Backport PCRE2 fix for GHSA-r9hj-j2rw-4q3m

Cherry-pick of PCRE2Project/pcre2@2b40382980 (out-of-bounds write in JIT matching with large stack allocations), adapted to the bundled 10.40 which has no SSIZE_OF macro.

Author: alexandre-daubois

NEWS

@@ -21,6 +21,10 @@ PHP                                                                        NEWS
     php_openssl_matches_wildcard_name() on crafted server certificate wildcard
     CN). (CVE-2026-91767) (Jakub Zelenka)
 
+- PCRE:
+  . Backported upstream fix for GHSA-r9hj-j2rw-4q3m (Out-of-bounds write in JIT
+    matching with large stack allocations). (Alexandre Daubois)
+
 - Phar:
   . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
     TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

ext/pcre/pcre2lib/pcre2_jit_compile.c

@@ -97,7 +97,7 @@ Fast, but limited size. */
 
 /* Growth rate for stack allocated by the OS. Should be the multiply
 of page size. */
-#define STACK_GROWTH_RATE 8192
+#define STACK_GROWTH_RATE (sljit_sw)8192
 
 /* Enable to check that the allocation could destroy temporaries. */
 #if defined SLJIT_DEBUG && SLJIT_DEBUG
@@ -438,6 +438,8 @@ typedef struct compiler_common {
   BOOL local_quit_available;
   /* Currently in a positive assertion. */
   BOOL in_positive_assertion;
+  /* More than STACK_GROWTH_RATE / 2 stack memory is allocated. */
+  BOOL large_stack_allocation;
   /* Newline control. */
   int nltype;
   sljit_u32 nlmax;
@@ -3144,6 +3146,8 @@ static SLJIT_INLINE void allocate_stack(compiler_common *common, int size)
 DEFINE_COMPILER;
 
 SLJIT_ASSERT(size > 0);
+if (size > (STACK_GROWTH_RATE / ((sljit_s32)sizeof(sljit_sw) * 2)))
+  common->large_stack_allocation = TRUE;
 OP2(SLJIT_SUB, STACK_TOP, 0, STACK_TOP, 0, SLJIT_IMM, size * sizeof(sljit_sw));
 #ifdef DESTROY_REGISTERS
 OP1(SLJIT_MOV, TMP1, 0, SLJIT_IMM, 12345);
@@ -14193,7 +14197,20 @@ SLJIT_ASSERT(TMP1 == SLJIT_R0 && STR_PTR == SLJIT_R1);
 
 OP1(SLJIT_MOV, SLJIT_MEM1(SLJIT_SP), LOCALS1, STR_PTR, 0);
 OP1(SLJIT_MOV, SLJIT_R0, 0, ARGUMENTS, 0);
-OP2(SLJIT_SUB, SLJIT_R1, 0, STACK_LIMIT, 0, SLJIT_IMM, STACK_GROWTH_RATE);
+if (common->large_stack_allocation)
+  {
+  SLJIT_COMPILE_ASSERT((STACK_GROWTH_RATE & (STACK_GROWTH_RATE - 1)) == 0, stack_growth_must_be_power_of_2);
+  // Negative difference. The positive difference would also use the same amount
+  // of operations, but the last subtraction emits several instructions on x86.
+  OP2(SLJIT_SUB, SLJIT_R1, 0, STACK_TOP, 0, STACK_LIMIT, 0);
+  // Minimum extra space after allocation.
+  OP2(SLJIT_SUB, SLJIT_R1, 0, SLJIT_R1, 0, SLJIT_IMM, (STACK_GROWTH_RATE / 2));
+  // Rounds down negative numbers.
+  OP2(SLJIT_AND, SLJIT_R1, 0, SLJIT_R1, 0, SLJIT_IMM, ~(STACK_GROWTH_RATE - 1));
+  OP2(SLJIT_ADD, SLJIT_R1, 0, SLJIT_R1, 0, STACK_LIMIT, 0);
+  }
+else
+  OP2(SLJIT_SUB, SLJIT_R1, 0, STACK_LIMIT, 0, SLJIT_IMM, STACK_GROWTH_RATE);
 OP1(SLJIT_MOV, SLJIT_R0, 0, SLJIT_MEM1(SLJIT_R0), SLJIT_OFFSETOF(jit_arguments, stack));
 OP1(SLJIT_MOV, STACK_LIMIT, 0, TMP2, 0);