From pcre changelog, version 7.0:

4. Fixed a major bug that caused incorrect computation of the amount of memory required for a compiled pattern when options that changed within the pattern affected the logic of the preliminary scan that determines the length. The relevant options are -x, and -i in UTF-8 mode. The result was that the computed length was too small. The symptoms of this bug were either the PCRE error "internal error: code overflow" from pcrecompile(), or a glibc crash with a message such as "pcretest: free(): invalid next size (fast)". Examples of patterns that provoked this bug (shown in pcretest format) are:

/(?-x: )/x /(?x)(?-x: \s#\s)/ /((?i)[\x{c0}])/8 /(?i:[\x{c0}])/8

HOWEVER: Change 17 below makes this fix obsolete as the memory computation is now done differently.

Acknowledgements:

Red Hat would like to thank Ludwig Nussel for reporting this issue.

Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified "multiple forms of character class", which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.