[libc++] Check back reference subscript overflow in a single place.

[timshen]

Summary

Currently it's checked in three places, including one place that's at
regex runtime.

There is no need to do runtime check, as all uses and definitions of
subexpress is known at regex compile-time.

This fixes PR34297.

libcxx/include/regex

public:
 
     virtual void __exec(__state&) const;
 };
 
 template <class _CharT>
 void
 __back_ref<_CharT>::__exec(__state& __s) const
 {
-    if (__mexp_ > __s.__sub_matches_.size())
-        __throw_regex_error<regex_constants::error_backref>();
     sub_match<const _CharT*>& __sm = __s.__sub_matches_[__mexp_-1];
     if (__sm.matched)
     {
         ptrdiff_t __len = __sm.second - __sm.first;
         if (__s.__last_ - __s.__current_ >= __len &&
             _VSTD::equal(__sm.first, __sm.second, __s.__current_))
         {
             __s.__do_ = __state::__accept_but_not_consume;
if (__first != __last)
             ++__first;
         }
         else if ('1' <= *__first && *__first <= '9')
         {
             unsigned __v = *__first - '0';
             for (++__first;
                     __first != __last && '0' <= *__first && *__first <= '9'; ++__first)
                 __v = 10 * __v + *__first - '0';
-            if (__v > mark_count())
-                __throw_regex_error<regex_constants::error_backref>();
             __push_back_ref(__v);
         }
     }
     return __first;
 }
 
 template <class _CharT, class _Traits>
 template <class _ForwardIterator>
__end_->first() = new __word_boundary<_CharT, _Traits>(__traits_, __invert,
                                                            __end_->first());
     __end_ = static_cast<__owns_one_state<_CharT>*>(__end_->first());
 }
 
 template <class _CharT, class _Traits>
 void
 basic_regex<_CharT, _Traits>::__push_back_ref(int __i)
 {
+    if (__i > static_cast<int>(mark_count()))
+        __throw_regex_error<regex_constants::error_backref>();
+
     if (flags() & icase)
         __end_->first() = new __back_ref_icase<_CharT, _Traits>
                                               (__traits_, __i, __end_->first());
     else if (flags() & collate)
         __end_->first() = new __back_ref_collate<_CharT, _Traits>
                                               (__traits_, __i, __end_->first());
     else
         __end_->first() = new __back_ref<_CharT>(__i, __end_->first());

libcxx/test/std/re/re.regex/re.regex.construct/bad_backref.pass.cpp

 
 // template <class ST, class SA>
 //    basic_regex(const basic_string<charT, ST, SA>& s);
 
 #include <regex>
 #include <cassert>
 #include "test_macros.h"
 
-static bool error_badbackref_thrown(const char *pat)
+static bool error_badbackref_thrown(
+    const char *pat,
+    std::regex_constants::syntax_option_type flags =
+        std::regex_constants::ECMAScript)
 {
     bool result = false;
     try {
-        std::regex re(pat);
+        std::regex re(pat, flags);
     } catch (const std::regex_error &ex) {
         result = (ex.code() == std::regex_constants::error_backref);
     }
     return result;
 }
 
 int main()
 {
     assert(error_badbackref_thrown("\\1abc"));      // no references
     assert(error_badbackref_thrown("ab(c)\\2def")); // only one reference
+    assert(error_badbackref_thrown("(cat)\\1", std::regex_constants::basic));
 
 //  this should NOT throw, because we only should look at the '1'
 //  See https://bugs.llvm.org/show_bug.cgi?id=31387
     {
     const char *pat1 = "a(b)c\\1234";
     std::regex re(pat1, pat1 + 7); // extra chars after the end.
     }
 }