Fix stack-buffer-overflow in parse_regex due to missing bounds checks

[Shivam7-1]

issue link: https://issues.oss-fuzz.com/issues/388922799
PR description
parse_regex iterates over the input pattern using the *last index but fails to enforce bounds checking before accessing p[*last]. When passed malformed or fuzzed input, this can lead to out-of-bounds reads, causing a crash or undefined behavior.

Fix:
Added strict (*last < pSize) bounds checking to:
-- The main loop condition in parse_regex
-- All cases where p[*last] is accessed (including switch statements and conditions)
Ensured safe handling of escape sequences, character classes, and alternates.
Added early exit if *last exceeds pSize to prevent further processing of invalid input.

[val-ms]

Thank you for working on this. It's one we've been procrastinating because we don't consider this type overflow to be a security issue (hence the issue becoming public. I'll review your work shortly.

[val-ms]

There's an improvement to be made just from reading the code. I still need to think about it harder and play with it.

[val-ms]

I have been unable to reproduce the oss-fuzz issue using oss-fuzz.

E.g. I run python3 infra/helper.py reproduce clamav clamav_dbload_PDB_fuzzer ~/Downloads/clusterfuzz-testcase-minimized-clamav_dbload_PDB_fuzzer-5501437374693376 and it doesn't trigger.

I did run into an unrelated memory leak introduced in 1.5 development that is triggering with all oss-fuzz runs and for which I need to fix to get oss-fuzz testing back up and running. So I made a fix for that here ( #1489 ). But even on that branch, I couldn't reproduce this issue.

That said, I agree with your change.