mruby-regexp: reject an empty group name - #7021

compile_atom() accepts (?<> as a named capture whose name is zero bytes long.
CRuby rejects an empty group name at compile time; mruby registers it, and the
group is then reachable through every named capture API under the name "".

re = Regexp.new("(?<>x)")   # CRuby: RegexpError (group name is empty)
re.named_captures           # mruby: {"" => 1}
re.match("x")[""]           # mruby: "x"

The backreference form goes the same way once such a group exists:

Regexp.new("(?<>x)\k<>").match("xx")   # mruby: matches   CRuby: RegexpError

\k<> on its own raises in mruby, but for the wrong reason: it resolves to no
group and falls out of the range check as undefined group name reference. It
stops raising as soon as the pattern has an empty named group to resolve to,
which is the case above.

Cause

The scan in the (?<name> branch stops immediately when the next byte is >,
cap_name_len is 0, and nothing tests it. cap_name is non-NULL, so the
registration block stores the entry like any other. The \k<name> branch scans
the same way.

The arena guard leaves a dangling pointer

mrb_re_compile() copies capture names into an arena the regexp owns, because
until that point they point into the pattern source, which in /x mode is a
buffer the function frees before returning. The copy is guarded on the total
length of all names, so for a pattern whose named groups are all empty named,
total is 0, the arena is never allocated, and every
pat->named_captures[i].name keeps pointing at c.stripped:

Regexp.new("(?<>x) ", Regexp::EXTENDED).named_captures   # mruby: {"" => 1}

Nothing dereferences it today, because every reader passes the matching
name_len of 0 to mrb_str_new() or memcmp(), so this is a latent condition
rather than a reproducible fault. Rejecting the empty name in the parser closes
it: total is now zero only when there are no named captures at all, which is
what the guard's comment says.

Change

Two checks, one in each branch, using CRuby's group name is empty message:

$ ./build/host/bin/mruby -e 'Regexp.new("(?<>x)")'
-e:0: group name is empty: /(?<>x)/ (RegexpError)

(?<=...) and (?<!...) are taken by the lookbehind branch, which tests
c->p[2], so neither reaches the new check.

Testing

rake test passes: 1943 tests, 0 failures, 0 crashes. Behaviour checked against
CRuby 4.0.6.

Summary by CodeRabbit

• Bug Fixes

  • Invalid regular expressions with empty named capture-group names or named backreferences now correctly raise RegexpError.
  • Extended-mode patterns now apply the same validation consistently.
  • Existing lookbehind behavior remains unchanged.

• Tests

  • Added regression coverage for invalid empty names and valid lookbehind expressions.