Looking at the Purify dump, I'd suspect the problem starts with the first invalid pointer read: S_nextchar [re_comp.c:3575] for (;;) { if (*PL_regcomp_parse == '(' && PL_regcomp_parse[1] == '?' && => PL_regcomp_parse[2] == '#') { while (*PL_regcomp_parse && *PL_regcomp_parse != ')') PL_regcomp_parse++; PL_regcomp_parse++; S_reg [re_comp.c:1791] FAIL("Eval-group in insecure regular expression"); } => nextchar(); if (logical) { ret = reg_node(LOGICAL); if (!SIZE_ONLY) S_regatom [re_comp.c:2297] break; case '(': nextchar(); => ret = reg(1, &flags); if (ret == NULL) { if (flags & TRYAGAIN) goto tryagain; S_regpiece [re_comp.c:2096] I32 min; I32 max = REG_INFTY; => ret = regatom(&flags); if (ret == NULL) { if (flags & TRYAGAIN) *flagp |= TRYAGAIN; S_regbranch [re_comp.c:2044] nextchar(); while (PL_regcomp_parse < PL_regxend && *PL_regcomp_parse != '|' && *PL_regcomp_parse != ')') { flags &= ~TRYAGAIN; => latest = regpiece(&flags); if (latest == NULL) { if (flags & TRYAGAIN) continue; S_reg [re_comp.c:1902] ret = NULL; /* Pick up the branches, linking them together. */ => br = regbranch(&flags, 1); if (br == NULL) return(NULL); if (*PL_regcomp_parse == '|') { my_regcomp [re_comp.c:1415] PL_regcode->next_off = ((PL_seen_evals > U16_MAX) ? U16_MAX : PL_seen_evals); REGC((U8)REG_MAGIC, (char*) PL_regcode++); r->data = 0; => if (reg(0, &flags) == NULL) return(NULL); /* Dig out information for optimizations. */ ==================================================== Mark Leighton Fisher Thomson Consumer Electronics fisherm@tce.com Indianapolis, IN, USA "Display some adaptability." -- Doug Shaftoe, _Cryptonomicon_Thread Previous