the
+        start of any following branches, and when this group ends (if we are in
+        a group), a resetting item can be compiled.
+
+        Note that if this item is right at the start of the pattern, the
+        options will have been abstracted and made global, so there will be no
+        change to compile. */
 
         if (*ptr == ')')
           {
-          if ((options & PCRE_INGROUP) != 0 &&
-              (options & PCRE_IMS) != (newoptions & PCRE_IMS))
+          if ((options & PCRE_IMS) != (newoptions & PCRE_IMS))
             {
             *code++ = OP_OPT;
-            *code++ = *optchanged = newoptions & PCRE_IMS;
+            *code++ = newoptions & PCRE_IMS;
             }
-          options = newoptions;  /* Change options at this level */
+
+          /* Change options at this level, and pass them back for use
+          in subsequent branches. Reset the greedy defaults and the case
+          value for firstchar and reqchar. */
+
+          *optionsptr = options = newoptions;
+          greedy_default = ((newoptions & PCRE_UNGREEDY) != 0);
+          greedy_non_default = greedy_default ^ 1;
+          req_caseopt = ((options & PCRE_CASELESS) != 0)? REQ_CASELESS : 0;
+
           previous = NULL;       /* This item can't be repeated */
           continue;              /* It is complete */
           }
@@ -1876,12 +2412,12 @@ for (;; ptr++)
 
     else
       {
+      NUMBERED_GROUP:
       if (++(*brackets) > EXTRACT_BASIC_MAX)
         {
         bravalue = OP_BRA + EXTRACT_BASIC_MAX + 1;
-        code[3] = OP_BRANUMBER;
-        code[4] = *brackets >> 8;
-        code[5] = *brackets & 255;
+        code[1+LINK_SIZE] = OP_BRANUMBER;
+        PUT2(code, 2+LINK_SIZE, *brackets);
         skipbytes = 3;
         }
       else bravalue = OP_BRA + *brackets;
@@ -1897,9 +2433,8 @@ for (;; ptr++)
     tempcode = code;
 
     if (!compile_regex(
-         options | PCRE_INGROUP,       /* Set for all nested groups */
-         ((options & PCRE_IMS) != (newoptions & PCRE_IMS))?
-           newoptions & PCRE_IMS : -1, /* Pass ims options if changed */
+         newoptions,                   /* The complete new option state */
+         options & PCRE_IMS,           /* The previous ims option state */
          brackets,                     /* Extracting bracket count */
          &tempcode,                    /* Where to put code (updated) */
          &ptr,                         /* Input pointer (updated) */
@@ -1907,8 +2442,9 @@ for (;; ptr++)
          (bravalue == OP_ASSERTBACK ||
           bravalue == OP_ASSERTBACK_NOT), /* TRUE if back assert */
          skipbytes,                    /* Skip over OP_COND/OP_BRANUMBER */
+         &subfirstchar,                /* For possible first char */
          &subreqchar,                  /* For possible last char */
-         &subcountlits,                /* For literal count */
+         bcptr,                        /* Current branch chain */
          cd))                          /* Tables block */
       goto FAILED;
 
@@ -1927,7 +2463,7 @@ for (;; ptr++)
 
       do {
          condcount++;
-         tc += (tc[1] << 8) | tc[2];
+         tc += GET(tc,1);
          }
       while (*tc != OP_KET);
 
@@ -1936,25 +2472,63 @@ for (;; ptr++)
         *errorptr = ERR27;
         goto FAILED;
         }
+
+      /* If there is just one branch, we must not make use of its firstchar or
+      reqchar, because this is equivalent to an empty second branch. */
+
+      if (condcount == 1) subfirstchar = subreqchar = REQ_NONE;
       }
 
-    /* Handle updating of the required character. If the subpattern didn't
-    set one, leave it as it was. Otherwise, update it for normal brackets of
-    all kinds, forward assertions, and conditions with two branches. Don't
-    update the literal count for forward assertions, however. If the bracket
-    is followed by a quantifier with zero repeat, we have to back off. Hence
-    the definition of prevreqchar and subcountlits outside the main loop so
-    that they can be accessed for the back off. */
-
-    if (subreqchar > 0 &&
-         (bravalue >= OP_BRA || bravalue == OP_ONCE || bravalue == OP_ASSERT ||
-         (bravalue == OP_COND && condcount == 2)))
+    /* Handle updating of the required and first characters. Update for normal
+    brackets of all kinds, and conditions with two branches (see code above).
+    If the bracket is followed by a quantifier with zero repeat, we have to
+    back off. Hence the definition of zeroreqchar and zerofirstchar outside the
+    main loop so that they can be accessed for the back off. */
+
+    zeroreqchar = reqchar;
+    zerofirstchar = firstchar;
+    groupsetfirstchar = FALSE;
+
+    if (bravalue >= OP_BRA || bravalue == OP_ONCE || bravalue == OP_COND)
       {
-      prevreqchar = *reqchar;
-      *reqchar = subreqchar;
-      if (bravalue != OP_ASSERT) *countlits += subcountlits;
+      /* If we have not yet set a firstchar in this branch, take it from the
+      subpattern, remembering that it was set here so that a repeat of more
+      than one can replicate it as reqchar if necessary. If the subpattern has
+      no firstchar, set "none" for the whole branch. In both cases, a zero
+      repeat forces firstchar to "none". */
+
+      if (firstchar == REQ_UNSET)
+        {
+        if (subfirstchar >= 0)
+          {
+          firstchar = subfirstchar;
+          groupsetfirstchar = TRUE;
+          }
+        else firstchar = REQ_NONE;
+        zerofirstchar = REQ_NONE;
+        }
+
+      /* If firstchar was previously set, convert the subpattern's firstchar
+      into reqchar if there wasn't one. */
+
+      else if (subfirstchar >= 0 && subreqchar < 0) subreqchar = subfirstchar;
+
+      /* If the subpattern set a required char (or set a first char that isn't
+      really the first char - see above), set it. */
+
+      if (subreqchar >= 0) reqchar = subreqchar;
       }
 
+    /* For a forward assertion, we take the reqchar, if set. This can be
+    helpful if the pattern that follows the assertion doesn't set a different
+    char. For example, it's useful for /(?=abcde).+/. We can't set firstchar
+    for an assertion, however because it leads to incorrect effect for patterns
+    such as /(?=a)a.+/ when the "real" "a" would then become a reqchar instead
+    of a firstchar. This is overcome by a scan at the end if there's no
+    firstchar, looking for an asserted first char. */
+
+    else if (bravalue == OP_ASSERT && subreqchar >= 0) reqchar = subreqchar;
+
     /* Now update the main code pointer to the end of the group. */
 
     code = tempcode;
@@ -1985,13 +2559,32 @@ for (;; ptr++)
 
     if (c < 0)
       {
+      if (-c == ESC_Q)            /* Handle start of quoted string */
+        {
+        if (ptr[1] == '\\' && ptr[2] == 'E') ptr += 2; /* avoid empty string */
+          else inescq = TRUE;
+        continue;
+        }
+
+      /* For metasequences that actually match a character, we disable the
+      setting of a first character if it hasn't already been set. */
+
+      if (firstchar == REQ_UNSET && -c > ESC_b && -c < ESC_Z)
+        firstchar = REQ_NONE;
+
+      /* Set values to reset to if this is followed by a zero repeat. */
+
+      zerofirstchar = firstchar;
+      zeroreqchar = reqchar;
+
+      /* Back references are handled specially */
+
       if (-c >= ESC_REF)
         {
         int number = -c - ESC_REF;
         previous = code;
         *code++ = OP_REF;
-        *code++ = number >> 8;
-        *code++ = number & 255;
+        PUT2INC(code, 0, number);
         }
       else
         {
@@ -2019,6 +2612,25 @@ for (;; ptr++)
 
     do
       {
+      /* If in \Q...\E, check for the end; if not, we always have a literal */
+
+      if (inescq)
+        {
+        if (c == '\\' && ptr[1] == 'E')
+          {
+          inescq = FALSE;
+          ptr++;
+          }
+        else
+          {
+          *code++ = c;
+          length++;
+          }
+        continue;
+        }
+
+      /* Skip white space and comments for /x patterns */
+
       if ((options & PCRE_EXTENDED) != 0)
         {
         if ((cd->ctypes[c] & ctype_space) != 0) continue;
@@ -2067,14 +2679,31 @@ for (;; ptr++)
 
     while (length < MAXLIT && (cd->ctypes[c = *(++ptr)] & ctype_meta) == 0);
 
-    /* Update the last character and the count of literals */
+    /* Update the first and last character */
 
-    prevreqchar = (length > 1)? code[-2] : *reqchar;
-    *reqchar = code[-1];
-    *countlits += length;
+    if (firstchar == REQ_UNSET)
+      {
+      if (length > 1)
+        {
+        zerofirstchar = firstchar = previous[2] | req_caseopt;
+        zeroreqchar = (length > 2)? (code[-2] | req_caseopt) : reqchar;
+        reqchar = code[-1] | req_caseopt;
+        }
+      else
+        {
+        zerofirstchar = REQ_NONE;
+        firstchar = code[-1] | req_caseopt;
+        zeroreqchar = reqchar;
+        }
+      }
+    else   /* firstchar previously set */
+      {
+      zerofirstchar = firstchar;
+      zeroreqchar = (length > 1)? (code[-2] | req_caseopt) : reqchar;
+      reqchar = code[-1] | req_caseopt;
+      }
 
-    /* Compute the length and set it in the data vector, and advance to
-    the next state. */
+    /* Set the length in the data vector, and advance to the next state. */
 
     previous[1] = length;
     if (length < MAXLIT) ptr--;
@@ -2107,52 +2736,56 @@ following branch to ensure they get set correctly at run time, and also pass
 the new options into every subsequent branch compile.
 
 Argument:
-  options     the option bits
-  optchanged  new ims options to set as if (?ims) were at the start, or -1
-               for no change
-  brackets    -> int containing the number of extracting brackets used
-  codeptr     -> the address of the current code pointer
-  ptrptr      -> the address of the current pattern pointer
-  errorptr    -> pointer to error message
-  lookbehind  TRUE if this is a lookbehind assertion
-  skipbytes   skip this many bytes at start (for OP_COND, OP_BRANUMBER)
-  reqchar     -> place to put the last required character, or a negative number
-  countlits   -> place to put the shortest literal count of any branch
-  cd          points to the data block with tables pointers
+  options        option bits, including any changes for this subpattern
+  oldims         previous settings of ims option bits
+  brackets       -> int containing the number of extracting brackets used
+  codeptr        -> the address of the current code pointer
+  ptrptr         -> the address of the current pattern pointer
+  errorptr       -> pointer to error message
+  lookbehind     TRUE if this is a lookbehind assertion
+  skipbytes      skip this many bytes at start (for OP_COND, OP_BRANUMBER)
+  firstcharptr   place to put the first required character, or a negative number
+  reqcharptr     place to put the last required character, or a negative number
+  bcptr          pointer to the chain of currently open branches
+  cd             points to the data block with tables pointers etc.
 
 Returns:      TRUE on success
 */
 
 static BOOL
-compile_regex(int options, int optchanged, int *brackets, uschar **codeptr,
+compile_regex(int options, int oldims, int *brackets, uschar **codeptr,
   const uschar **ptrptr, const char **errorptr, BOOL lookbehind, int skipbytes,
-  int *reqchar, int *countlits, compile_data *cd)
+  int *firstcharptr, int *reqcharptr, branch_chain *bcptr, compile_data *cd)
 {
 const uschar *ptr = *ptrptr;
 uschar *code = *codeptr;
 uschar *last_branch = code;
 uschar *start_bracket = code;
 uschar *reverse_count = NULL;
-int oldoptions = options & PCRE_IMS;
-int branchreqchar, branchcountlits;
+int firstchar, reqchar;
+int branchfirstchar, branchreqchar;
+branch_chain bc;
+
+bc.outer = bcptr;
+bc.current = code;
+
+firstchar = reqchar = REQ_UNSET;
 
-*reqchar = -1;
-*countlits = INT_MAX;
-code += 3 + skipbytes;
+/* Offset is set zero to mark that this bracket is still open */
+
+PUT(code, 1, 0);
+code += 1 + LINK_SIZE + skipbytes;
 
 /* Loop for each alternative branch */
 
 for (;;)
   {
-  int length;
-
-  /* Handle change of options */
+  /* Handle a change of ims options at the start of the branch */
 
-  if (optchanged >= 0)
+  if ((options & PCRE_IMS) != oldims)
     {
     *code++ = OP_OPT;
-    *code++ = optchanged;
-    options = (options & ~PCRE_IMS) | optchanged;
+    *code++ = options & PCRE_IMS;
     }
 
   /* Set up dummy OP_REVERSE if lookbehind assertion */
@@ -2161,43 +2794,52 @@ for (;;)
     {
     *code++ = OP_REVERSE;
     reverse_count = code;
-    *code++ = 0;
-    *code++ = 0;
+    PUTINC(code, 0, 0);
     }
 
   /* Now compile the branch */
 
-  if (!compile_branch(options, brackets, &code, &ptr, errorptr, &optchanged,
-      &branchreqchar, &branchcountlits, cd))
+  if (!compile_branch(&options, brackets, &code, &ptr, errorptr,
+        &branchfirstchar, &branchreqchar, &bc, cd))
     {
     *ptrptr = ptr;
     return FALSE;
     }
 
-  /* Fill in the length of the last branch */
+  /* If this is the first branch, the firstchar and reqchar values for the
+  branch become the values for the regex. */
 
-  length = code - last_branch;
-  last_branch[1] = length >> 8;
-  last_branch[2] = length & 255;
+  if (*last_branch != OP_ALT)
+    {
+    firstchar = branchfirstchar;
+    reqchar = branchreqchar;
+    }
 
-  /* Save the last required character if all branches have the same; a current
-  value of -1 means unset, while -2 means "previous branch had no last required
-  char".  */
+  /* If this is not the first branch, the first char and reqchar have to
+  match the values from all the previous branches. */
 
-  if (*reqchar != -2)
+  else
     {
-    if (branchreqchar >= 0)
+    /* If we previously had a firstchar, but it doesn't match the new branch,
+    we have to abandon the firstchar for the regex, but if there was previously
+    no reqchar, it takes on the value of the old firstchar. */
+
+    if (firstchar >= 0 && firstchar != branchfirstchar)
       {
-      if (*reqchar == -1) *reqchar = branchreqchar;
-      else if (*reqchar != branchreqchar) *reqchar = -2;
+      if (reqchar < 0) reqchar = firstchar;
+      firstchar = REQ_NONE;
       }
-    else *reqchar = -2;
-    }
 
-  /* Keep the shortest literal count */
+    /* If we (now or from before) have no firstchar, a firstchar from the
+    branch becomes a reqchar if there isn't a branch reqchar. */
+
+    if (firstchar < 0 && branchfirstchar >= 0 && branchreqchar < 0)
+        branchreqchar = branchfirstchar;
+
+    /* Now ensure that the reqchars match */
 
-  if (branchcountlits < *countlits) *countlits = branchcountlits;
-  DPRINTF(("literal count = %d min=%d\n", branchcountlits, *countlits));
+    if (reqchar != branchreqchar) reqchar = REQ_NONE;
+    }
 
   /* If lookbehind, check that this branch matches a fixed-length string,
   and put the length into the OP_REVERSE item. Temporarily mark the end of
@@ -2205,110 +2847,73 @@ for (;;)
 
   if (lookbehind)
     {
+    int length;
     *code = OP_END;
     length = find_fixedlength(last_branch, options);
     DPRINTF(("fixed length = %d\n", length));
     if (length < 0)
       {
-      *errorptr = ERR25;
+      *errorptr = (length == -2)? ERR36 : ERR25;
       *ptrptr = ptr;
       return FALSE;
       }
-    reverse_count[0] = (length >> 8);
-    reverse_count[1] = length & 255;
+    PUT(reverse_count, 0, length);
     }
 
-  /* Reached end of expression, either ')' or end of pattern. Insert a
-  terminating ket and the length of the whole bracketed item, and return,
-  leaving the pointer at the terminating char. If any of the ims options
-  were changed inside the group, compile a resetting op-code following. */
+  /* Reached end of expression, either ')' or end of pattern. Go back through
+  the alternative branches and reverse the chain of offsets, with the field in
+  the BRA item now becoming an offset to the first alternative. If there are
+  no alternatives, it points to the end of the group. The length in the
+  terminating ket is always the length of the whole bracketed item. If any of
+  the ims options were changed inside the group, compile a resetting op-code
+  following, except at the very end of the pattern. Return leaving the pointer
+  at the terminating char. */
 
   if (*ptr != '|')
     {
-    length = code - start_bracket;
-    *code++ = OP_KET;
-    *code++ = length >> 8;
-    *code++ = length & 255;
-    if (optchanged >= 0)
+    int length = code - last_branch;
+    do
       {
-      *code++ = OP_OPT;
-      *code++ = oldoptions;
+      int prev_length = GET(last_branch, 1);
+      PUT(last_branch, 1, length);
+      length = prev_length;
+      last_branch -= length;
       }
-    *codeptr = code;
-    *ptrptr = ptr;
-    return TRUE;
-    }
+    while (length > 0);
 
-  /* Another branch follows; insert an "or" node and advance the pointer. */
-
-  *code = OP_ALT;
-  last_branch = code;
-  code += 3;
-  ptr++;
-  }
-/* Control never reaches here */
-}
+    /* Fill in the ket */
 
+    *code = OP_KET;
+    PUT(code, 1, code - start_bracket);
+    code += 1 + LINK_SIZE;
 
+    /* Resetting option if needed */
 
-
-/*************************************************
-*      Find first significant op code            *
-*************************************************/
-
-/* This is called by several functions that scan a compiled expression looking
-for a fixed first character, or an anchoring op code etc. It skips over things
-that do not influence this. For one application, a change of caseless option is
-important.
-
-Arguments:
-  code       pointer to the start of the group
-  options    pointer to external options
-  optbit     the option bit whose changing is significant, or
-             zero if none are
-  optstop    TRUE to return on option change, otherwise change the options
-               value and continue
-
-Returns:     pointer to the first significant opcode
-*/
-
-static const uschar*
-first_significant_code(const uschar *code, int *options, int optbit,
-  BOOL optstop)
-{
-for (;;)
-  {
-  switch ((int)*code)
-    {
-    case OP_OPT:
-    if (optbit > 0 && ((int)code[1] & optbit) != (*options & optbit))
+    if ((options & PCRE_IMS) != oldims && *ptr == ')')
       {
-      if (optstop) return code;
-      *options = (int)code[1];
+      *code++ = OP_OPT;
+      *code++ = oldims;
       }
-    code += 2;
-    break;
 
-    case OP_CREF:
-    case OP_BRANUMBER:
-    code += 3;
-    break;
+    /* Set values to pass back */
 
-    case OP_WORD_BOUNDARY:
-    case OP_NOT_WORD_BOUNDARY:
-    code++;
-    break;
+    *codeptr = code;
+    *ptrptr = ptr;
+    *firstcharptr = firstchar;
+    *reqcharptr = reqchar;
+    return TRUE;
+    }
 
-    case OP_ASSERT_NOT:
-    case OP_ASSERTBACK:
-    case OP_ASSERTBACK_NOT:
-    do code += (code[1] << 8) + code[2]; while (*code == OP_ALT);
-    code += 3;
-    break;
+  /* Another branch follows; insert an "or" node. Its length field points back
+  to the previous branch while the bracket remains open. At the end the chain
+  is reversed. It's done like this so that the start of the bracket has a
+  zero offset until it is closed, making it possible to detect recursion. */
 
-    default:
-    return code;
-    }
+  *code = OP_ALT;
+  PUT(code, 1, code - last_branch);
+  bc.current = last_branch = code;
+  code += 1 + LINK_SIZE;
+  ptr++;
   }
 /* Control never reaches here */
 }
@@ -2328,33 +2933,64 @@ counts, since OP_CIRC can match in the middle.
 
 A branch is also implicitly anchored if it starts with .* and DOTALL is set,
 because that will try the rest of the pattern at all possible matching points,
-so there is no point trying them again.
+so there is no point trying again.... er ....
+
+.... except when the .* appears inside capturing parentheses, and there is a
+subsequent back reference to those parentheses. We haven't enough information
+to catch that case precisely. The best we can do is to detect when .* is in
+capturing brackets and the highest back reference is greater than or equal to
+that level.
 
 Arguments:
-  code       points to start of expression (the bracket)
-  options    points to the options setting
+  code           points to start of expression (the bracket)
+  options        points to the options setting
+  in_brackets    TRUE if inside capturing parentheses
+  top_backref    the highest back reference in the regex
 
 Returns:     TRUE or FALSE
 */
 
 static BOOL
-is_anchored(register const uschar *code, int *options)
+is_anchored(register const uschar *code, int *options, BOOL in_brackets,
+  int top_backref)
 {
 do {
-   const uschar *scode = first_significant_code(code + 3, options,
-     PCRE_MULTILINE, FALSE);
+   const uschar *scode =
+     first_significant_code(code + 1+LINK_SIZE, options, PCRE_MULTILINE);
    register int op = *scode;
-   if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
-     { if (!is_anchored(scode, options)) return FALSE; }
+
+   /* Capturing brackets */
+
+   if (op > OP_BRA)
+     {
+     if (!is_anchored(scode, options, TRUE, top_backref)) return FALSE;
+     }
+
+   /* Other brackets */
+
+   else if (op == OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
+     {
+     if (!is_anchored(scode, options, in_brackets, top_backref))
+       return FALSE;
+     }
+
+   /* .* is not anchored unless DOTALL is set and it isn't in brackets that
+   may be referenced. */
+
    else if ((op == OP_TYPESTAR || op == OP_TYPEMINSTAR) &&
             (*options & PCRE_DOTALL) != 0)
-     { if (scode[1] != OP_ANY) return FALSE; }
+     {
+     if (scode[1] != OP_ANY || (in_brackets && top_backref > 0)) return FALSE;
+     }
+
+   /* Check for explicit anchoring */
+
    else if (op != OP_SOD &&
            ((*options & PCRE_MULTILINE) != 0 || op != OP_CIRC))
      return FALSE;
-   code += (code[1] << 8) + code[2];
+   code += GET(code, 1);
    }
-while (*code == OP_ALT);
+while (*code == OP_ALT);   /* Loop for each alternative */
 return TRUE;
 }
 
@@ -2367,56 +3003,82 @@ return TRUE;
 /* This is called to find out if every branch starts with ^ or .* so that
 "first char" processing can be done to speed things up in multiline
 matching and for non-DOTALL patterns that start with .* (which must start at
-the beginning or after \n).
+the beginning or after \n). As in the case of is_anchored() (see above), we
+have to take account of back references to capturing brackets that contain .*
+because in that case we can't make the assumption.
 
-Argument:  points to start of expression (the bracket)
-Returns:   TRUE or FALSE
+Arguments:
+  code           points to start of expression (the bracket)
+  in_brackets    TRUE if inside capturing parentheses
+  top_backref    the highest back reference in the regex
+
+Returns:         TRUE or FALSE
 */
 
 static BOOL
-is_startline(const uschar *code)
+is_startline(const uschar *code, BOOL in_brackets, int top_backref)
 {
 do {
-   const uschar *scode = first_significant_code(code + 3, NULL, 0, FALSE);
+   const uschar *scode = first_significant_code(code + 1+LINK_SIZE, NULL, 0);
    register int op = *scode;
-   if (op >= OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
-     { if (!is_startline(scode)) return FALSE; }
+
+   /* Capturing brackets */
+
+   if (op > OP_BRA)
+     { if (!is_startline(scode, TRUE, top_backref)) return FALSE; }
+
+   /* Other brackets */
+
+   else if (op == OP_BRA || op == OP_ASSERT || op == OP_ONCE || op == OP_COND)
+     { if (!is_startline(scode, in_brackets, top_backref)) return FALSE; }
+
+   /* .* is not anchored unless DOTALL is set and it isn't in brackets that
+   may be referenced. */
+
    else if (op == OP_TYPESTAR || op == OP_TYPEMINSTAR)
-     { if (scode[1] != OP_ANY) return FALSE; }
+     {
+     if (scode[1] != OP_ANY || (in_brackets && top_backref > 0)) return FALSE;
+     }
+
+   /* Check for explicit circumflex */
+
    else if (op != OP_CIRC) return FALSE;
-   code += (code[1] << 8) + code[2];
+   code += GET(code, 1);
    }
-while (*code == OP_ALT);
+while (*code == OP_ALT);  /* Loop for each alternative */
 return TRUE;
 }
 
 
 
 /*************************************************
-*          Check for fixed first char            *
+*       Check for asserted fixed first char      *
 *************************************************/
 
-/* Try to find out if there is a fixed first character. This is called for
-unanchored expressions, as it speeds up their processing quite considerably.
-Consider each alternative branch. If they all start with the same char, or with
-a bracket all of whose alternatives start with the same char (recurse ad lib),
-then we return that char, otherwise -1.
+/* During compilation, the "first char" settings from forward assertions are
+discarded, because they can cause conflicts with actual literals that follow.
+However, if we end up without a first char setting for an unanchored pattern,
+it is worth scanning the regex to see if there is an initial asserted first
+char. If all branches start with the same asserted char, or with a bracket all
+of whose alternatives start with the same asserted char (recurse ad lib), then
+we return that char, otherwise -1.
 
 Arguments:
   code       points to start of expression (the bracket)
   options    pointer to the options (used to check casing changes)
+  inassert   TRUE if in an assertion
 
 Returns:     -1 or the fixed first char
 */
 
 static int
-find_firstchar(const uschar *code, int *options)
+find_firstassertedchar(const uschar *code, int *options, BOOL inassert)
 {
 register int c = -1;
 do {
    int d;
-   const uschar *scode = first_significant_code(code + 3, options,
-     PCRE_CASELESS, TRUE);
+   const uschar *scode =
+     first_significant_code(code + 1+LINK_SIZE, options, PCRE_CASELESS);
    register int op = *scode;
 
    if (op >= OP_BRA) op = OP_BRA;
@@ -2430,7 +3092,8 @@ do {
      case OP_ASSERT:
      case OP_ONCE:
      case OP_COND:
-     if ((d = find_firstchar(scode, options)) < 0) return -1;
+     if ((d = find_firstassertedchar(scode, options, op == OP_ASSERT)) < 0)
+       return -1;
      if (c < 0) c = d; else if (c != d) return -1;
      break;
 
@@ -2442,11 +3105,17 @@ do {
 
      case OP_PLUS:
      case OP_MINPLUS:
-     if (c < 0) c = scode[1]; else if (c != scode[1]) return -1;
+     if (!inassert) return -1;
+     if (c < 0)
+       {
+       c = scode[1];
+       if ((*options & PCRE_CASELESS) != 0) c |= REQ_CASELESS;
+       }
+     else if (c != scode[1]) return -1;
      break;
      }
 
-   code += (code[1] << 8) + code[2];
+   code += GET(code, 1);
    }
 while (*code == OP_ALT);
 return c;
@@ -2455,7 +3124,6 @@ return c;
 
 
 
-
 /*************************************************
 *        Compile a Regular Expression            *
 *************************************************/
@@ -2479,25 +3147,26 @@ pcre_compile(const char *pattern, int options, const char **errorptr,
   int *erroroffset, const unsigned char *tables)
 {
 real_pcre *re;
-int length = 3;      /* For initial BRA plus length */
+int length = 1 + LINK_SIZE;      /* For initial BRA plus length */
 int runlength;
-int c, reqchar, countlits;
+int c, firstchar, reqchar;
 int bracount = 0;
 int top_backref = 0;
 int branch_extra = 0;
 int branch_newextra;
+int item_count = -1;
+int name_count = 0;
+int max_name_size = 0;
+BOOL inescq = FALSE;
 unsigned int brastackptr = 0;
 size_t size;
 uschar *code;
+const uschar *codestart;
 const uschar *ptr;
 compile_data compile_block;
 int brastack[BRASTACK_SIZE];
 uschar bralenstack[BRASTACK_SIZE];
 
-#ifdef DEBUG
-uschar *code_base, *code_end;
-#endif
-
 /* Can't support UTF8 unless PCRE has been compiled to include the code. */
 
 #ifndef SUPPORT_UTF8
@@ -2545,9 +3214,9 @@ DPRINTF(("%s\n", pattern));
 /* The first thing to do is to make a pass over the pattern to compute the
 amount of store required to hold the compiled code. This does not have to be
 perfect as long as errors are overestimates. At the same time we can detect any
-internal flag settings. Make an attempt to correct for any counted white space
-if an "extended" flag setting appears late in the pattern. We can't be so
-clever for #-comments. */
+flag settings right at the start, and extract them. Make an attempt to correct
+for any counted white space if an "extended" flag setting appears late in the
+pattern. We can't be so clever for #-comments. */
 
 ptr = (const uschar *)(pattern - 1);
 while ((c = *(++ptr)) != 0)
@@ -2555,6 +3224,13 @@ while ((c = *(++ptr)) != 0)
   int min, max;
   int class_charcount;
   int bracket_length;
+  int duplength;
+
+  /* If we are inside a \Q...\E sequence, all chars are literal */
+
+  if (inescq) goto NORMAL_CHAR;
+
+  /* Otherwise, first check for ignored whitespace and comments */
 
   if ((options & PCRE_EXTENDED) != 0)
     {
@@ -2564,10 +3240,13 @@ while ((c = *(++ptr)) != 0)
       /* The space before the ; is to avoid a warning on a silly compiler
       on the Macintosh. */
       while ((c = *(++ptr)) != 0 && c != NEWLINE) ;
+      if (c == 0) break;
       continue;
       }
     }
 
+  item_count++;    /* Is zero for the first non-comment item */
+
   switch(c)
     {
     /* A backslashed item may be an escaped "normal" character or a
@@ -2587,6 +3266,17 @@ while ((c = *(++ptr)) != 0)
         goto NORMAL_CHAR;
         }
       }
+
+    /* If \Q, enter "literal" mode */
+
+    if (-c == ESC_Q)
+      {
+      inescq = TRUE;
+      continue;
+      }
+
+    /* Other escapes need one byte */
+
     length++;
 
     /* A back reference needs an additional 2 bytes, plus either one or 5
@@ -2611,12 +3301,19 @@ while ((c = *(++ptr)) != 0)
       }
     continue;
 
-    case '^':
+    case '*':            /* These repeats won't be after brackets; */
+    case '+':            /* those are handled separately */
+    case '?':
+    if (ptr[1] == '+')   /* Handle "possessive quantifier" */
+      {
+      length += 2 + 2*LINK_SIZE;
+      ptr++;
+      }
+    /* Fall through */
+
+    case '^':     /* Single-byte metacharacters */
     case '.':
     case '$':
-    case '*':     /* These repeats won't be after brackets; */
-    case '+':     /* those are handled separately */
-    case '?':
     length++;
     continue;
 
@@ -2636,7 +3333,12 @@ while ((c = *(++ptr)) != 0)
       if (min == 1) length++; else if (min > 0) length += 4;
       if (max > 0) length += 4; else length += 2;
       }
-    if (ptr[1] == '?') ptr++;
+    if (ptr[1] == '?') ptr++;                   /* Needs no extra length */
+    if (ptr[1] == '+')                          /* Possessive quantifier */
+      {
+      ptr++;
+      length += 2 + 2*LINK_SIZE;              /* Allow for atomic brackets */
+      }
     continue;
 
     /* An alternation contains an offset to the next branch or ket. If any ims
@@ -2645,7 +3347,7 @@ while ((c = *(++ptr)) != 0)
     branch. This is handled by branch_extra. */
 
     case '|':
-    length += 3 + branch_extra;
+    length += 1 + LINK_SIZE + branch_extra;
     continue;
 
     /* A character class uses 33 characters. Don't worry about character types
@@ -2656,7 +3358,10 @@ while ((c = *(++ptr)) != 0)
     case '[':
     class_charcount = 0;
     if (*(++ptr) == '^') ptr++;
-    do
+
+    /* Written as a "do" so that an initial ']' is taken as data */
+
+    if (*ptr != 0) do
       {
       if (*ptr == '\\')
         {
@@ -2665,10 +3370,27 @@ while ((c = *(++ptr)) != 0)
         if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
         if (-ch == ESC_b) class_charcount++; else class_charcount = 10;
         }
+
+      /* Check the syntax for POSIX stuff. The bits we actually handle are
+      checked during the real compile phase. */
+
+      else if (*ptr == '[' && check_posix_syntax(ptr, &ptr, &compile_block))
+        {
+        ptr++;
+        class_charcount = 10;    /* Make sure > 1 */
+        }
+
+      /* Anything else just counts as one char */
+
       else class_charcount++;
-      ptr++;
       }
-    while (*ptr != 0 && *ptr != ']');
+    while (*(++ptr) != 0 && *ptr != ']');   /* Concludes "do" above */
+
+    if (*ptr == 0)                          /* Missing terminating ']' */
+      {
+      *errorptr = ERR6;
+      goto PCRE_ERROR_RETURN;
+      }
 
     /* Repeats for negated single chars are handled by the general code */
 
@@ -2695,7 +3417,7 @@ while ((c = *(++ptr)) != 0)
 
     case '(':
     branch_newextra = 0;
-    bracket_length = 3;
+    bracket_length = 1 + LINK_SIZE;
 
     /* Handle special forms of bracket, which all start (? */
 
@@ -2729,27 +3451,98 @@ while ((c = *(++ptr)) != 0)
         ptr += 2;
         break;
 
-        /* A recursive call to the regex is an extension, to provide the
-        facility which can be obtained by $(?p{perl-code}) in Perl 5.6. */
+        /* (?R) specifies a recursive call to the regex, which is an extension
+        to provide the facility which can be obtained by (?p{perl-code}) in
+        Perl 5.6. In Perl 5.8 this has become (??{perl-code}).
+
+        From PCRE 4.00, items such as (?3) specify subroutine-like "calls" to
+        the appropriate numbered brackets. This includes both recursive and
+        non-recursive calls. (?R) is now synonymous with (?0). */
 
         case 'R':
-        if (ptr[3] != ')')
+        ptr++;
+
+        case '0': case '1': case '2': case '3': case '4':
+        case '5': case '6': case '7': case '8': case '9':
+        ptr += 2;
+        if (c != 'R')
+          while ((compile_block.ctypes[*(++ptr)] & ctype_digit) != 0);
+        if (*ptr != ')')
           {
           *errorptr = ERR29;
           goto PCRE_ERROR_RETURN;
           }
+        length += 1 + LINK_SIZE;
+
+        /* If this item is quantified, it will get wrapped inside brackets so
+        as to use the code for quantified brackets. We jump down and use the
+        code that handles this for real brackets. */
+
+        if (ptr[1] == '+' || ptr[1] == '*' || ptr[1] == '?' || ptr[1] == '{')
+          {
+          length += 2 + 2 * LINK_SIZE;       /* to make bracketed */
+          duplength = 5 + 3 * LINK_SIZE;
+          goto HANDLE_QUANTIFIED_BRACKETS;
+          }
+        continue;
+
+        /* (?C) is an extension which provides "callout" - to provide a bit of
+        the functionality of the Perl (?{...}) feature. An optional number may
+        follow (default is zero). */
+
+        case 'C':
+        ptr += 2;
+        while ((compile_block.ctypes[*(++ptr)] & ctype_digit) != 0);
+        if (*ptr != ')')
+          {
+          *errorptr = ERR39;
+          goto PCRE_ERROR_RETURN;
+          }
+        length += 2;
+        continue;
+
+        /* Named subpatterns are an extension copied from Python */
+
+        case 'P':
         ptr += 3;
-        length += 1;
-        break;
+        if (*ptr == '<')
+          {
+          const uschar *p = ++ptr;
+          while ((compile_block.ctypes[*ptr] & ctype_word) != 0) ptr++;
+          if (*ptr != '>')
+            {
+            *errorptr = ERR42;
+            goto PCRE_ERROR_RETURN;
+            }
+          name_count++;
+          if (ptr - p > max_name_size) max_name_size = (ptr - p);
+          break;
+          }
+
+        if (*ptr == '=' || *ptr == '>')
+          {
+          while ((compile_block.ctypes[*(++ptr)] & ctype_word) != 0);
+          if (*ptr != ')')
+            {
+            *errorptr = ERR42;
+            goto PCRE_ERROR_RETURN;
+            }
+          break;
+          }
+
+        /* Unknown character after (?P */
+
+        *errorptr = ERR41;
+        goto PCRE_ERROR_RETURN;
 
         /* Lookbehinds are in Perl from version 5.005 */
 
         case '<':
-        if (ptr[3] == '=' || ptr[3] == '!')
+        ptr += 3;
+        if (*ptr == '=' || *ptr == '!')
           {
-          ptr += 3;
-          branch_newextra = 3;
-          length += 3;         /* For the first branch */
+          branch_newextra = 1 + LINK_SIZE;
+          length += 1 + LINK_SIZE;         /* For the first branch */
           break;
           }
         *errorptr = ERR24;
@@ -2757,10 +3550,15 @@ while ((c = *(++ptr)) != 0)
 
         /* Conditionals are in Perl from version 5.005. The bracket must either
         be followed by a number (for bracket reference) or by an assertion
-        group. */
+        group, or (a PCRE extension) by 'R' for a recursion test. */
 
         case '(':
-        if ((compile_block.ctypes[ptr[3]] & ctype_digit) != 0)
+        if (ptr[3] == 'R' && ptr[4] == ')')
+          {
+          ptr += 4;
+          length += 3;
+          }
+        else if ((compile_block.ctypes[ptr[3]] & ctype_digit) != 0)
           {
           ptr += 4;
           length += 3;
@@ -2827,17 +3625,27 @@ while ((c = *(++ptr)) != 0)
             optset = &unset;
             continue;
 
-            /* A termination by ')' indicates an options-setting-only item;
-            this is global at top level; otherwise nothing is done here and
-            it is handled during the compiling process on a per-bracket-group
-            basis. */
+            /* A termination by ')' indicates an options-setting-only item; if
+            this is at the very start of the pattern (indicated by item_count
+            being zero), we use it to set the global options. This is helpful
+            when analyzing the pattern for first characters, etc. Otherwise
+            nothing is done here and it is handled during the compiling
+            process.
+
+            [Historical note: Up to Perl 5.8, options settings at top level
+            were always global settings, wherever they appeared in the pattern.
+            That is, they were equivalent to an external setting. From 5.8
+            onwards, they apply only to what follows (which is what you might
+            expect).] */
 
             case ')':
-            if (brastackptr == 0)
+            if (item_count == 0)
               {
               options = (options | set) & (~unset);
               set = unset = 0;     /* To save length */
+              item_count--;        /* To allow for several */
               }
+
             /* Fall through */
 
             /* A termination by ':' indicates the start of a nested group with
@@ -2879,7 +3687,8 @@ while ((c = *(++ptr)) != 0)
         END_OPTIONS:
         if (c == ')')
           {
-          if (branch_newextra == 2 && (branch_extra == 0 || branch_extra == 3))
+          if (branch_newextra == 2 &&
+              (branch_extra == 0 || branch_extra == 1+LINK_SIZE))
             branch_extra += branch_newextra;
           continue;
           }
@@ -2924,55 +3733,65 @@ while ((c = *(++ptr)) != 0)
     the branch_extra value. */
 
     case ')':
-    length += 3;
+    length += 1 + LINK_SIZE;
+    if (brastackptr > 0)
       {
-      int minval = 1;
-      int maxval = 1;
-      int duplength;
+      duplength = length - brastack[--brastackptr];
+      branch_extra = bralenstack[brastackptr];
+      }
+    else duplength = 0;
 
-      if (brastackptr > 0)
-        {
-        duplength = length - brastack[--brastackptr];
-        branch_extra = bralenstack[brastackptr];
-        }
-      else duplength = 0;
+    /* The following code is also used when a recursion such as (?3) is
+    followed by a quantifier, because in that case, it has to be wrapped inside
+    brackets so that the quantifier works. The value of duplength must be
+    set before arrival. */
 
-      /* Leave ptr at the final char; for read_repeat_counts this happens
-      automatically; for the others we need an increment. */
+    HANDLE_QUANTIFIED_BRACKETS:
 
-      if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
-        {
-        ptr = read_repeat_counts(ptr+2, &minval, &maxval, errorptr,
-          &compile_block);
-        if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
-        }
-      else if (c == '*') { minval = 0; maxval = -1; ptr++; }
-      else if (c == '+') { maxval = -1; ptr++; }
-      else if (c == '?') { minval = 0; ptr++; }
+    /* Leave ptr at the final char; for read_repeat_counts this happens
+    automatically; for the others we need an increment. */
+
+    if ((c = ptr[1]) == '{' && is_counted_repeat(ptr+2, &compile_block))
+      {
+      ptr = read_repeat_counts(ptr+2, &min, &max, errorptr, &compile_block);
+      if (*errorptr != NULL) goto PCRE_ERROR_RETURN;
+      }
+    else if (c == '*') { min = 0; max = -1; ptr++; }
+    else if (c == '+') { min = 1; max = -1; ptr++; }
+    else if (c == '?') { min = 0; max = 1;  ptr++; }
+    else { min = 1; max = 1; }
 
-      /* If the minimum is zero, we have to allow for an OP_BRAZERO before the
-      group, and if the maximum is greater than zero, we have to replicate
-      maxval-1 times; each replication acquires an OP_BRAZERO plus a nesting
-      bracket set - hence the 7. */
+    /* If the minimum is zero, we have to allow for an OP_BRAZERO before the
+    group, and if the maximum is greater than zero, we have to replicate
+    maxval-1 times; each replication acquires an OP_BRAZERO plus a nesting
+    bracket set. */
 
-      if (minval == 0)
-        {
-        length++;
-        if (maxval > 0) length += (maxval - 1) * (duplength + 7);
-        }
+    if (min == 0)
+      {
+      length++;
+      if (max > 0) length += (max - 1) * (duplength + 3 + 2*LINK_SIZE);
+      }
 
-      /* When the minimum is greater than zero, 1 we have to replicate up to
-      minval-1 times, with no additions required in the copies. Then, if
-      there is a limited maximum we have to replicate up to maxval-1 times
-      allowing for a BRAZERO item before each optional copy and nesting
-      brackets for all but one of the optional copies. */
+    /* When the minimum is greater than zero, we have to replicate up to
+    minval-1 times, with no additions required in the copies. Then, if there
+    is a limited maximum we have to replicate up to maxval-1 times allowing
+    for a BRAZERO item before each optional copy and nesting brackets for all
+    but one of the optional copies. */
 
-      else
-        {
-        length += (minval - 1) * duplength;
-        if (maxval > minval)   /* Need this test as maxval=-1 means no limit */
-          length += (maxval - minval) * (duplength + 7) - 6;
-        }
+    else
+      {
+      length += (min - 1) * duplength;
+      if (max > min)   /* Need this test as max=-1 means no limit */
+        length += (max - min) * (duplength + 3 + 2*LINK_SIZE)
+          - (2 + 2*LINK_SIZE);
+      }
+
+    /* Allow space for once brackets for "possessive quantifier" */
+
+    if (ptr[1] == '+')
+      {
+      ptr++;
+      length += 2 + 2*LINK_SIZE;
       }
     continue;
 
@@ -2987,6 +3806,20 @@ while ((c = *(++ptr)) != 0)
     runlength = 0;
     do
       {
+      /* If in a \Q...\E sequence, check for end; otherwise it's a literal */
+      if (inescq)
+        {
+        if (c == '\\' && ptr[1] == 'E')
+          {
+          inescq = FALSE;
+          ptr++;
+          }
+        else runlength++;
+        continue;
+        }
+
+      /* Skip whitespace and comments for /x */
+
       if ((options & PCRE_EXTENDED) != 0)
         {
         if ((compile_block.ctypes[c] & ctype_space) != 0) continue;
@@ -3031,27 +3864,24 @@ while ((c = *(++ptr)) != 0)
     while (runlength < MAXLIT &&
       (compile_block.ctypes[c = *(++ptr)] & ctype_meta) == 0);
 
-    ptr--;
+    if (runlength < MAXLIT) ptr--;
     length += runlength;
     continue;
     }
   }
 
-length += 4;    /* For final KET and END */
+length += 2 + LINK_SIZE;    /* For final KET and END */
 
-if (length > 65539)
+if (length > MAX_PATTERN_SIZE)
   {
   *errorptr = ERR20;
   return NULL;
   }
 
 /* Compute the size of data block needed and get it, either from malloc or
-externally provided function. We specify "code[0]" in the offsetof() expression
-rather than just "code", because it has been reported that one broken compiler
-fails on "code" because it is also an independent variable. It should make no
-difference to the value of the offsetof(). */
+externally provided function. */
 
-size = length + offsetof(real_pcre, code[0]);
+size = length + sizeof(real_pcre) + name_count * (max_name_size + 3);
 re = (real_pcre *)(pcre_malloc)(size);
 
 if (re == NULL)
@@ -3066,17 +3896,28 @@ re->magic_number = MAGIC_NUMBER;
 re->size = size;
 re->options = options;
 re->tables = tables;
+re->name_entry_size = max_name_size + 3;
+re->name_count = name_count;
+
+/* The starting points of the name/number translation table and of the code are
+passed around in the compile data block. */
+
+compile_block.names_found = 0;
+compile_block.name_entry_size = max_name_size + 3;
+compile_block.name_table = (uschar *)re + sizeof(real_pcre);
+codestart = compile_block.name_table + re->name_entry_size * re->name_count;
+compile_block.start_code = codestart;
 
 /* Set up a starting, non-extracting bracket, then compile the expression. On
 error, *errorptr will be set non-NULL, so we don't need to look at the result
 of the function here. */
 
 ptr = (const uschar *)pattern;
-code = re->code;
+code = (uschar *)codestart;
 *code = OP_BRA;
 bracount = 0;
-(void)compile_regex(options, -1, &bracount, &code, &ptr, errorptr, FALSE, 0,
-  &reqchar, &countlits, &compile_block);
+(void)compile_regex(options, options & PCRE_IMS, &bracount, &code, &ptr,
+  errorptr, FALSE, 0, &firstchar, &reqchar, NULL, &compile_block);
 re->top_bracket = bracount;
 re->top_backref = top_backref;
 
@@ -3090,7 +3931,7 @@ if debugging, leave the test till after things are printed out. */
 *code++ = OP_END;
 
 #ifndef DEBUG
-if (code - re->code > length) *errorptr = ERR23;
+if (code - codestart > length) *errorptr = ERR23;
 #endif
 
 /* Give an error if there's back reference to a non-existent capturing
@@ -3098,7 +3939,7 @@ subpattern. */
 
 if (top_backref > re->top_bracket) *errorptr = ERR15;
 
-/* Failed to compile */
+/* Failed to compile, or error while post-processing */
 
 if (*errorptr != NULL)
   {
@@ -3108,12 +3949,12 @@ if (*errorptr != NULL)
   return NULL;
   }
 
-/* If the anchored option was not passed, set flag if we can determine that the
-pattern is anchored by virtue of ^ characters or \A or anything else (such as
-starting with .* when DOTALL is set).
+/* If the anchored option was not passed, set the flag if we can determine that
+the pattern is anchored by virtue of ^ characters or \A or anything else (such
+as starting with .* when DOTALL is set).
 
-Otherwise, see if we can determine what the first character has to be, because
-that speeds up unanchored matches no end. If not, see if we can set the
+Otherwise, if we know what the first character has to be, save it, because that
+speeds up unanchored matches no end. If not, see if we can set the
 PCRE_STARTLINE flag. This is helpful for multiline matches when all branches
 start with ^. and also when all branches start with .* for non-DOTALL matches.
 */
@@ -3121,27 +3962,35 @@ start with ^. and also when all branches start with .* for non-DOTALL matches.
 if ((options & PCRE_ANCHORED) == 0)
   {
   int temp_options = options;
-  if (is_anchored(re->code, &temp_options))
+  if (is_anchored(codestart, &temp_options, FALSE, top_backref))
     re->options |= PCRE_ANCHORED;
   else
     {
-    int ch = find_firstchar(re->code, &temp_options);
-    if (ch >= 0)
+    if (firstchar < 0)
+      firstchar = find_firstassertedchar(codestart, &temp_options, FALSE);
+    if (firstchar >= 0)   /* Remove caseless flag for non-caseable chars */
       {
-      re->first_char = ch;
+      int ch = firstchar & 255;
+      re->first_char = ((firstchar & REQ_CASELESS) != 0 &&
+         compile_block.fcc[ch] == ch)? ch : firstchar;
       re->options |= PCRE_FIRSTSET;
       }
-    else if (is_startline(re->code))
+    else if (is_startline(codestart, FALSE, top_backref))
       re->options |= PCRE_STARTLINE;
     }
   }
 
-/* Save the last required character if there are at least two literal
-characters on all paths, or if there is no first character setting. */
+/* Save the last required character if any. Remove caseless flag for
+non-caseable chars. */
 
-if (reqchar >= 0 && (countlits > 1 || (re->options & PCRE_FIRSTSET) == 0))
+if ((re->options & PCRE_ANCHORED) != 0 && reqchar < 0 && firstchar >= 0)
+  reqchar = firstchar;
+
+if (reqchar >= 0)
   {
-  re->req_char = reqchar;
+  int ch = reqchar & 255;
+  re->req_char = ((reqchar & REQ_CASELESS) != 0 &&
+    compile_block.fcc[ch] == ch)? ch : reqchar;
   re->options |= PCRE_REQCHSET;
   }
 
@@ -3168,209 +4017,26 @@ if (re->options != 0)
 
 if ((re->options & PCRE_FIRSTSET) != 0)
   {
-  if (isprint(re->first_char)) printf("First char = %c\n", re->first_char);
-    else printf("First char = \\x%02x\n", re->first_char);
+  int ch = re->first_char & 255;
+  char *caseless = ((re->first_char & REQ_CASELESS) == 0)? "" : " (caseless)";
+  if (isprint(ch)) printf("First char = %c%s\n", ch, caseless);
+    else printf("First char = \\x%02x%s\n", ch, caseless);
   }
 
 if ((re->options & PCRE_REQCHSET) != 0)
   {
-  if (isprint(re->req_char)) printf("Req char = %c\n", re->req_char);
-    else printf("Req char = \\x%02x\n", re->req_char);
+  int ch = re->req_char & 255;
+  char *caseless = ((re->req_char & REQ_CASELESS) == 0)? "" : " (caseless)";
+  if (isprint(ch)) printf("Req char = %c%s\n", ch, caseless);
+    else printf("Req char = \\x%02x%s\n", ch, caseless);
   }
 
-code_end = code;
-code_base = code = re->code;
-
-while (code < code_end)
-  {
-  int charlength;
-
-  printf("%3d ", code - code_base);
-
-  if (*code >= OP_BRA)
-    {
-    if (*code - OP_BRA > EXTRACT_BASIC_MAX)
-      printf("%3d Bra extra", (code[1] << 8) + code[2]);
-    else
-      printf("%3d Bra %d", (code[1] << 8) + code[2], *code - OP_BRA);
-    code += 2;
-    }
-
-  else switch(*code)
-    {
-    case OP_OPT:
-    printf(" %.2x %s", code[1], OP_names[*code]);
-    code++;
-    break;
-
-    case OP_CHARS:
-    charlength = *(++code);
-    printf("%3d ", charlength);
-    while (charlength-- > 0)
-      if (isprint(c = *(++code))) printf("%c", c); else printf("\\x%02x", c);
-    break;
-
-    case OP_KETRMAX:
-    case OP_KETRMIN:
-    case OP_ALT:
-    case OP_KET:
-    case OP_ASSERT:
-    case OP_ASSERT_NOT:
-    case OP_ASSERTBACK:
-    case OP_ASSERTBACK_NOT:
-    case OP_ONCE:
-    case OP_REVERSE:
-    case OP_BRANUMBER:
-    case OP_COND:
-    case OP_CREF:
-    printf("%3d %s", (code[1] << 8) + code[2], OP_names[*code]);
-    code += 2;
-    break;
-
-    case OP_STAR:
-    case OP_MINSTAR:
-    case OP_PLUS:
-    case OP_MINPLUS:
-    case OP_QUERY:
-    case OP_MINQUERY:
-    case OP_TYPESTAR:
-    case OP_TYPEMINSTAR:
-    case OP_TYPEPLUS:
-    case OP_TYPEMINPLUS:
-    case OP_TYPEQUERY:
-    case OP_TYPEMINQUERY:
-    if (*code >= OP_TYPESTAR)
-      printf("    %s", OP_names[code[1]]);
-    else if (isprint(c = code[1])) printf("    %c", c);
-      else printf("    \\x%02x", c);
-    printf("%s", OP_names[*code++]);
-    break;
-
-    case OP_EXACT:
-    case OP_UPTO:
-    case OP_MINUPTO:
-    if (isprint(c = code[3])) printf("    %c{", c);
-      else printf("    \\x%02x{", c);
-    if (*code != OP_EXACT) printf("0,");
-    printf("%d}", (code[1] << 8) + code[2]);
-    if (*code == OP_MINUPTO) printf("?");
-    code += 3;
-    break;
-
-    case OP_TYPEEXACT:
-    case OP_TYPEUPTO:
-    case OP_TYPEMINUPTO:
-    printf("    %s{", OP_names[code[3]]);
-    if (*code != OP_TYPEEXACT) printf(",");
-    printf("%d}", (code[1] << 8) + code[2]);
-    if (*code == OP_TYPEMINUPTO) printf("?");
-    code += 3;
-    break;
-
-    case OP_NOT:
-    if (isprint(c = *(++code))) printf("    [^%c]", c);
-      else printf("    [^\\x%02x]", c);
-    break;
-
-    case OP_NOTSTAR:
-    case OP_NOTMINSTAR:
-    case OP_NOTPLUS:
-    case OP_NOTMINPLUS:
-    case OP_NOTQUERY:
-    case OP_NOTMINQUERY:
-    if (isprint(c = code[1])) printf("    [^%c]", c);
-      else printf("    [^\\x%02x]", c);
-    printf("%s", OP_names[*code++]);
-    break;
-
-    case OP_NOTEXACT:
-    case OP_NOTUPTO:
-    case OP_NOTMINUPTO:
-    if (isprint(c = code[3])) printf("    [^%c]{", c);
-      else printf("    [^\\x%02x]{", c);
-    if (*code != OP_NOTEXACT) printf(",");
-    printf("%d}", (code[1] << 8) + code[2]);
-    if (*code == OP_NOTMINUPTO) printf("?");
-    code += 3;
-    break;
-
-    case OP_REF:
-    printf("    \\%d", (code[1] << 8) | code[2]);
-    code += 3;
-    goto CLASS_REF_REPEAT;
-
-    case OP_CLASS:
-      {
-      int i, min, max;
-      code++;
-      printf("    [");
-
-      for (i = 0; i < 256; i++)
-        {
-        if ((code[i/8] & (1 << (i&7))) != 0)
-          {
-          int j;
-          for (j = i+1; j < 256; j++)
-            if ((code[j/8] & (1 << (j&7))) == 0) break;
-          if (i == '-' || i == ']') printf("\\");
-          if (isprint(i)) printf("%c", i); else printf("\\x%02x", i);
-          if (--j > i)
-            {
-            printf("-");
-            if (j == '-' || j == ']') printf("\\");
-            if (isprint(j)) printf("%c", j); else printf("\\x%02x", j);
-            }
-          i = j;
-          }
-        }
-      printf("]");
-      code += 32;
-
-      CLASS_REF_REPEAT:
-
-      switch(*code)
-        {
-        case OP_CRSTAR:
-        case OP_CRMINSTAR:
-        case OP_CRPLUS:
-        case OP_CRMINPLUS:
-        case OP_CRQUERY:
-        case OP_CRMINQUERY:
-        printf("%s", OP_names[*code]);
-        break;
-
-        case OP_CRRANGE:
-        case OP_CRMINRANGE:
-        min = (code[1] << 8) + code[2];
-        max = (code[3] << 8) + code[4];
-        if (max == 0) printf("{%d,}", min);
-        else printf("{%d,%d}", min, max);
-        if (*code == OP_CRMINRANGE) printf("?");
-        code += 4;
-        break;
-
-        default:
-        code--;
-        }
-      }
-    break;
-
-    /* Anything else is just a one-node item */
-
-    default:
-    printf("    %s", OP_names[*code]);
-    break;
-    }
-
-  code++;
-  printf("\n");
-  }
-printf("------------------------------------------------------------------\n");
+print_internals(re, stdout);
 
 /* This check is done here in the debugging case so that the code that
 was compiled can be seen. */
 
-if (code - re->code > length)
+if (code - codestart > length)
   {
   *errorptr = ERR23;
   (pcre_free)(re);
@@ -3515,7 +4181,8 @@ for (;;)
     /* For extended extraction brackets (large number), we have to fish out the
     number from a dummy opcode at the start. */
 
-    if (number > EXTRACT_BASIC_MAX) number = (ecode[4] << 8) | ecode[5];
+    if (number > EXTRACT_BASIC_MAX)
+      number = GET2(ecode, 2+LINK_SIZE);
     offset = number << 1;
 
 #ifdef DEBUG
@@ -3529,15 +4196,17 @@ for (;;)
       int save_offset1 = md->offset_vector[offset];
       int save_offset2 = md->offset_vector[offset+1];
       int save_offset3 = md->offset_vector[md->offset_end - number];
+      int save_capture_last = md->capture_last;
 
       DPRINTF(("saving %d %d %d\n", save_offset1, save_offset2, save_offset3));
       md->offset_vector[md->offset_end - number] = eptr - md->start_subject;
 
       do
         {
-        if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
-          return TRUE;
-        ecode += (ecode[1] << 8) + ecode[2];
+        if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, eptrb,
+          match_isgroup)) return TRUE;
+        md->capture_last = save_capture_last;
+        ecode += GET(ecode, 1);
         }
       while (*ecode == OP_ALT);
 
@@ -3563,9 +4232,9 @@ for (;;)
     DPRINTF(("start bracket 0\n"));
     do
       {
-      if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
-        return TRUE;
-      ecode += (ecode[1] << 8) + ecode[2];
+      if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, eptrb,
+        match_isgroup)) return TRUE;
+      ecode += GET(ecode, 1);
       }
     while (*ecode == OP_ALT);
     DPRINTF(("bracket 0 failed\n"));
@@ -3577,12 +4246,14 @@ for (;;)
     exactly what going to the ket would do. */
 
     case OP_COND:
-    if (ecode[3] == OP_CREF)         /* Condition is extraction test */
+    if (ecode[LINK_SIZE+1] == OP_CREF) /* Condition extract or recurse test */
       {
-      int offset = (ecode[4] << 9) | (ecode[5] << 1); /* Doubled ref number */
-      return match(eptr,
-        ecode + ((offset < offset_top && md->offset_vector[offset] >= 0)?
-          6 : 3 + (ecode[1] << 8) + ecode[2]),
+      int offset = GET2(ecode, LINK_SIZE+2) << 1;  /* Doubled ref number */
+      BOOL condition = (offset == CREF_RECURSE * 2)?
+        (md->recursive != NULL) :
+        (offset < offset_top && md->offset_vector[offset] >= 0);
+      return match(eptr, ecode + (condition?
+        (LINK_SIZE + 4) : (LINK_SIZE + 1 + GET(ecode, 1))),
         offset_top, md, ims, eptrb, match_isgroup);
       }
 
@@ -3591,14 +4262,15 @@ for (;;)
 
     else
       {
-      if (match(eptr, ecode+3, offset_top, md, ims, NULL,
+      if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, NULL,
           match_condassert | match_isgroup))
         {
-        ecode += 3 + (ecode[4] << 8) + ecode[5];
-        while (*ecode == OP_ALT) ecode += (ecode[1] << 8) + ecode[2];
+        ecode += 1 + LINK_SIZE + GET(ecode, LINK_SIZE+2);
+        while (*ecode == OP_ALT) ecode += GET(ecode, 1);
         }
-      else ecode += (ecode[1] << 8) + ecode[2];
-      return match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup);
+      else ecode += GET(ecode, 1);
+      return match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, eptrb,
+        match_isgroup);
       }
     /* Control never reaches here */
 
@@ -3610,10 +4282,26 @@ for (;;)
     ecode += 3;
     break;
 
-    /* End of the pattern. If PCRE_NOTEMPTY is set, fail if we have matched
-    an empty string - recursion will then try other alternatives, if any. */
+    /* End of the pattern. If we are in a recursion, we should restore the
+    offsets appropriately and continue from after the call. */
 
     case OP_END:
+    if (md->recursive != NULL && md->recursive->group_num == 0)
+      {
+      recursion_info *rec = md->recursive;
+      DPRINTF(("Hit the end in a (?0) recursion\n"));
+      md->recursive = rec->prev;
+      memmove(md->offset_vector, rec->offset_save,
+        rec->saved_max * sizeof(int));
+      md->start_match = rec->save_start;
+      ims = original_ims;
+      ecode = rec->after_call;
+      break;
+      }
+
+    /* Otherwise, if PCRE_NOTEMPTY is set, fail if we have matched an empty
+    string - backtracking will then try other alternatives, if any. */
+
     if (md->notempty && eptr == md->start_match) return FALSE;
     md->end_match_ptr = eptr;          /* Record where we ended */
     md->end_offset_top = offset_top;   /* and how many extracts were taken */
@@ -3637,8 +4325,9 @@ for (;;)
     case OP_ASSERTBACK:
     do
       {
-      if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup)) break;
-      ecode += (ecode[1] << 8) + ecode[2];
+      if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, NULL,
+        match_isgroup)) break;
+      ecode += GET(ecode, 1);
       }
     while (*ecode == OP_ALT);
     if (*ecode == OP_KET) return FALSE;
@@ -3650,8 +4339,8 @@ for (;;)
     /* Continue from after the assertion, updating the offsets high water
     mark, since extracts may have been taken during the assertion. */
 
-    do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
-    ecode += 3;
+    do ecode += GET(ecode,1); while (*ecode == OP_ALT);
+    ecode += 1 + LINK_SIZE;
     offset_top = md->end_offset_top;
     continue;
 
@@ -3661,15 +4350,15 @@ for (;;)
     case OP_ASSERTBACK_NOT:
     do
       {
-      if (match(eptr, ecode+3, offset_top, md, ims, NULL, match_isgroup))
-        return FALSE;
-      ecode += (ecode[1] << 8) + ecode[2];
+      if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, NULL,
+        match_isgroup)) return FALSE;
+      ecode += GET(ecode,1);
       }
     while (*ecode == OP_ALT);
 
     if ((flags & match_condassert) != 0) return TRUE;
 
-    ecode += 3;
+    ecode += 1 + LINK_SIZE;
     continue;
 
     /* Move the subject pointer back. This occurs only at the start of
@@ -3679,75 +4368,161 @@ for (;;)
 
     case OP_REVERSE:
 #ifdef SUPPORT_UTF8
-    c = (ecode[1] << 8) + ecode[2];
+    c = GET(ecode,1);
     for (i = 0; i < c; i++)
       {
       eptr--;
       BACKCHAR(eptr)
       }
 #else
-    eptr -= (ecode[1] << 8) + ecode[2];
+    eptr -= GET(ecode,1);
 #endif
 
     if (eptr < md->start_subject) return FALSE;
-    ecode += 3;
+    ecode += 1 + LINK_SIZE;
     break;
 
-    /* Recursion matches the current regex, nested. If there are any capturing
-    brackets started but not finished, we have to save their starting points
-    and reinstate them after the recursion. However, we don't know how many
-    such there are (offset_top records the completed total) so we just have
-    to save all the potential data. There may be up to 99 such values, which
-    is a bit large to put on the stack, but using malloc for small numbers
-    seems expensive. As a compromise, the stack is used when there are fewer
-    than 16 values to store; otherwise malloc is used. A problem is what to do
-    if the malloc fails ... there is no way of returning to the top level with
-    an error. Save the top 15 values on the stack, and accept that the rest
-    may be wrong. */
+    /* The callout item calls an external function, if one is provided, passing
+    details of the match so far. This is mainly for debugging, though the
+    function is able to force a failure. */
+
+    case OP_CALLOUT:
+    if (pcre_callout != NULL)
+      {
+      pcre_callout_block cb;
+      cb.version          = 0;   /* Version 0 of the callout block */
+      cb.callout_number   = ecode[1];
+      cb.offset_vector    = md->offset_vector;
+      cb.subject          = (const char *)md->start_subject;
+      cb.subject_length   = md->end_subject - md->start_subject;
+      cb.start_match      = md->start_match - md->start_subject;
+      cb.current_position = eptr - md->start_subject;
+      cb.capture_top      = offset_top/2;
+      cb.capture_last     = md->capture_last;
+      if ((*pcre_callout)(&cb) != 0) return FALSE;
+      }
+    ecode += 2;
+    break;
+
+    /* Recursion either matches the current regex, or some subexpression. The
+    offset data is the offset to the starting bracket from the start of the
+    whole pattern. However, it is possible that a BRAZERO was inserted before
+    this bracket after we took the offset - we just skip it if encountered.
+
+    If there are any capturing brackets started but not finished, we have to
+    save their starting points and reinstate them after the recursion. However,
+    we don't know how many such there are (offset_top records the completed
+    total) so we just have to save all the potential data. There may be up to
+    65535 such values, which is too large to put on the stack, but using malloc
+    for small numbers seems expensive. As a compromise, the stack is used when
+    there are no more than REC_STACK_SAVE_MAX values to store; otherwise malloc
+    is used. A problem is what to do if the malloc fails ... there is no way of
+    returning to the top level with an error. Save the top REC_STACK_SAVE_MAX
+    values on the stack, and accept that the rest may be wrong.
+
+    There are also other values that have to be saved. We use a chained
+    sequence of blocks that actually live on the stack. Thanks to Robin Houston
+    for the original version of this logic. */
 
     case OP_RECURSE:
       {
-      BOOL rc;
-      int *save;
-      int stacksave[15];
+      int stacksave[REC_STACK_SAVE_MAX];
+      recursion_info new_recursive;
+      const uschar *callpat = md->start_code + GET(ecode, 1);
+
+      if (*callpat == OP_BRAZERO) callpat++;
+
+      new_recursive.group_num = *callpat - OP_BRA;
 
-      c = md->offset_max;
+      /* For extended extraction brackets (large number), we have to fish out
+      the number from a dummy opcode at the start. */
 
-      if (c < 16) save = stacksave; else
+      if (new_recursive.group_num > EXTRACT_BASIC_MAX)
+        new_recursive.group_num = GET2(callpat, 2+LINK_SIZE);
+
+      /* Add to "recursing stack" */
+
+      new_recursive.prev = md->recursive;
+      md->recursive = &new_recursive;
+
+      /* Find where to continue from afterwards */
+
+      ecode += 1 + LINK_SIZE;
+      new_recursive.after_call = ecode;
+
+      /* Now save the offset data. */
+
+      new_recursive.saved_max = md->offset_end;
+      if (new_recursive.saved_max <= REC_STACK_SAVE_MAX)
+        new_recursive.offset_save = stacksave;
+      else
         {
-        save = (int *)(pcre_malloc)((c+1) * sizeof(int));
-        if (save == NULL)
+        new_recursive.offset_save = (int *)
+            (pcre_malloc)(new_recursive.saved_max * sizeof(int));
+
+        /* RH: Warning: This may cause INCORRECT RESULTS if we run out of
+        memory here, because we won't be restoring all the stored strings
+        correctly. We either need proper run-time error handling or, at the
+        very least, some way to warn the user. Could we just spit a message to
+        stderr?
+
+        PH: No, Robin, no! You must NEVER write to stderr from inside a general
+        library function, because you don't know anything about the state of
+        the file descriptor.
+
+        RH: Returning error values would be very tedious because of the
+        recursion; and Philip Hazel says that longjmp() - in many ways the
+        obvious solution - has previously caused problems on some platforms. */
+
+        if (new_recursive.offset_save == NULL)
           {
-          save = stacksave;
-          c = 15;
+          DPRINTF(("malloc() failed - results may be wrong\n"));
+          new_recursive.offset_save = stacksave;
+          new_recursive.saved_max = REC_STACK_SAVE_MAX;
           }
         }
 
-      for (i = 1; i <= c; i++)
-        save[i] = md->offset_vector[md->offset_end - i];
-      rc = match(eptr, md->start_pattern, offset_top, md, ims, eptrb,
-        match_isgroup);
-      for (i = 1; i <= c; i++)
-        md->offset_vector[md->offset_end - i] = save[i];
-      if (save != stacksave) (pcre_free)(save);
-      if (!rc) return FALSE;
+      memcpy(new_recursive.offset_save, md->offset_vector,
+            new_recursive.saved_max * sizeof(int));
+      new_recursive.save_start = md->start_match;
+      md->start_match = eptr;
 
-      /* In case the recursion has set more capturing values, save the final
-      number, then move along the subject till after the recursive match,
-      and advance one byte in the pattern code. */
+      /* OK, now we can do the recursion. For each top-level alternative we
+      restore the offset and recursion data. */
 
-      offset_top = md->end_offset_top;
-      eptr = md->end_match_ptr;
-      ecode++;
+      DPRINTF(("Recursing into group %d\n", new_recursive.group_num));
+      do
+        {
+        if (match(eptr, callpat + 1 + LINK_SIZE, offset_top, md, ims, eptrb,
+            match_isgroup))
+          {
+          md->recursive = new_recursive.prev;
+          if (new_recursive.offset_save != stacksave)
+            (pcre_free)(new_recursive.offset_save);
+          return TRUE;
+          }
+
+        md->recursive = &new_recursive;
+        memcpy(md->offset_vector, new_recursive.offset_save,
+            new_recursive.saved_max * sizeof(int));
+        callpat += GET(callpat, 1);
+        }
+      while (*callpat == OP_ALT);
+
+      DPRINTF(("Recursion didn't match\n"));
+      md->recursive = new_recursive.prev;
+      if (new_recursive.offset_save != stacksave)
+        (pcre_free)(new_recursive.offset_save);
+      return FALSE;
       }
     break;
 
     /* "Once" brackets are like assertion brackets except that after a match,
     the point in the subject string is not moved back. Thus there can never be
-    a move back into the brackets. Check the alternative branches in turn - the
-    matching won't pass the KET for this kind of subpattern. If any one branch
-    matches, we carry on as at the end of a normal bracket, leaving the subject
-    pointer. */
+    a move back into the brackets. Friedl calls these "atomic" subpatterns.
+    Check the alternative branches in turn - the matching won't pass the KET
+    for this kind of subpattern. If any one branch matches, we carry on as at
+    the end of a normal bracket, leaving the subject pointer. */
 
     case OP_ONCE:
       {
@@ -3756,9 +4531,9 @@ for (;;)
 
       do
         {
-        if (match(eptr, ecode+3, offset_top, md, ims, eptrb, match_isgroup))
-          break;
-        ecode += (ecode[1] << 8) + ecode[2];
+        if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, eptrb,
+          match_isgroup)) break;
+        ecode += GET(ecode,1);
         }
       while (*ecode == OP_ALT);
 
@@ -3769,7 +4544,7 @@ for (;;)
       /* Continue as from after the assertion, updating the offsets high water
       mark, since extracts may have been taken. */
 
-      do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+      do ecode += GET(ecode,1); while (*ecode == OP_ALT);
 
       offset_top = md->end_offset_top;
       eptr = md->end_match_ptr;
@@ -3782,7 +4557,7 @@ for (;;)
 
       if (*ecode == OP_KET || eptr == saved_eptr)
         {
-        ecode += 3;
+        ecode += 1+LINK_SIZE;
         break;
         }
 
@@ -3791,7 +4566,7 @@ for (;;)
       that changed within the bracket before re-running it, so check the next
       opcode. */
 
-      if (ecode[3] == OP_OPT)
+      if (ecode[1+LINK_SIZE] == OP_OPT)
         {
         ims = (ims & ~PCRE_IMS) | ecode[4];
         DPRINTF(("ims set to %02lx at group repeat\n", ims));
@@ -3799,14 +4574,16 @@ for (;;)
 
       if (*ecode == OP_KETRMIN)
         {
-        if (match(eptr, ecode+3, offset_top, md, ims, eptrb, 0) ||
+        if (match(eptr, ecode + 1 + LINK_SIZE, offset_top, md, ims, eptrb, 0)
+            ||
             match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup))
               return TRUE;
         }
       else  /* OP_KETRMAX */
         {
         if (match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup) ||
-            match(eptr, ecode+3, offset_top, md, ims, eptrb, 0)) return TRUE;
+            match(eptr, ecode + 1+LINK_SIZE, offset_top, md, ims, eptrb, 0))
+            return TRUE;
         }
       }
     return FALSE;
@@ -3815,7 +4592,7 @@ for (;;)
     bracketed group and go to there. */
 
     case OP_ALT:
-    do ecode += (ecode[1] << 8) + ecode[2]; while (*ecode == OP_ALT);
+    do ecode += GET(ecode,1); while (*ecode == OP_ALT);
     break;
 
     /* BRAZERO and BRAMINZERO occur just before a bracket group, indicating
@@ -3829,17 +4606,17 @@ for (;;)
       const uschar *next = ecode+1;
       if (match(eptr, next, offset_top, md, ims, eptrb, match_isgroup))
         return TRUE;
-      do next += (next[1] << 8) + next[2]; while (*next == OP_ALT);
-      ecode = next + 3;
+      do next += GET(next,1); while (*next == OP_ALT);
+      ecode = next + 1+LINK_SIZE;
       }
     break;
 
     case OP_BRAMINZERO:
       {
       const uschar *next = ecode+1;
-      do next += (next[1] << 8) + next[2]; while (*next == OP_ALT);
-      if (match(eptr, next+3, offset_top, md, ims, eptrb, match_isgroup))
-        return TRUE;
+      do next += GET(next,1); while (*next == OP_ALT);
+      if (match(eptr, next + 1+LINK_SIZE, offset_top, md, ims, eptrb,
+        match_isgroup)) return TRUE;
       ecode++;
       }
     break;
@@ -3853,7 +4630,7 @@ for (;;)
     case OP_KETRMIN:
     case OP_KETRMAX:
       {
-      const uschar *prev = ecode - (ecode[1] << 8) - ecode[2];
+      const uschar *prev = ecode - GET(ecode, 1);
       const uschar *saved_eptr = eptrb->saved_eptr;
 
       eptrb = eptrb->prev;    /* Back up the stack of bracket start pointers */
@@ -3879,7 +4656,7 @@ for (;;)
         /* For extended extraction brackets (large number), we have to fish out
         the number from a dummy opcode at the start. */
 
-        if (number > EXTRACT_BASIC_MAX) number = (prev[4] << 8) | prev[5];
+        if (number > EXTRACT_BASIC_MAX) number = GET2(prev, 2+LINK_SIZE);
         offset = number << 1;
 
 #ifdef DEBUG
@@ -3887,8 +4664,14 @@ for (;;)
         printf("\n");
 #endif
 
+        /* Test for a numbered group. This includes groups called as a result
+        of recursion. Note that whole-pattern recursion is coded as a recurse
+        into group 0, so it won't be picked up here. Instead, we catch it when
+        the OP_END is reached. */
+
         if (number > 0)
           {
+          md->capture_last = number;
           if (offset >= md->offset_max) md->offset_overflow = TRUE; else
             {
             md->offset_vector[offset] =
@@ -3896,6 +4679,22 @@ for (;;)
             md->offset_vector[offset+1] = eptr - md->start_subject;
             if (offset_top <= offset) offset_top = offset + 2;
             }
+
+          /* Handle a recursively called group. Restore the offsets
+          appropriately and continue from after the call. */
+
+          if (md->recursive != NULL && md->recursive->group_num == number)
+            {
+            recursion_info *rec = md->recursive;
+            DPRINTF(("Recursion (%d) succeeded - continuing\n", number));
+            md->recursive = rec->prev;
+            md->start_match = rec->save_start;
+            memcpy(md->offset_vector, rec->offset_save,
+              rec->saved_max * sizeof(int));
+            ecode = rec->after_call;
+            ims = original_ims;
+            break;
+            }
           }
         }
 
@@ -3913,7 +4712,7 @@ for (;;)
 
       if (*ecode == OP_KET || eptr == saved_eptr)
         {
-        ecode += 3;
+        ecode += 1 + LINK_SIZE;
         break;
         }
 
@@ -3922,14 +4721,15 @@ for (;;)
 
       if (*ecode == OP_KETRMIN)
         {
-        if (match(eptr, ecode+3, offset_top, md, ims, eptrb, 0) ||
+        if (match(eptr, ecode + 1+LINK_SIZE, offset_top, md, ims, eptrb, 0) ||
             match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup))
               return TRUE;
         }
       else  /* OP_KETRMAX */
         {
         if (match(eptr, prev, offset_top, md, ims, eptrb, match_isgroup) ||
-            match(eptr, ecode+3, offset_top, md, ims, eptrb, 0)) return TRUE;
+            match(eptr, ecode + 1+LINK_SIZE, offset_top, md, ims, eptrb, 0))
+          return TRUE;
         }
       }
     return FALSE;
@@ -3953,6 +4753,13 @@ for (;;)
     ecode++;
     break;
 
+    /* Start of match assertion */
+
+    case OP_SOM:
+    if (eptr != md->start_subject + md->start_offset) return FALSE;
+    ecode++;
+    break;
+
     /* Assert before internal newline if multiline, or before a terminating
     newline unless endonly is set, else end of subject unless noteol is set. */
 
@@ -4021,6 +4828,14 @@ for (;;)
     ecode++;
     break;
 
+    /* Match a single byte, even in UTF-8 mode. This opcode really does match
+    any byte, even newline, independent of the setting of PCRE_DOTALL. */
+
+    case OP_ANYBYTE:
+    if (eptr++ >= md->end_subject) return FALSE;
+    ecode++;
+    break;
+
     case OP_NOT_DIGIT:
     if (eptr >= md->end_subject ||
        (md->ctypes[*eptr++] & ctype_digit) != 0)
@@ -4074,7 +4889,7 @@ for (;;)
     case OP_REF:
       {
       int length;
-      int offset = (ecode[1] << 9) | (ecode[2] << 1); /* Doubled ref number */
+      int offset = GET2(ecode, 1) << 1;               /* Doubled ref number */
       ecode += 3;                                     /* Advance past item */
 
       /* If the reference is unset, set the length to be longer than the amount
@@ -4106,8 +4921,8 @@ for (;;)
         case OP_CRRANGE:
         case OP_CRMINRANGE:
         minimize = (*ecode == OP_CRMINRANGE);
-        min = (ecode[1] << 8) + ecode[2];
-        max = (ecode[3] << 8) + ecode[4];
+        min = GET2(ecode, 1);
+        max = GET2(ecode, 3);
         if (max == 0) max = INT_MAX;
         ecode += 5;
         break;
@@ -4203,8 +5018,8 @@ for (;;)
         case OP_CRRANGE:
         case OP_CRMINRANGE:
         minimize = (*ecode == OP_CRMINRANGE);
-        min = (ecode[1] << 8) + ecode[2];
-        max = (ecode[3] << 8) + ecode[4];
+        min = GET2(ecode, 1);
+        max = GET2(ecode, 3);
         if (max == 0) max = INT_MAX;
         ecode += 5;
         break;
@@ -4327,14 +5142,14 @@ for (;;)
     /* Match a single character repeatedly; different opcodes share code. */
 
     case OP_EXACT:
-    min = max = (ecode[1] << 8) + ecode[2];
+    min = max = GET2(ecode, 1);
     ecode += 3;
     goto REPEATCHAR;
 
     case OP_UPTO:
     case OP_MINUPTO:
     min = 0;
-    max = (ecode[1] << 8) + ecode[2];
+    max = GET2(ecode, 1);
     minimize = *ecode == OP_MINUPTO;
     ecode += 3;
     goto REPEATCHAR;
@@ -4458,14 +5273,14 @@ for (;;)
     time taken, but character matching *is* what this is all about... */
 
     case OP_NOTEXACT:
-    min = max = (ecode[1] << 8) + ecode[2];
+    min = max = GET2(ecode, 1);
     ecode += 3;
     goto REPEATNOTCHAR;
 
     case OP_NOTUPTO:
     case OP_NOTMINUPTO:
     min = 0;
-    max = (ecode[1] << 8) + ecode[2];
+    max = GET2(ecode, 1);
     minimize = *ecode == OP_NOTMINUPTO;
     ecode += 3;
     goto REPEATNOTCHAR;
@@ -4572,7 +5387,7 @@ for (;;)
     repeat it in the interests of efficiency. */
 
     case OP_TYPEEXACT:
-    min = max = (ecode[1] << 8) + ecode[2];
+    min = max = GET2(ecode, 1);
     minimize = TRUE;
     ecode += 3;
     goto REPEATTYPE;
@@ -4580,7 +5395,7 @@ for (;;)
     case OP_TYPEUPTO:
     case OP_TYPEMINUPTO:
     min = 0;
-    max = (ecode[1] << 8) + ecode[2];
+    max = GET2(ecode, 1);
     minimize = *ecode == OP_TYPEMINUPTO;
     ecode += 3;
     goto REPEATTYPE;
@@ -4632,6 +5447,10 @@ for (;;)
       else eptr += min;
       break;
 
+      case OP_ANYBYTE:
+      eptr += min;
+      break;
+
       case OP_NOT_DIGIT:
       for (i = 1; i <= min; i++)
         if ((md->ctypes[*eptr++] & ctype_digit) != 0) return FALSE;
@@ -4690,6 +5509,9 @@ for (;;)
 #endif
           break;
 
+          case OP_ANYBYTE:
+          break;
+
           case OP_NOT_DIGIT:
           if ((md->ctypes[c] & ctype_digit) != 0) return FALSE;
           break;
@@ -4761,13 +5583,14 @@ for (;;)
             if (eptr >= md->end_subject || *eptr == NEWLINE) break;
             eptr++;
             }
+          break;
           }
-        else
-          {
-          c = max - min;
-          if (c > md->end_subject - eptr) c = md->end_subject - eptr;
-          eptr += c;
-          }
+        /* For non-UTF8 DOTALL case, fall through and treat as \C */
+
+        case OP_ANYBYTE:
+        c = max - min;
+        if (c > md->end_subject - eptr) c = md->end_subject - eptr;
+        eptr += c;
         break;
 
         case OP_NOT_DIGIT:
@@ -4898,9 +5721,13 @@ const uschar *end_subject;
 const uschar *req_char_ptr = start_match - 1;
 const real_pcre *re = (const real_pcre *)external_re;
 const real_pcre_extra *extra = (const real_pcre_extra *)external_extra;
+const uschar *codestart =
+  (const uschar *)re + sizeof(real_pcre) + re->name_count * re->name_entry_size;
 BOOL using_temporary_offsets = FALSE;
 BOOL anchored;
 BOOL startline;
+BOOL first_char_caseless = FALSE;
+BOOL req_char_caseless = FALSE;
 
 if ((options & ~PUBLIC_EXEC_OPTIONS) != 0) return PCRE_ERROR_BADOPTION;
 
@@ -4911,8 +5738,9 @@ if (re->magic_number != MAGIC_NUMBER) return PCRE_ERROR_BADMAGIC;
 anchored = ((re->options | options) & PCRE_ANCHORED) != 0;
 startline = (re->options & PCRE_STARTLINE) != 0;
 
-match_block.start_pattern = re->code;
+match_block.start_code = codestart;
 match_block.start_subject = (const uschar *)subject;
+match_block.start_offset = start_offset;
 match_block.end_subject = match_block.start_subject + length;
 end_subject = match_block.end_subject;
 
@@ -4924,6 +5752,7 @@ match_block.noteol = (options & PCRE_NOTEOL) != 0;
 match_block.notempty = (options & PCRE_NOTEMPTY) != 0;
 
 match_block.errorcode = PCRE_ERROR_NOMATCH;     /* Default error */
+match_block.recursive = NULL;                   /* No recursion */
 
 match_block.lcc = re->tables + lcc_offset;
 match_block.ctypes = re->tables + ctypes_offset;
@@ -4954,6 +5783,7 @@ else match_block.offset_vector = offsets;
 match_block.offset_end = ocount;
 match_block.offset_max = (2*ocount)/3;
 match_block.offset_overflow = FALSE;
+match_block.capture_last = -1;
 
 /* Compute the minimum number of offsets that we need to reset each time. Doing
 this makes a huge difference to execution time when there aren't many brackets
@@ -4983,8 +5813,9 @@ if (!anchored)
   {
   if ((re->options & PCRE_FIRSTSET) != 0)
     {
-    first_char = re->first_char;
-    if ((ims & PCRE_CASELESS) != 0) first_char = match_block.lcc[first_char];
+    first_char = re->first_char & 255;
+    if ((first_char_caseless = ((re->first_char & REQ_CASELESS) != 0)) == TRUE)
+      first_char = match_block.lcc[first_char];
     }
   else
     if (!startline && extra != NULL &&
@@ -4993,18 +5824,13 @@ if (!anchored)
   }
 
 /* For anchored or unanchored matches, there may be a "last known required
-character" set. If the PCRE_CASELESS is set, implying that the match starts
-caselessly, or if there are any changes of this flag within the regex, set up
-both cases of the character. Otherwise set the two values the same, which will
-avoid duplicate testing (which takes significant time). This covers the vast
-majority of cases. It will be suboptimal when the case flag changes in a regex
-and the required character in fact is caseful. */
+character" set. */
 
 if ((re->options & PCRE_REQCHSET) != 0)
   {
-  req_char = re->req_char;
-  req_char2 = ((re->options & (PCRE_CASELESS | PCRE_ICHANGED)) != 0)?
-    (re->tables + fcc_offset)[req_char] : req_char;
+  req_char = re->req_char & 255;
+  req_char_caseless = (re->req_char & REQ_CASELESS) != 0;
+  req_char2 = (re->tables + fcc_offset)[req_char];  /* case flipped */
   }
 
 /* Loop for handling unanchored repeated matching attempts; for anchored regexs
@@ -5024,7 +5850,7 @@ do
 
   if (first_char >= 0)
     {
-    if ((ims & PCRE_CASELESS) != 0)
+    if (first_char_caseless)
       while (start_match < end_subject &&
              match_block.lcc[*start_match] != first_char)
         start_match++;
@@ -5065,12 +5891,9 @@ do
   for the match to succeed. If the first character is set, req_char must be
   later in the subject; otherwise the test starts at the match point. This
   optimization can save a huge amount of backtracking in patterns with nested
-  unlimited repeats that aren't going to match. We don't know what the state of
-  case matching may be when this character is hit, so test for it in both its
-  cases if necessary. However, the different cased versions will not be set up
-  unless PCRE_CASELESS was given or the casing state changes within the regex.
-  Writing separate code makes it go faster, as does using an autoincrement and
-  backing off on a match. */
+  unlimited repeats that aren't going to match. Writing separate code for
+  cased/caseless versions makes it go faster, as does using an autoincrement
+  and backing off on a match. */
 
   if (req_char >= 0)
     {
@@ -5081,24 +5904,19 @@ do
 
     if (p > req_char_ptr)
       {
-      /* Do a single test if no case difference is set up */
-
-      if (req_char == req_char2)
+      if (req_char_caseless)
         {
         while (p < end_subject)
           {
-          if (*p++ == req_char) { p--; break; }
+          register int pp = *p++;
+          if (pp == req_char || pp == req_char2) { p--; break; }
           }
         }
-
-      /* Otherwise test for either case */
-
       else
         {
         while (p < end_subject)
           {
-          register int pp = *p++;
-          if (pp == req_char || pp == req_char2) { p--; break; }
+          if (*p++ == req_char) { p--; break; }
           }
         }
 
@@ -5122,7 +5940,7 @@ do
   if certain parts of the pattern were not used. */
 
   match_block.start_match = start_match;
-  if (!match(start_match, re->code, 2, &match_block, ims, NULL, match_isgroup))
+  if (!match(start_match, codestart, 2, &match_block, ims, NULL, match_isgroup))
     continue;
 
   /* Copy the offset information from temporary store if necessary */