chore(patches): fix pcre2 regex memory corruption issues

build/openresty/patches/ngx_lua-0.10.26_03-regex-memory-corruption.patch

@@ -0,0 +1,38 @@
+diff --git a/bundle/ngx_lua-0.10.26/src/ngx_http_lua_regex.c b/bundle/ngx_lua-0.10.26/src/ngx_http_lua_regex.c
+index 1b52fa2..30c1650 100644
+--- a/bundle/ngx_lua-0.10.26/src/ngx_http_lua_regex.c
++++ b/bundle/ngx_lua-0.10.26/src/ngx_http_lua_regex.c
+@@ -688,11 +688,11 @@ ngx_http_lua_ffi_exec_regex(ngx_http_lua_regex_t *re, int flags,
+     ngx_pool_t  *old_pool;
+
+     if (flags & NGX_LUA_RE_MODE_DFA) {
+-        ovecsize = 2;
++        ovecsize = 1;
+         re->ncaptures = 0;
+
+     } else {
+-        ovecsize = (re->ncaptures + 1) * 3;
++        ovecsize = re->ncaptures + 1;
+     }
+
+     old_pool = ngx_http_lua_pcre_malloc_init(NULL);
+@@ -710,7 +710,7 @@ ngx_http_lua_ffi_exec_regex(ngx_http_lua_regex_t *re, int flags,
+         }
+
+         ngx_regex_match_data_size = ovecsize;
+-        ngx_regex_match_data = pcre2_match_data_create(ovecsize / 3, NULL);
++        ngx_regex_match_data = pcre2_match_data_create(ovecsize, NULL);
+
+         if (ngx_regex_match_data == NULL) {
+             rc = PCRE2_ERROR_NOMEMORY;
+@@ -756,8 +756,8 @@ ngx_http_lua_ffi_exec_regex(ngx_http_lua_regex_t *re, int flags,
+                    "n %ui, ovecsize %ui", flags, exec_opts, rc, n, ovecsize);
+ #endif
+
+-    if (!(flags & NGX_LUA_RE_MODE_DFA) && n > ovecsize / 3) {
+-        n = ovecsize / 3;
++    if (n > ovecsize) {
++        n = ovecsize;
+     }
+
+     for (i = 0; i < n; i++) {

build/openresty/patches/ngx_stream_lua-0.0.14_03-regex-memory-corruption.patch

@@ -0,0 +1,60 @@
+diff --git a/bundle/ngx_stream_lua-0.0.14/src/ngx_stream_lua_regex.c b/bundle/ngx_stream_lua-0.0.14/src/ngx_stream_lua_regex.c
+index e32744e..241ec00 100644
+--- a/bundle/ngx_stream_lua-0.0.14/src/ngx_stream_lua_regex.c
++++ b/bundle/ngx_stream_lua-0.0.14/src/ngx_stream_lua_regex.c
+@@ -695,11 +695,11 @@ ngx_stream_lua_ffi_exec_regex(ngx_stream_lua_regex_t *re, int flags,
+     ngx_pool_t  *old_pool;
+
+     if (flags & NGX_LUA_RE_MODE_DFA) {
+-        ovecsize = 2;
++        ovecsize = 1;
+         re->ncaptures = 0;
+
+     } else {
+-        ovecsize = (re->ncaptures + 1) * 3;
++        ovecsize = re->ncaptures + 1;
+     }
+
+     old_pool = ngx_stream_lua_pcre_malloc_init(NULL);
+@@ -717,7 +717,7 @@ ngx_stream_lua_ffi_exec_regex(ngx_stream_lua_regex_t *re, int flags,
+         }
+
+         ngx_regex_match_data_size = ovecsize;
+-        ngx_regex_match_data = pcre2_match_data_create(ovecsize / 3, NULL);
++        ngx_regex_match_data = pcre2_match_data_create(ovecsize, NULL);
+
+         if (ngx_regex_match_data == NULL) {
+             rc = PCRE2_ERROR_NOMEMORY;
+@@ -762,8 +762,8 @@ ngx_stream_lua_ffi_exec_regex(ngx_stream_lua_regex_t *re, int flags,
+                    "n %ui, ovecsize %ui", flags, exec_opts, rc, n, ovecsize);
+ #endif
+
+-    if (!(flags & NGX_LUA_RE_MODE_DFA) && n > ovecsize / 3) {
+-        n = ovecsize / 3;
++    if (n > ovecsize) {
++        n = ovecsize;
+     }
+
+     for (i = 0; i < n; i++) {
+@@ -796,6 +796,21 @@ ngx_stream_lua_ffi_exec_regex(ngx_stream_lua_regex_t *re, int flags,
+         re->ncaptures = 0;
+
+     } else {
++        /* How pcre_exec() returns captured substrings
++         * The first two-thirds of the vector is used to pass back captured
++         * substrings, each substring using a pair of integers. The remaining
++         * third of the vector is used as workspace by pcre_exec() while
++         * matching capturing subpatterns, and is not available for passing
++         * back information. The number passed in ovecsize should always be a
++         * multiple of three. If it is not, it is rounded down.
++         *
++         * When a match is successful, information about captured substrings is
++         * returned in pairs of integers, starting at the beginning of ovector,
++         * and continuing up to two-thirds of its length at the most. The first
++         * element of each pair is set to the byte offset of the first character
++         * in a substring, and the second is set to the byte offset of the first
++         * character after the end of a substring.
++         */
+         ovecsize = (re->ncaptures + 1) * 3;
+     }
+