[libxml2] Fix certain combinations of regex range quantifiers

[Nick Wellnhofer <nwellnhof src gnome org>]

commit ea6e8f998dc1a4d465fb8d44c4fad93940ca8280
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Mon Dec 20 00:34:58 2021 +0100

    Fix certain combinations of regex range quantifiers
    
    Fix regex transitions that have both min/max and a counter. In this
    case, we want to save the regex state before incrementing the counter.
    
    Fixes #301 and the issue reported here:
    
    https://mail.gnome.org/archives/xml/2016-April/msg00017.html

 result/regexp/issue301 |  4 ++++
 test/regexp/issue301   |  4 ++++
 xmlregexp.c            | 11 ++++++-----
 3 files changed, 14 insertions(+), 5 deletions(-)
---
diff --git a/result/regexp/issue301 b/result/regexp/issue301
new file mode 100644
index 00000000..90e7c4c0
--- /dev/null
+++ b/result/regexp/issue301
@@ -0,0 +1,4 @@
+Regexp: (a{1,2}|ab){2}
+abab: Ok
+Regexp: ((1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])
+192.168.254.0: Ok
diff --git a/test/regexp/issue301 b/test/regexp/issue301
new file mode 100644
index 00000000..b5a316b1
--- /dev/null
+++ b/test/regexp/issue301
@@ -0,0 +1,4 @@
+=>(a{1,2}|ab){2}
+abab
+=>((1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.){3}(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])
+192.168.254.0
diff --git a/xmlregexp.c b/xmlregexp.c
index 80dfc34a..784563af 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -3364,7 +3364,6 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
                    /*
                     * this is a multiple input sequence
                     * If there is a counter associated increment it now.
-                    * before potentially saving and rollback
                     * do not increment if the counter is already over the
                     * maximum limit in which case get to next transition
                     */
@@ -3380,15 +3379,17 @@ xmlFARegExec(xmlRegexpPtr comp, const xmlChar *content) {
                        counter = &exec->comp->counters[trans->counter];
                        if (exec->counts[trans->counter] >= counter->max)
                            continue; /* for loop on transitions */
-
+                    }
+                    /* Save before incrementing */
+                   if (exec->state->nbTrans > exec->transno + 1) {
+                       xmlFARegExecSave(exec);
+                   }
+                   if (trans->counter >= 0) {
 #ifdef DEBUG_REGEXP_EXEC
                        printf("Increasing count %d\n", trans->counter);
 #endif
                        exec->counts[trans->counter]++;
                    }
-                   if (exec->state->nbTrans > exec->transno + 1) {
-                       xmlFARegExecSave(exec);
-                   }
                    exec->transcount = 1;
                    do {
                        /*