Harden PCRE2 JIT allocator wrappers against NULL allocator_data and zero-size allocation

[orbisai0security]

While reviewing src/pcre2_jit_compile.c, I noticed that the SLJIT allocator wrapper functions assume allocator_data is always a valid pcre2_memctl*.

This patch proposes a small defensive hardening change:

• Return NULL from pcre2_jit_malloc() if allocator_data == NULL or size == 0
• Return early from pcre2_jit_free() if allocator_data == NULL or ptr == NULL

This is not intended to claim a confirmed exploitable vulnerability by itself. It is a robustness improvement to avoid potential NULL dereference or undefined behavior if these wrappers are ever called with invalid allocator context.

If this is acceptable upstream, downstream projects such as Notepad3 can pick it up through their normal PCRE2 vendor update process.

🤖 Generated with Claude Code

[zherczeg]

Thank you for reviewing the jit compiler. Could you trigger the NULL allocator in some way? As far as i remember there is a default allocator which is used when no allocator is passed to PCRE2. So the allocator pointer cannot be NULL. The if statement could be replaced with an ASSERT, since size must be > 0 as well.

[orbisai0security]

Thanks, that makes sense. I don’t currently have a concrete trigger showing allocator_data == NULL through the public PCRE2 API. My concern was based on the wrapper contract rather than a proven reachable path.

Given your point that PCRE2 always supplies a default allocator and that size should also be non-zero, I agree this should not be treated as a security vulnerability.

Would you prefer this PR to be changed to debug assertions documenting those invariants instead, e.g. asserting allocator_data != NULL, size > 0 in pcre2_jit_malloc(), and allocator_data != NULL in pcre2_jit_free()?

[zherczeg]

Yes, asserts are good.

This code ensures that the context always has a malloc/free:
https://github.com/PCRE2Project/pcre2/blob/main/src/pcre2_context.c#L111

The allocator comes from the regex: void *allocator_data = &re->memctl;
https://github.com/PCRE2Project/pcre2/blob/main/src/pcre2_jit_compile.c#L13536

[zherczeg]

a single assert with && is enough.