Prevent integer overflow in regex repetition count

b.c

@@ -1212,6 +1212,9 @@ replace_repeat(const uschar *reptok, int reptoklen, const uschar *atom,
 static int repeat(const uschar *reptok, int reptoklen, const uschar *atom,
 		  int atomlen, int firstnum, int secondnum)
 {
+	if (atom == NULL)
+		return 0;
+
 	/*
 	   In general, the repetition specifier or "bound" is replaced here
 	   by an equivalent ERE string, repeating the immediately previous atom
@@ -1459,6 +1462,9 @@ int relex(void)		/* lexical analyzer for reparse */
 					lastre);
 			} else if (isdigit(c)) {
 				num = 10 * num + c - '0';
+				if (num > 255)
+					FATAL("repetition count %.20s too large",
+						lastre);
 				digitfound = true;
 			} else if (c == ',') {
 				if (commafound)

bugs-fixed/repetition-no-atom.awk

@@ -0,0 +1 @@
+/{00}/

bugs-fixed/repetition-no-atom.ok

@@ -0,0 +1,4 @@
+awk: illegal primary in regular expression {00} at 
+ source line number 1 source file /usr/src/local/Languages/Awk/awk/bugs-fixed/repetition-no-atom.awk
+ context is
+	 >>> /{00}/ <<< 

bugs-fixed/repetition-overflow.awk

@@ -0,0 +1 @@
+/a{256}/

bugs-fixed/repetition-overflow.ok

@@ -0,0 +1,4 @@
+awk: repetition count a{256} too large
+ source line number 1 source file /home/millert/a
+ context is
+	 >>> /a{256}/ <<<