patch 9.0.0105: illegal memory access when pattern starts with illegal byte

Problem:    Illegal memory access when pattern starts with illegal byte.
Solution:   Do not match a character with an illegal byte.

src/regexp.c

@@ -1641,7 +1641,11 @@ cstrchr(char_u *s, int c)
 	{
 	    if (enc_utf8 && c > 0x80)
 	    {
-		if (utf_fold(utf_ptr2char(p)) == cc)
+		int uc = utf_ptr2char(p);
+
+		// Do not match an illegal byte.  E.g. 0xff matches 0xc3 0xbf,
+		// not 0xff.
+		if ((uc < 0x80 || uc != *p) && utf_fold(uc) == cc)
 		    return p;
 	    }
 	    else if (*p == c || *p == cc)

src/testdir/test_regexp_utf8.vim

@@ -1,5 +1,7 @@
 " Tests for regexp in utf8 encoding
 
+source shared.vim
+
 func s:equivalence_test()
   let str = "A<><41><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ゾ<EFBFBD><E382BE><EFBFBD>廎<EFBFBD>廕<EFBFBD>滯廕戶漲廕兕漯廕矜漁廕唸熔廕氮熄 B<><42>廎<EFBFBD><E5BB8E>廎<EFBFBD> C<><43><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廎<EFBFBD><E5BB8E> D<><44><EFBFBD>廎𢈈<E5BB8E>廎墰<E5BB8E>廎<EFBFBD> E<><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廎竢<E5BB8E>廎嘣<E5BB8E>廎𦸇爾廕筵獐廕擔<E5BB95>廙<EFBFBD><E5BB99>廙<EFBFBD> F<>廎嵴<E5BB8E> G<><47><EFBFBD>罌<EFBFBD>エオジ廎𥻗<E5BB8E> H臚藻<E8879A>廎Ｓ舅廎艮落廎芬惕 I<><49><EFBFBD><EFBFBD>蘑蘆蘇蠔襤<E8A094><E8A5A4><EFBFBD><EFBFBD>廎矜葬廙<E891AC><E5BB99> J譬<4A> K譯<4B>ガ廎唸葡廎氯惟<E6B0AF><E6839F> L贏躉躅醴<E8BA85><E986B4>廎嗤虜廎筵蜈漹<E89C88> M廎擔<E5BB8E>廜<EFBFBD> N<><4E><EFBFBD><EFBFBD>ゼ廜<E382BC><E5BB9C>廜<EFBFBD><E5BB9C><EFBFBD><EFBFBD> O<><4F><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ギグヂ<E382B0><E38382><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廜𣉖<E5BB9C>廜靟<E5BB9C>廙𣉖<E5BB99>廙靟<E5BB99>廙竢<E5BB99>廙嘣<E5BB99>廙𦸇<E5BB99>廙<EFBFBD>誥 P④廜竢<E5BB9C>漹<EFBFBD> Q<> R<><52><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廜嘣<E5BB9C>廜𦸇<E5BB9C>漹曰𩵼 S<><53><EFBFBD><EFBFBD><EFBFBD>廜<EFBFBD>飾廜戶髡廜兩掛<E585A9><E68E9B> T籠聾臟⑵⑷<E291B5><E291B7>廜花僧廜桑僭 U<><55><EFBFBD><EFBFBD>襯讀贗躓酈⑸<E98588><E291B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廜聊僑廜嗤兢廜筵誘廙艮豪廙花賑廙桑趕  V⑻廜澄嗾 W霽廕<E99CBD>廕<EFBFBD><E5BB95>廕<EFBFBD><E5BB95> X廕𢈈<E5BB95> Y<>韃顫⑼<E9A1AB><E291BC>廕墰輔廙氮辣廙<E8BEA3> Z饕驍鬚ⅰ廕靟<E5BB95>廕婙惚 a<>獺璽瓊瓣疇<E793A3><E79687><EFBFBD><EFBFBD><EFBFBD>ゥタ<E382A5><E382BF>廑𥕥<E5BB91>廕𠹳滿廕€漸廕扭漫廕後滬廕脊滷廕喔熊廕猾悼 b<><62>廘矜<E5BB98>廎<EFBFBD><E5BB8E>廎<EFBFBD> c癟<63><E7999F><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廎㕓<E5BB8E><E39593><EFBFBD> d<><64><EFBFBD>廘凍<E5BB98>廑𤒹<E5BB91>廎溆<E5BB8E>廎𤒹<E5BB8E> e癡矇礙禱<E7A499><E7A6B1><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廑𠯆<E5BB91>廎䤾<E5BB8E>廎𧘲<E5BB8E>廕嫗獄廕賦瑪廙<E791AA><E5BB99>廙<EFBFBD><E5BB99> f<>廘桑<E5BB98>廎<EFBFBD><E5BB8E> g<><67>纂耀ォカス<E382AB>廑<EFBFBD>腹<EFBFBD><E885B9> h艦藹<E889A6>廎€艇廎扭萱廎後<E5BB8E>漹刷<E6BCB9> i穫穩簾簿藺蘋蘊蠕<E8988A><E8A095><EFBFBD>禸廑𥕝葉廎脊<E5BB8E>廙<EFBFBD> j警ゴ<E8ADA6> k譟<6B>キ廑<E382AD>萵廎喔葭漹虎<E6BCB9> l贍躁躂<E8BA81><E8BA82><EFBFBD>廎猿號廎頗蜇漹<E89C87> m廘脊蛾廜<E89BBE><E5BB9C> n簽<6E><E7B0BD><EFBFBD><EFBFBD>ソ廘唸<E5BB98>廜<EFBFBD><E5BB9C>廜刅<E5BB9C><E58885><EFBFBD> o簷籀繫繭繹繪<E7B9B9><E7B9AA><EFBFBD>①<EFBFBD>クケッ<E382B1><E38383><EFBFBD><EFBFBD><EFBFBD><EFBFBD>伂廜溆<E5BB9C>廜𤒹<E5BB9C>廙溆<E5BB99>廙𤒹<E5BB99>廙鐧<E5BB99>廙䟭<E5BB99>廙鍅<E5BB99>廙﹥誨 p⑤廘晨善廑<E59684><E5BB91>廜<EFBFBD> q<><71> r<><72><EFBFBD><EFBFBD><EFBFBD><EFBFBD>刓廘聊絨廑刅<E5BB91>廜鍅<E5BB9C><E98D85><EFBFBD> s<><73><EFBFBD>禳<EFBFBD><E7A6B3>廘氮<E5BB98>廜﹥馳廜丟鳩廜抱恢 t籟聽襲⑴⑶<E291B4><E291B6>廘菲鼠廜凍僖廜晨<E5BB9C>漹<EFBFBD> u羅繳羶羹觼贖躑轡鑄鑒<E99184><E99192>⑹<EFBFBD><E291B9><EFBFBD><EFBFBD><EFBFBD><EFBFBD>廘擔<E5BB98>廜喔僱廜猿凳廜頗誑廙扭貍廙後賒廙脊跼 v<>廑𣉖厭廜<E58EAD> w霾廕<E99CBE><E5BB95>廕<EFBFBD><E5BB95>廕刅<E5BB95> x廕𦘒<E5BB95> y羸藩韁⑽<E99F81><E291BD>廕𥕥<E5BB95>廙喔輓廙猿遜 z驕髒鱉ⅱ廘嗤<E5BB98>廕𤒹<E5BB95>廕𨰝惇"
   let groups = split(str)
@@ -560,6 +562,19 @@ func Test_match_invalid_byte()
   call delete('Xinvalid')
 endfunc
 
+func Test_match_illegal_byte()
+  let lines =<< trim END
+      silent! buffer 藩\c
+      next 藩
+      0scriptnames
+      source
+  END
+  call writefile(lines, 'Xregexp')
+  call system(GetVimCommand() .. ' -X -Z -e -s -S Xregexp -c qa!')
+
+  call delete('Xregexp')
+endfunc
+
 func Test_match_too_complicated()
   set regexpengine=1
   exe "noswapfile vsplit \xeb\xdb\x99"

src/version.c

@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    105,
 /**/
     104,
 /**/