changeset 6184:f1728546eca4

On 64-bit hosts (where size_t is 64 bits and int is 32 bits), the old glibc regex code mishandles strings longer than 2**31 bytes. This patch fixes this when the regex code is used in gnulib (i.e., outside glibc). * lib/regex.h (_REGEX_LARGE_OFFSETS): New feature-test macro, governing whether the rest of this patch is active. By default, the macro is disabled and the patch has no effect. (regoff_t) [defined _REGEX_LARGE_OFFSETS]: Define to off_t, not int. (__re_idx_t, __re_size_t, __re_long_size_t): New types. (struct re_pattern_buffer, re_search, re_search_2, re_match): (re_match_2, re_set_registers): Use the new types. * lib/regex_internal.h (Idx, re_hashval_t): New types. (REG_MISSING, REG_ERROR, REG_VALID_INDEX, REG_VALID_NONZERO_INDEX): New macros. (re_node_set, re_charset_t, re_token_t, re_string_realloc_buffers): (re_string_context_at, bin_tree_t, re_dfastate_t): (struct re_state_table_entry, state_array_t, re_sub_match_last_t): (re_sub_match_top_t, re_match_context_t, re_sift_context_t): (struct re_fail_stack_ent_t, struct re_fail_stack_t, struct re_dfa_t): (re_string_char_size_at, re_string_wchar_at): (re_string_elem_size_at): Use the new types and macros to port to 64-bit hosts. Use unsigned types for internal values, so that the code mostly works even for arrays larger than SSIZE_MAX. * lib/regcomp.c (re_compile_internal, init_dfa, duplicate_node): (search_duplicated_node, calc_eclosure_iter, fetch_number): (parse_reg_exp, parse_branch, parse_expression, parse_sub_exp): (build_equiv_class, build_charclass, re_compile_fastmap_iter): (free_dfa_content, create_initial_state, optimize_utf8, analyze): (optimize_subexps, calc_first, link_nfa_nodes, duplicate_node_closure): (calc_inveclosure, parse_dup_op, build_range_exp): (build_collating_symbol, parse_bracket_exp, build_charclass_op): (fetch_number, create_token_tree, mark_opt_subexp): Likewise. * lib/regex_internal.c (re_string_construct_common, create_ci_newstate): (create_cd_newstate, re_string_allocate, re_string_construct): (re_string_realloc_buffers, build_wcs_upper_buffer): (re_string_skip_chars, build_upper_buffer, re_string_translate_buffer): (re_string_reconstruct, re_string_peek_byte_case): (re_string_fetch_byte_case, re_string_context_at): (re_node_set_alloc, re_node_set_init_1, re_node_set_init_2): (re_node_set_init_copy, re_node_set_add_intersect): (re_node_set_init_union, re_node_set_merge, re_node_set_insert): (re_node_set_insert_last, re_node_set_compare, re_node_set_contains): (re_node_set_remove_at, re_dfa_add_node, calc_state_hash): (re_acquire_state, re_acquire_state_context, register_state): Likewise. * lib/regex.c (match_ctx_init, match_ctx_add_entry, search_cur_bkref_entry): (match_ctx_add_subtop, match_ctx_add_sublast, sift_ctx_init): (re_search_internal, re_search_2_stub, re_search_stub) (re_copy_regs, check_matching, check_halt_state_context, update_regs): (push_fail_stack, sift_states_iter_mb, build_sifted_states): (update_cur_sifted_state, check_dst_limits): (check_dst_limits_calc_pos_1, check_dst_limits_calc_pos): (check_subexp_limits, sift_states_bkref, merge_state_array): (check_subexp_matching_top, get_subexp, get_subexp_sub): (find_subexp_node, check_arrival, check_arrival_add_next_nodes): (check_arrival_expand_ecl, check_arrival_expand_ecl_sub): (expand_bkref_cache, check_node_accept_bytes): (group_nodes_into_DFAstates, check_node_accept, regexec, re_match): (re_search, re_match_2, re_search_2, prune_impossible_nodes): (acquire_init_state_context, check_halt_node_context): (proceed_next_node, pop_fail_stack, set_regs, free_fail_stack_return): (sift_states_backward, clean_state_log_if_needed): (sub_epsilon_src_nodes, add_epsilone_src_nodes, merge_state_with_log): (find_recover_state, transit_state_sb, transit_state_mb): (transit_state_bkref, build_trtable, match_ctx_clean): Likewise. * lib/regcomp.c (parse_dup_op): Add an extra test if Idx is unsigned, to work around an assumption that REG_MISSING is negative. * m4/regex.m4 (gl_REGEX): Require AC_SYS_LARGEFILE, Define _REGEX_LARGE_OFFSETS). Test for regoff_t/off_t bug in 64-bit and large-file glibc and in 32-bit large-file Solaris. * config/srclist.txt: Add glibc bug 1281.
author Paul Eggert <eggert@cs.ucla.edu>
date Wed, 31 Aug 2005 22:51:09 +0000
parents d12635ef6eb5
children 6b09f7f6ba73
files config/ChangeLog config/srclist.txt lib/ChangeLog lib/regcomp.c lib/regex.h lib/regex_internal.c lib/regex_internal.h lib/regexec.c m4/ChangeLog m4/regex.m4
diffstat 10 files changed, 797 insertions(+), 591 deletions(-) [+]
line wrap: on
line diff
--- a/config/ChangeLog
+++ b/config/ChangeLog
@@ -1,6 +1,6 @@
 2005-08-31  Paul Eggert  <eggert@cs.ucla.edu>
 
-	* srclist.txt: Add glibc bugs 1273, 1278-1280.
+	* srclist.txt: Add glibc bugs 1273, 1278-1281.
 
 2005-08-25  Paul Eggert  <eggert@cs.ucla.edu>
 
--- a/config/srclist.txt
+++ b/config/srclist.txt
@@ -1,4 +1,4 @@
-# $Id: srclist.txt,v 1.92 2005-08-31 20:27:56 eggert Exp $
+# $Id: srclist.txt,v 1.93 2005-08-31 22:51:09 eggert Exp $
 # Files for which we are not the source.  See ./srclistvars.sh for the
 # variable definitions.
 
@@ -105,6 +105,7 @@
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1273
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1278
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1280
+# http://sources.redhat.com/bugzilla/show_bug.cgi?id=1281
 #$LIBCSRC/posix/regcomp.c		lib gpl
 #
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1238
@@ -117,6 +118,7 @@
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1232
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1236
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1240
+# http://sources.redhat.com/bugzilla/show_bug.cgi?id=1281
 #$LIBCSRC/posix/regex.h			lib gpl
 #
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1215
@@ -127,6 +129,7 @@
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1237
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1241
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1248
+# http://sources.redhat.com/bugzilla/show_bug.cgi?id=1281
 #$LIBCSRC/posix/regex_internal.c		lib gpl
 #
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1054
@@ -137,6 +140,7 @@
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1248
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1273
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1278
+# http://sources.redhat.com/bugzilla/show_bug.cgi?id=1281
 #$LIBCSRC/posix/regex_internal.h		lib gpl
 #
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1216
@@ -150,6 +154,7 @@
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1278
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1279
 # http://sources.redhat.com/bugzilla/show_bug.cgi?id=1280
+# http://sources.redhat.com/bugzilla/show_bug.cgi?id=1281
 #$LIBCSRC/posix/regexec.c		lib gpl
 #
 # c89 changes $LIBCSRC/string/strdup.c		lib gpl
--- a/lib/ChangeLog
+++ b/lib/ChangeLog
@@ -1,5 +1,83 @@
 2005-08-31  Paul Eggert  <eggert@cs.ucla.edu>
 
+	On 64-bit hosts (where size_t is 64 bits and int is 32 bits), the
+	old glibc regex code mishandles strings longer than 2**31 bytes.
+	This patch fixes this when the regex code is used in gnulib
+	(i.e., outside glibc).
+
+	This patch should not affect the use of the regex code inside
+	glibc.  No doubt this problem also needs to be handled for glibc
+	as well, but the result will be an incompatible change to the
+	glibc ABI, and the old ABI will have to be supported too.  That
+	can be the the subject for another patch.
+
+	* regex.h (_REGEX_LARGE_OFFSETS): New feature-test macro,
+	governing whether the rest of this patch is active.  By default,
+	the macro is disabled and the patch has no effect.
+	(regoff_t) [defined _REGEX_LARGE_OFFSETS]: Define to off_t, not int.
+	(__re_idx_t, __re_size_t, __re_long_size_t): New types.
+	(struct re_pattern_buffer, re_search, re_search_2, re_match):
+	(re_match_2, re_set_registers): Use the new types.
+	* regex_internal.h (Idx, re_hashval_t): New types.
+	(REG_MISSING, REG_ERROR, REG_VALID_INDEX, REG_VALID_NONZERO_INDEX):
+	New macros.
+	(re_node_set, re_charset_t, re_token_t, re_string_realloc_buffers):
+	(re_string_context_at, bin_tree_t, re_dfastate_t):
+	(struct re_state_table_entry, state_array_t, re_sub_match_last_t):
+	(re_sub_match_top_t, re_match_context_t, re_sift_context_t):
+	(struct re_fail_stack_ent_t, struct re_fail_stack_t, struct re_dfa_t):
+	(re_string_char_size_at, re_string_wchar_at):
+	(re_string_elem_size_at):
+	Use the new types and macros to port to 64-bit hosts.
+	Use unsigned types for internal values, so that the code
+	mostly works even for arrays larger than SSIZE_MAX.
+	* regcomp.c (re_compile_internal, init_dfa, duplicate_node):
+	(search_duplicated_node, calc_eclosure_iter, fetch_number):
+	(parse_reg_exp, parse_branch, parse_expression, parse_sub_exp):
+	(build_equiv_class, build_charclass, re_compile_fastmap_iter):
+	(free_dfa_content, create_initial_state, optimize_utf8, analyze):
+	(optimize_subexps, calc_first, link_nfa_nodes, duplicate_node_closure):
+	(calc_inveclosure, parse_dup_op, build_range_exp):
+	(build_collating_symbol, parse_bracket_exp, build_charclass_op):
+	(fetch_number, create_token_tree, mark_opt_subexp):
+	Likewise.
+	* regex_internal.c (re_string_construct_common, create_ci_newstate):
+	(create_cd_newstate, re_string_allocate, re_string_construct):
+	(re_string_realloc_buffers, build_wcs_upper_buffer):
+	(re_string_skip_chars, build_upper_buffer, re_string_translate_buffer):
+	(re_string_reconstruct, re_string_peek_byte_case):
+	(re_string_fetch_byte_case, re_string_context_at):
+	(re_node_set_alloc, re_node_set_init_1, re_node_set_init_2):
+	(re_node_set_init_copy, re_node_set_add_intersect):
+	(re_node_set_init_union, re_node_set_merge, re_node_set_insert):
+	(re_node_set_insert_last, re_node_set_compare, re_node_set_contains):
+	(re_node_set_remove_at, re_dfa_add_node, calc_state_hash):
+	(re_acquire_state, re_acquire_state_context, register_state):
+	Likewise.
+	* regex.c (match_ctx_init, match_ctx_add_entry, search_cur_bkref_entry):
+	(match_ctx_add_subtop, match_ctx_add_sublast, sift_ctx_init):
+	(re_search_internal, re_search_2_stub, re_search_stub)
+	(re_copy_regs, check_matching, check_halt_state_context, update_regs):
+	(push_fail_stack, sift_states_iter_mb, build_sifted_states):
+	(update_cur_sifted_state, check_dst_limits):
+	(check_dst_limits_calc_pos_1, check_dst_limits_calc_pos):
+	(check_subexp_limits, sift_states_bkref, merge_state_array):
+	(check_subexp_matching_top, get_subexp, get_subexp_sub):
+	(find_subexp_node, check_arrival, check_arrival_add_next_nodes):
+	(check_arrival_expand_ecl, check_arrival_expand_ecl_sub):
+	(expand_bkref_cache, check_node_accept_bytes):
+	(group_nodes_into_DFAstates, check_node_accept, regexec, re_match):
+	(re_search, re_match_2, re_search_2, prune_impossible_nodes):
+	(acquire_init_state_context, check_halt_node_context):
+	(proceed_next_node, pop_fail_stack, set_regs, free_fail_stack_return):
+	(sift_states_backward, clean_state_log_if_needed):
+	(sub_epsilon_src_nodes, add_epsilone_src_nodes, merge_state_with_log):
+	(find_recover_state, transit_state_sb, transit_state_mb):
+	(transit_state_bkref, build_trtable, match_ctx_clean):
+	Likewise.
+	* regcomp.c (parse_dup_op): Add an extra test if Idx is unsigned,
+	to work around an assumption that REG_MISSING is negative.
+
 	* regcomp.c (re_comp) [defined _REGEX_RE_COMP || defined _LIBC]:
 	(seek_collating_symbol_entry) [defined _LIBC]:
 	(lookup_collation_sequence_value) [defined _LIBC]:
--- a/lib/regcomp.c
+++ b/lib/regcomp.c
@@ -18,11 +18,11 @@
    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
 
 static reg_errcode_t re_compile_internal (regex_t *preg, const char * pattern,
-					  int length, reg_syntax_t syntax);
+					  Idx length, reg_syntax_t syntax);
 static void re_compile_fastmap_iter (regex_t *bufp,
 				     const re_dfastate_t *init_state,
 				     char *fastmap);
-static reg_errcode_t init_dfa (re_dfa_t *dfa, int pat_len);
+static reg_errcode_t init_dfa (re_dfa_t *dfa, Idx pat_len);
 #ifdef RE_ENABLE_I18N
 static void free_charset (re_charset_t *cset);
 #endif /* RE_ENABLE_I18N */
@@ -45,14 +45,14 @@
 static reg_errcode_t calc_first (void *extra, bin_tree_t *node);
 static reg_errcode_t calc_next (void *extra, bin_tree_t *node);
 static reg_errcode_t link_nfa_nodes (void *extra, bin_tree_t *node);
-static int duplicate_node (re_dfa_t *dfa, int org_idx, unsigned int constraint);
-static int search_duplicated_node (re_dfa_t *dfa, int org_node,
+static Idx duplicate_node (re_dfa_t *dfa, Idx org_idx, unsigned int constraint);
+static Idx search_duplicated_node (re_dfa_t *dfa, Idx org_node,
 				   unsigned int constraint);
 static reg_errcode_t calc_eclosure (re_dfa_t *dfa);
 static reg_errcode_t calc_eclosure_iter (re_node_set *new_set, re_dfa_t *dfa,
-					 int node, int root);
+					 Idx node, int root);
 static reg_errcode_t calc_inveclosure (re_dfa_t *dfa);
-static int fetch_number (re_string_t *input, re_token_t *token,
+static Idx fetch_number (re_string_t *input, re_token_t *token,
 			 reg_syntax_t syntax);
 static int peek_token (re_token_t *token, re_string_t *input,
 			reg_syntax_t syntax);
@@ -60,16 +60,16 @@
 			  reg_syntax_t syntax, reg_errcode_t *err);
 static bin_tree_t *parse_reg_exp (re_string_t *regexp, regex_t *preg,
 				  re_token_t *token, reg_syntax_t syntax,
-				  int nest, reg_errcode_t *err);
+				  Idx nest, reg_errcode_t *err);
 static bin_tree_t *parse_branch (re_string_t *regexp, regex_t *preg,
 				 re_token_t *token, reg_syntax_t syntax,
-				 int nest, reg_errcode_t *err);
+				 Idx nest, reg_errcode_t *err);
 static bin_tree_t *parse_expression (re_string_t *regexp, regex_t *preg,
 				     re_token_t *token, reg_syntax_t syntax,
-				     int nest, reg_errcode_t *err);
+				     Idx nest, reg_errcode_t *err);
 static bin_tree_t *parse_sub_exp (re_string_t *regexp, regex_t *preg,
 				  re_token_t *token, reg_syntax_t syntax,
-				  int nest, reg_errcode_t *err);
+				  Idx nest, reg_errcode_t *err);
 static bin_tree_t *parse_dup_op (bin_tree_t *dup_elem, re_string_t *regexp,
 				 re_dfa_t *dfa, re_token_t *token,
 				 reg_syntax_t syntax, reg_errcode_t *err);
@@ -88,12 +88,12 @@
 #ifdef RE_ENABLE_I18N
 static reg_errcode_t build_equiv_class (re_bitset_ptr_t sbcset,
 					re_charset_t *mbcset,
-					int *equiv_class_alloc,
+					Idx *equiv_class_alloc,
 					const unsigned char *name);
 static reg_errcode_t build_charclass (unsigned REG_TRANSLATE_TYPE trans,
 				      re_bitset_ptr_t sbcset,
 				      re_charset_t *mbcset,
-				      int *char_class_alloc,
+				      Idx *char_class_alloc,
 				      const unsigned char *class_name,
 				      reg_syntax_t syntax);
 #else  /* not RE_ENABLE_I18N */
@@ -298,11 +298,11 @@
 			 char *fastmap)
 {
   re_dfa_t *dfa = (re_dfa_t *) bufp->re_buffer;
-  int node_cnt;
+  Idx node_cnt;
   int icase = (dfa->mb_cur_max == 1 && (bufp->re_syntax & REG_IGNORE_CASE));
   for (node_cnt = 0; node_cnt < init_state->nodes.nelem; ++node_cnt)
     {
-      int node = init_state->nodes.elems[node_cnt];
+      Idx node = init_state->nodes.elems[node_cnt];
       re_token_type_t type = dfa->nodes[node].type;
 
       if (type == CHARACTER)
@@ -342,7 +342,7 @@
 #ifdef RE_ENABLE_I18N
       else if (type == COMPLEX_BRACKET)
 	{
-	  int i;
+	  Idx i;
 	  re_charset_t *cset = dfa->nodes[node].opr.mbcset;
 	  if (cset->non_match || cset->ncoll_syms || cset->nequiv_classes
 	      || cset->nranges || cset->nchar_classes)
@@ -558,7 +558,7 @@
 static void
 free_dfa_content (re_dfa_t *dfa)
 {
-  int i, j;
+  Idx i, j;
 
   if (dfa->nodes)
     for (i = 0; i < dfa->nodes_len; ++i)
@@ -697,7 +697,7 @@
    SYNTAX indicate regular expression's syntax.  */
 
 static reg_errcode_t
-re_compile_internal (regex_t *preg, const char * pattern, int length,
+re_compile_internal (regex_t *preg, const char *pattern, Idx length,
 		     reg_syntax_t syntax)
 {
   reg_errcode_t err = REG_NOERROR;
@@ -795,9 +795,9 @@
    as the initial length of some arrays.  */
 
 static reg_errcode_t
-init_dfa (re_dfa_t *dfa, int pat_len)
+init_dfa (re_dfa_t *dfa, Idx pat_len)
 {
-  unsigned int table_size;
+  __re_size_t table_size;
 #ifndef _LIBC
   char *codeset_name;
 #endif
@@ -811,9 +811,9 @@
   dfa->nodes = re_malloc (re_token_t, dfa->nodes_alloc);
 
   /*  table_size = 2 ^ ceil(log pat_len) */
-  for (table_size = 1; ; table_size <<= 1)
-    if (table_size > pat_len)
-      break;
+  for (table_size = 1; table_size <= pat_len; table_size <<= 1)
+    if (0 < (Idx) -1 && table_size == 0)
+      return REG_ESPACE;
 
   dfa->state_table = re_calloc (struct re_state_table_entry, table_size);
   dfa->state_hash_mask = table_size - 1;
@@ -925,7 +925,7 @@
 static reg_errcode_t
 create_initial_state (re_dfa_t *dfa)
 {
-  int first, i;
+  Idx first, i;
   reg_errcode_t err;
   re_node_set init_nodes;
 
@@ -944,10 +944,10 @@
   if (dfa->nbackref > 0)
     for (i = 0; i < init_nodes.nelem; ++i)
       {
-	int node_idx = init_nodes.elems[i];
+	Idx node_idx = init_nodes.elems[i];
 	re_token_type_t type = dfa->nodes[node_idx].type;
 
-	int clexp_idx;
+	Idx clexp_idx;
 	if (type != OP_BACK_REF)
 	  continue;
 	for (clexp_idx = 0; clexp_idx < init_nodes.nelem; ++clexp_idx)
@@ -963,7 +963,7 @@
 
 	if (type == OP_BACK_REF)
 	  {
-	    int dest_idx = dfa->edests[node_idx].elems[0];
+	    Idx dest_idx = dfa->edests[node_idx].elems[0];
 	    if (!re_node_set_contains (&init_nodes, dest_idx))
 	      {
 		re_node_set_merge (&init_nodes, dfa->eclosures + dest_idx);
@@ -1007,7 +1007,8 @@
 static void
 optimize_utf8 (re_dfa_t *dfa)
 {
-  int node, i, mb_chars = 0, has_period = 0;
+  Idx node;
+  int i, mb_chars = 0, has_period = 0;
 
   for (node = 0; node < dfa->nodes_len; ++node)
     switch (dfa->nodes[node].type)
@@ -1078,18 +1079,18 @@
   reg_errcode_t ret;
 
   /* Allocate arrays.  */
-  dfa->nexts = re_malloc (int, dfa->nodes_alloc);
-  dfa->org_indices = re_malloc (int, dfa->nodes_alloc);
+  dfa->nexts = re_malloc (Idx, dfa->nodes_alloc);
+  dfa->org_indices = re_malloc (Idx, dfa->nodes_alloc);
   dfa->edests = re_malloc (re_node_set, dfa->nodes_alloc);
   dfa->eclosures = re_malloc (re_node_set, dfa->nodes_alloc);
   if (BE (dfa->nexts == NULL || dfa->org_indices == NULL || dfa->edests == NULL
 	  || dfa->eclosures == NULL, 0))
     return REG_ESPACE;
 
-  dfa->subexp_map = re_malloc (int, preg->re_nsub);
+  dfa->subexp_map = re_malloc (Idx, preg->re_nsub);
   if (dfa->subexp_map != NULL)
     {
-      int i;
+      Idx i;
       for (i = 0; i < preg->re_nsub; i++)
 	dfa->subexp_map[i] = i;
       preorder (dfa->str_tree, optimize_subexps, dfa);
@@ -1214,7 +1215,7 @@
   else if (node->token.type == SUBEXP
            && node->left && node->left->token.type == SUBEXP)
     {
-      int other_idx = node->left->token.opr.idx;
+      Idx other_idx = node->left->token.opr.idx;
 
       node->left = node->left->left;
       if (node->left)
@@ -1301,7 +1302,7 @@
     {
       node->first = node;
       node->node_idx = re_dfa_add_node (dfa, node->token);
-      if (BE (node->node_idx == -1, 0))
+      if (BE (node->node_idx == REG_MISSING, 0))
         return REG_ESPACE;
     }
   return REG_NOERROR;
@@ -1335,7 +1336,7 @@
 link_nfa_nodes (void *extra, bin_tree_t *node)
 {
   re_dfa_t *dfa = (re_dfa_t *) extra;
-  int idx = node->node_idx;
+  Idx idx = node->node_idx;
   reg_errcode_t err = REG_NOERROR;
 
   switch (node->token.type)
@@ -1350,7 +1351,7 @@
     case OP_DUP_ASTERISK:
     case OP_ALT:
       {
-	int left, right;
+	Idx left, right;
 	dfa->has_plural_match = 1;
 	if (node->left != NULL)
 	  left = node->left->first->node_idx;
@@ -1360,8 +1361,8 @@
 	  right = node->right->first->node_idx;
 	else
 	  right = node->next->node_idx;
-	assert (left > -1);
-	assert (right > -1);
+	assert (REG_VALID_INDEX (left));
+	assert (REG_VALID_INDEX (right));
 	err = re_node_set_init_2 (dfa->edests + idx, left, right);
       }
       break;
@@ -1392,14 +1393,16 @@
    to their own constraint.  */
 
 static reg_errcode_t
-duplicate_node_closure (re_dfa_t *dfa, int top_org_node, int top_clone_node,
-			int root_node, unsigned int init_constraint)
+duplicate_node_closure (re_dfa_t *dfa, Idx top_org_node,
+			Idx top_clone_node, Idx root_node,
+			unsigned int init_constraint)
 {
-  int org_node, clone_node, ret;
+  Idx org_node, clone_node;
+  int ret;
   unsigned int constraint = init_constraint;
   for (org_node = top_org_node, clone_node = top_clone_node;;)
     {
-      int org_dest, clone_dest;
+      Idx org_dest, clone_dest;
       if (dfa->nodes[org_node].type == OP_BACK_REF)
 	{
 	  /* If the back reference epsilon-transit, its destination must
@@ -1409,7 +1412,7 @@
 	  org_dest = dfa->nexts[org_node];
 	  re_node_set_empty (dfa->edests + clone_node);
 	  clone_dest = duplicate_node (dfa, org_dest, constraint);
-	  if (BE (clone_dest == -1, 0))
+	  if (BE (clone_dest == REG_MISSING, 0))
 	    return REG_ESPACE;
 	  dfa->nexts[clone_node] = dfa->nexts[org_node];
 	  ret = re_node_set_insert (dfa->edests + clone_node, clone_dest);
@@ -1447,7 +1450,7 @@
 	      constraint |= dfa->nodes[org_node].opr.ctx_type;
 	    }
 	  clone_dest = duplicate_node (dfa, org_dest, constraint);
-	  if (BE (clone_dest == -1, 0))
+	  if (BE (clone_dest == REG_MISSING, 0))
 	    return REG_ESPACE;
 	  ret = re_node_set_insert (dfa->edests + clone_node, clone_dest);
 	  if (BE (ret < 0, 0))
@@ -1461,12 +1464,12 @@
 	  re_node_set_empty (dfa->edests + clone_node);
 	  /* Search for a duplicated node which satisfies the constraint.  */
 	  clone_dest = search_duplicated_node (dfa, org_dest, constraint);
-	  if (clone_dest == -1)
+	  if (clone_dest == REG_MISSING)
 	    {
 	      /* There are no such a duplicated node, create a new one.  */
 	      reg_errcode_t err;
 	      clone_dest = duplicate_node (dfa, org_dest, constraint);
-	      if (BE (clone_dest == -1, 0))
+	      if (BE (clone_dest == REG_MISSING, 0))
 		return REG_ESPACE;
 	      ret = re_node_set_insert (dfa->edests + clone_node, clone_dest);
 	      if (BE (ret < 0, 0))
@@ -1487,7 +1490,7 @@
 
 	  org_dest = dfa->edests[org_node].elems[1];
 	  clone_dest = duplicate_node (dfa, org_dest, constraint);
-	  if (BE (clone_dest == -1, 0))
+	  if (BE (clone_dest == REG_MISSING, 0))
 	    return REG_ESPACE;
 	  ret = re_node_set_insert (dfa->edests + clone_node, clone_dest);
 	  if (BE (ret < 0, 0))
@@ -1502,28 +1505,29 @@
 /* Search for a node which is duplicated from the node ORG_NODE, and
    satisfies the constraint CONSTRAINT.  */
 
-static int
-search_duplicated_node (re_dfa_t *dfa, int org_node, unsigned int constraint)
+static Idx
+search_duplicated_node (re_dfa_t *dfa, Idx org_node,
+			unsigned int constraint)
 {
-  int idx;
+  Idx idx;
   for (idx = dfa->nodes_len - 1; dfa->nodes[idx].duplicated && idx > 0; --idx)
     {
       if (org_node == dfa->org_indices[idx]
 	  && constraint == dfa->nodes[idx].constraint)
 	return idx; /* Found.  */
     }
-  return -1; /* Not found.  */
+  return REG_MISSING; /* Not found.  */
 }
 
 /* Duplicate the node whose index is ORG_IDX and set the constraint CONSTRAINT.
-   Return the index of the new node, or -1 if insufficient storage is
+   Return the index of the new node, or REG_MISSING if insufficient storage is
    available.  */
 
-static int
-duplicate_node (re_dfa_t *dfa, int org_idx, unsigned int constraint)
+static Idx
+duplicate_node (re_dfa_t *dfa, Idx org_idx, unsigned int constraint)
 {
-  int dup_idx = re_dfa_add_node (dfa, dfa->nodes[org_idx]);
-  if (BE (dup_idx != -1, 1))
+  Idx dup_idx = re_dfa_add_node (dfa, dfa->nodes[org_idx]);
+  if (BE (dup_idx != REG_MISSING, 1))
     {
       dfa->nodes[dup_idx].constraint = constraint;
       if (dfa->nodes[org_idx].type == ANCHOR)
@@ -1539,17 +1543,18 @@
 static reg_errcode_t
 calc_inveclosure (re_dfa_t *dfa)
 {
-  int src, idx, ret;
+  Idx src, idx;
+  int ret;
   for (idx = 0; idx < dfa->nodes_len; ++idx)
     re_node_set_init_empty (dfa->inveclosures + idx);
 
   for (src = 0; src < dfa->nodes_len; ++src)
     {
-      int *elems = dfa->eclosures[src].elems;
+      Idx *elems = dfa->eclosures[src].elems;
       for (idx = 0; idx < dfa->eclosures[src].nelem; ++idx)
 	{
 	  ret = re_node_set_insert_last (dfa->inveclosures + elems[idx], src);
-	  if (BE (ret == -1, 0))
+	  if (BE (ret == REG_MISSING, 0))
 	    return REG_ESPACE;
 	}
     }
@@ -1562,7 +1567,8 @@
 static reg_errcode_t
 calc_eclosure (re_dfa_t *dfa)
 {
-  int node_idx, incomplete;
+  Idx node_idx;
+  int incomplete;
 #ifdef DEBUG
   assert (dfa->nodes_len > 0);
 #endif
@@ -1581,7 +1587,7 @@
 	}
 
 #ifdef DEBUG
-      assert (dfa->eclosures[node_idx].nelem != -1);
+      assert (dfa->eclosures[node_idx].nelem != REG_MISSING);
 #endif
 
       /* If we have already calculated, skip it.  */
@@ -1604,11 +1610,12 @@
 /* Calculate epsilon closure of NODE.  */
 
 static reg_errcode_t
-calc_eclosure_iter (re_node_set *new_set, re_dfa_t *dfa, int node, int root)
+calc_eclosure_iter (re_node_set *new_set, re_dfa_t *dfa, Idx node, int root)
 {
   reg_errcode_t err;
   unsigned int constraint;
-  int i, incomplete;
+  Idx i;
+  int incomplete;
   re_node_set eclosure;
   incomplete = 0;
   err = re_node_set_alloc (&eclosure, dfa->edests[node].nelem + 1);
@@ -1617,7 +1624,7 @@
 
   /* This indicates that we are calculating this node now.
      We reference this value to avoid infinite loop.  */
-  dfa->eclosures[node].nelem = -1;
+  dfa->eclosures[node].nelem = REG_MISSING;
 
   constraint = ((dfa->nodes[node].type == ANCHOR)
 		? dfa->nodes[node].opr.ctx_type : 0);
@@ -1627,7 +1634,7 @@
       && dfa->edests[node].nelem
       && !dfa->nodes[dfa->edests[node].elems[0]].duplicated)
     {
-      int org_node, cur_node;
+      Idx org_node, cur_node;
       org_node = cur_node = node;
       err = duplicate_node_closure (dfa, node, node, node, constraint);
       if (BE (err != REG_NOERROR, 0))
@@ -1639,10 +1646,10 @@
     for (i = 0; i < dfa->edests[node].nelem; ++i)
       {
 	re_node_set eclosure_elem;
-	int edest = dfa->edests[node].elems[i];
+	Idx edest = dfa->edests[node].elems[i];
 	/* If calculating the epsilon closure of `edest' is in progress,
 	   return intermediate result.  */
-	if (dfa->eclosures[edest].nelem == -1)
+	if (dfa->eclosures[edest].nelem == REG_MISSING)
 	  {
 	    incomplete = 1;
 	    continue;
@@ -2062,7 +2069,7 @@
 
 static bin_tree_t *
 parse_reg_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
-	       reg_syntax_t syntax, int nest, reg_errcode_t *err)
+	       reg_syntax_t syntax, Idx nest, reg_errcode_t *err)
 {
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
   bin_tree_t *tree, *branch = NULL;
@@ -2103,7 +2110,7 @@
 
 static bin_tree_t *
 parse_branch (re_string_t *regexp, regex_t *preg, re_token_t *token,
-	      reg_syntax_t syntax, int nest, reg_errcode_t *err)
+	      reg_syntax_t syntax, Idx nest, reg_errcode_t *err)
 {
   bin_tree_t *tree, *exp;
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
@@ -2143,7 +2150,7 @@
 
 static bin_tree_t *
 parse_expression (re_string_t *regexp, regex_t *preg, re_token_t *token,
-		  reg_syntax_t syntax, int nest, reg_errcode_t *err)
+		  reg_syntax_t syntax, Idx nest, reg_errcode_t *err)
 {
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
   bin_tree_t *tree;
@@ -2359,7 +2366,7 @@
 
 static bin_tree_t *
 parse_sub_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
-	       reg_syntax_t syntax, int nest, reg_errcode_t *err)
+	       reg_syntax_t syntax, Idx nest, reg_errcode_t *err)
 {
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
   bin_tree_t *tree;
@@ -2400,14 +2407,14 @@
 	      re_token_t *token, reg_syntax_t syntax, reg_errcode_t *err)
 {
   bin_tree_t *tree = NULL, *old_tree = NULL;
-  int i, start, end, start_idx = re_string_cur_idx (regexp);
+  Idx i, start, end, start_idx = re_string_cur_idx (regexp);
   re_token_t start_token = *token;
 
   if (token->type == OP_OPEN_DUP_NUM)
     {
       end = 0;
       start = fetch_number (regexp, token, syntax);
-      if (start == -1)
+      if (start == REG_MISSING)
 	{
 	  if (token->type == CHARACTER && token->opr.c == ',')
 	    start = 0; /* We treat "{,m}" as "{0,m}".  */
@@ -2417,14 +2424,14 @@
 	      return NULL;
 	    }
 	}
-      if (BE (start != -2, 1))
+      if (BE (start != REG_ERROR, 1))
 	{
 	  /* We treat "{n}" as "{n,n}".  */
 	  end = ((token->type == OP_CLOSE_DUP_NUM) ? start
 		 : ((token->type == CHARACTER && token->opr.c == ',')
-		    ? fetch_number (regexp, token, syntax) : -2));
+		    ? fetch_number (regexp, token, syntax) : REG_ERROR));
 	}
-      if (BE (start == -2 || end == -2, 0))
+      if (BE (start == REG_ERROR || end == REG_ERROR, 0))
 	{
 	  /* Invalid sequence.  */
 	  if (BE (!(syntax & REG_INVALID_INTERVAL_ORD), 0))
@@ -2446,7 +2453,7 @@
 	  return elem;
 	}
 
-      if (BE (end != -1 && start > end, 0))
+      if (BE (end != REG_MISSING && start > end, 0))
 	{
 	  /* First number greater than second.  */
 	  *err = REG_BADBR;
@@ -2456,7 +2463,7 @@
   else
     {
       start = (token->type == OP_DUP_PLUS) ? 1 : 0;
-      end = (token->type == OP_DUP_QUESTION) ? 1 : -1;
+      end = (token->type == OP_DUP_QUESTION) ? 1 : REG_MISSING;
     }
 
   fetch_token (token, regexp, syntax);
@@ -2494,24 +2501,26 @@
   if (elem->token.type == SUBEXP)
     postorder (elem, mark_opt_subexp, (void *) (long) elem->token.opr.idx);
 
-  tree = create_tree (dfa, elem, NULL, (end == -1 ? OP_DUP_ASTERISK : OP_ALT));
+  tree = create_tree (dfa, elem, NULL,
+		      (end == REG_MISSING ? OP_DUP_ASTERISK : OP_ALT));
   if (BE (tree == NULL, 0))
     goto parse_dup_op_espace;
 
-  /* This loop is actually executed only when end != -1,
+  /* This loop is actually executed only when end != REG_MISSING,
      to rewrite <re>{0,n} as (<re>(<re>...<re>?)?)?...  We have
      already created the start+1-th copy.  */
-  for (i = start + 2; i <= end; ++i)
-    {
-      elem = duplicate_tree (elem, dfa);
-      tree = create_tree (dfa, tree, elem, CONCAT);
-      if (BE (elem == NULL || tree == NULL, 0))
-        goto parse_dup_op_espace;
-
-      tree = create_tree (dfa, tree, NULL, OP_ALT);
-      if (BE (tree == NULL, 0))
-        goto parse_dup_op_espace;
-    }
+  if ((Idx) -1 < 0 || end != REG_MISSING)
+    for (i = start + 2; i <= end; ++i)
+      {
+	elem = duplicate_tree (elem, dfa);
+	tree = create_tree (dfa, tree, elem, CONCAT);
+	if (BE (elem == NULL || tree == NULL, 0))
+	  goto parse_dup_op_espace;
+
+	tree = create_tree (dfa, tree, NULL, OP_ALT);
+	if (BE (tree == NULL, 0))
+	  goto parse_dup_op_espace;
+      }
 
   if (old_tree)
     tree = create_tree (dfa, old_tree, tree, CONCAT);
@@ -2538,7 +2547,7 @@
 static reg_errcode_t
 build_range_exp (re_bitset_ptr_t sbcset,
 # ifdef RE_ENABLE_I18N
-		 re_charset_t *mbcset, int *range_alloc,
+		 re_charset_t *mbcset, Idx *range_alloc,
 # endif
 		 bracket_elem_t *start_elem, bracket_elem_t *end_elem)
 {
@@ -2592,7 +2601,7 @@
           {
 	    /* There is not enough space, need realloc.  */
 	    wchar_t *new_array_start, *new_array_end;
-	    int new_nranges;
+	    Idx new_nranges;
 
 	    /* +1 in case of mbcset->nranges is 0.  */
 	    new_nranges = 2 * mbcset->nranges + 1;
@@ -2655,7 +2664,7 @@
 static reg_errcode_t
 build_collating_symbol (re_bitset_ptr_t sbcset,
 # ifdef RE_ENABLE_I18N
-			re_charset_t *mbcset, int *coll_sym_alloc,
+			re_charset_t *mbcset, Idx *coll_sym_alloc,
 # endif
 			const unsigned char *name)
 {
@@ -2790,7 +2799,7 @@
   auto inline reg_errcode_t
   __attribute ((always_inline))
   build_range_exp (re_bitset_ptr_t sbcset, re_charset_t *mbcset,
-		   int *range_alloc,
+		   Idx *range_alloc,
 		   bracket_elem_t *start_elem, bracket_elem_t *end_elem)
     {
       unsigned int ch;
@@ -2824,7 +2833,7 @@
 	      /* There is not enough space, need realloc.  */
 	      uint32_t *new_array_start;
 	      uint32_t *new_array_end;
-	      int new_nranges;
+	      Idx new_nranges;
 
 	      /* +1 in case of mbcset->nranges is 0.  */
 	      new_nranges = 2 * mbcset->nranges + 1;
@@ -2871,7 +2880,7 @@
   auto inline reg_errcode_t
   __attribute ((always_inline))
   build_collating_symbol (re_bitset_ptr_t sbcset, re_charset_t *mbcset,
-			  int *coll_sym_alloc, const unsigned char *name)
+			  Idx *coll_sym_alloc, const unsigned char *name)
     {
       int32_t elem, idx;
       size_t name_len = strlen ((const char *) name);
@@ -2901,7 +2910,7 @@
 	    {
 	      /* Not enough, realloc it.  */
 	      /* +1 in case of mbcset->ncoll_syms is 0.  */
-	      int new_coll_sym_alloc = 2 * mbcset->ncoll_syms + 1;
+	      Idx new_coll_sym_alloc = 2 * mbcset->ncoll_syms + 1;
 	      /* Use realloc since mbcset->coll_syms is NULL
 		 if *alloc == 0.  */
 	      int32_t *new_coll_syms = re_realloc (mbcset->coll_syms, int32_t,
@@ -2931,8 +2940,8 @@
   re_bitset_ptr_t sbcset;
 #ifdef RE_ENABLE_I18N
   re_charset_t *mbcset;
-  int coll_sym_alloc = 0, range_alloc = 0, mbchar_alloc = 0;
-  int equiv_class_alloc = 0, char_class_alloc = 0;
+  Idx coll_sym_alloc = 0, range_alloc = 0, mbchar_alloc = 0;
+  Idx equiv_class_alloc = 0, char_class_alloc = 0;
 #endif /* not RE_ENABLE_I18N */
   int non_match = 0;
   bin_tree_t *work_tree;
@@ -3307,7 +3316,7 @@
 static reg_errcode_t
 build_equiv_class (re_bitset_ptr_t sbcset,
 #ifdef RE_ENABLE_I18N
-		   re_charset_t *mbcset, int *equiv_class_alloc,
+		   re_charset_t *mbcset, Idx *equiv_class_alloc,
 #endif
 		   const unsigned char *name)
 {
@@ -3367,7 +3376,7 @@
 	{
 	  /* Not enough, realloc it.  */
 	  /* +1 in case of mbcset->nequiv_classes is 0.  */
-	  int new_equiv_class_alloc = 2 * mbcset->nequiv_classes + 1;
+	  Idx new_equiv_class_alloc = 2 * mbcset->nequiv_classes + 1;
 	  /* Use realloc since the array is NULL if *alloc == 0.  */
 	  int32_t *new_equiv_classes = re_realloc (mbcset->equiv_classes,
 						   int32_t,
@@ -3398,7 +3407,7 @@
 static reg_errcode_t
 build_charclass (unsigned REG_TRANSLATE_TYPE trans, re_bitset_ptr_t sbcset,
 #ifdef RE_ENABLE_I18N
-		 re_charset_t *mbcset, int *char_class_alloc,
+		 re_charset_t *mbcset, Idx *char_class_alloc,
 #endif
 		 const unsigned char *class_name, reg_syntax_t syntax)
 {
@@ -3417,7 +3426,7 @@
     {
       /* Not enough, realloc it.  */
       /* +1 in case of mbcset->nchar_classes is 0.  */
-      int new_char_class_alloc = 2 * mbcset->nchar_classes + 1;
+      Idx new_char_class_alloc = 2 * mbcset->nchar_classes + 1;
       /* Use realloc since array is NULL if *alloc == 0.  */
       wctype_t *new_char_classes = re_realloc (mbcset->char_classes, wctype_t,
 					       new_char_class_alloc);
@@ -3478,7 +3487,7 @@
   re_bitset_ptr_t sbcset;
 #ifdef RE_ENABLE_I18N
   re_charset_t *mbcset;
-  int alloc = 0;
+  Idx alloc = 0;
 #endif /* not RE_ENABLE_I18N */
   reg_errcode_t ret;
   re_token_t br_token;
@@ -3583,25 +3592,27 @@
 
 /* This is intended for the expressions like "a{1,3}".
    Fetch a number from `input', and return the number.
-   Return -1, if the number field is empty like "{,1}".
-   Return -2, If an error is occured.  */
-
-static int
+   Return REG_MISSING if the number field is empty like "{,1}".
+   Return REG_ERROR if an error occurred.  */
+
+static Idx
 fetch_number (re_string_t *input, re_token_t *token, reg_syntax_t syntax)
 {
-  int num = -1;
+  Idx num = REG_MISSING;
   unsigned char c;
   while (1)
     {
       fetch_token (token, input, syntax);
       c = token->opr.c;
       if (BE (token->type == END_OF_RE, 0))
-	return -2;
+	return REG_ERROR;
       if (token->type == OP_CLOSE_DUP_NUM || c == ',')
 	break;
-      num = ((token->type != CHARACTER || c < '0' || '9' < c || num == -2)
-	     ? -2 : ((num == -1) ? c - '0' : num * 10 + c - '0'));
-      num = (num > REG_DUP_MAX) ? -2 : num;
+      num = ((token->type != CHARACTER || c < '0' || '9' < c
+	      || num == REG_ERROR)
+	     ? REG_ERROR
+	     : ((num == REG_MISSING) ? c - '0' : num * 10 + c - '0'));
+      num = (num > REG_DUP_MAX) ? REG_ERROR : num;
     }
   return num;
 }
@@ -3660,7 +3671,7 @@
   tree->token.opt_subexp = 0;
   tree->first = NULL;
   tree->next = NULL;
-  tree->node_idx = -1;
+  tree->node_idx = REG_MISSING;
 
   if (left != NULL)
     left->parent = tree;
@@ -3675,7 +3686,7 @@
 static reg_errcode_t
 mark_opt_subexp (void *extra, bin_tree_t *node)
 {
-  int idx = (int) (long) extra;
+  Idx idx = (Idx) (long) extra;
   if (node->token.type == SUBEXP && node->token.opr.idx == idx)
     node->token.opt_subexp = 1;
 
--- a/lib/regex.h
+++ b/lib/regex.h
@@ -43,6 +43,46 @@
 # include <stddef.h>
 #endif
 
+#ifdef _REGEX_LARGE_OFFSETS
+
+/* Use types and values that are wide enough to represent signed and
+   unsigned byte offsets in memory.  This currently works only when
+   the regex code is used outside of the GNU C library; it is not yet
+   supported within glibc itself, and glibc users should not define
+   _REGEX_LARGE_OFFSETS.  */
+
+/* The type of the offset of a byte within a string.
+   For historical reasons POSIX 1003.1-2004 requires that regoff_t be
+   at least as wide as off_t.  This is a bit odd (and many common
+   POSIX platforms set it to the more-sensible ssize_t) but we might
+   as well conform.  We don't know of any hosts where ssize_t is wider
+   than off_t, so off_t is safe.  */
+typedef off_t regoff_t;
+
+/* The type of nonnegative object indexes.  Traditionally, GNU regex
+   uses 'int' for these.  Code that uses __re_idx_t should work
+   regardless of whether the type is signed.  */
+typedef size_t __re_idx_t;
+
+/* The type of object sizes.  */
+typedef size_t __re_size_t;
+
+/* The type of object sizes, in places where the traditional code
+   uses unsigned long int.  */
+typedef size_t __re_long_size_t;
+
+#else
+
+/* Use types that are binary-compatible with the traditional GNU regex
+   implementation, which mishandles strings longer than INT_MAX.  */
+
+typedef int regoff_t;
+typedef int __re_idx_t;
+typedef unsigned int __re_size_t;
+typedef unsigned long int __re_long_size_t;
+
+#endif
+
 /* The following two types have to be signed and unsigned integer type
    wide enough to hold a value of a pointer.  For most ANSI compilers
    ptrdiff_t and size_t should be likely OK.  Still size of these two
@@ -416,10 +456,10 @@
   unsigned char *_REG_RE_NAME (buffer);
 
 	/* Number of bytes to which `re_buffer' points.  */
-  unsigned long int _REG_RE_NAME (allocated);
+  __re_long_size_t _REG_RE_NAME (allocated);
 
 	/* Number of bytes actually used in `re_buffer'.  */
-  unsigned long int _REG_RE_NAME (used);
+  __re_long_size_t _REG_RE_NAME (used);
 
         /* Syntax setting with which the pattern was compiled.  */
   reg_syntax_t _REG_RE_NAME (syntax);
@@ -477,15 +517,11 @@
 
 typedef struct re_pattern_buffer regex_t;
 
-/* Type for byte offsets within the string.  POSIX mandates this.  */
-typedef int regoff_t;
-
-
 /* This is the structure we store register match data in.  See
    regex.texinfo for a full description of what registers match.  */
 struct re_registers
 {
-  unsigned int _REG_RM_NAME (num_regs);
+  __re_size_t _REG_RM_NAME (num_regs);
   regoff_t *_REG_RM_NAME (start);
   regoff_t *_REG_RM_NAME (end);
 };
@@ -532,31 +568,35 @@
    characters.  Return the starting position of the match, -1 for no
    match, or -2 for an internal error.  Also return register
    information in REGS (if REGS and BUFFER->re_no_sub are nonzero).  */
-extern int re_search (struct re_pattern_buffer *__buffer, const char *__string,
-		      int __length, int __start, int __range,
-		      struct re_registers *__regs);
+extern regoff_t re_search (struct re_pattern_buffer *__buffer,
+			   const char *__string, __re_idx_t __length,
+			   __re_idx_t __start, regoff_t __range,
+			   struct re_registers *__regs);
 
 
 /* Like `re_search', but search in the concatenation of STRING1 and
    STRING2.  Also, stop searching at index START + STOP.  */
-extern int re_search_2 (struct re_pattern_buffer *__buffer,
-			const char *__string1, int __length1,
-			const char *__string2, int __length2,
-			int __start, int __range, struct re_registers *__regs,
-			int __stop);
+extern regoff_t re_search_2 (struct re_pattern_buffer *__buffer,
+			     const char *__string1, __re_idx_t __length1,
+			     const char *__string2, __re_idx_t __length2,
+			     __re_idx_t __start, regoff_t __range,
+			     struct re_registers *__regs,
+			     __re_idx_t __stop);
 
 
 /* Like `re_search', but return how many characters in STRING the regexp
    in BUFFER matched, starting at position START.  */
-extern int re_match (struct re_pattern_buffer *__buffer, const char *__string,
-		     int __length, int __start, struct re_registers *__regs);
+extern regoff_t re_match (struct re_pattern_buffer *__buffer,
+			  const char *__string, __re_idx_t __length,
+			  __re_idx_t __start, struct re_registers *__regs);
 
 
 /* Relates to `re_match' as `re_search_2' relates to `re_search'.  */
-extern int re_match_2 (struct re_pattern_buffer *__buffer,
-		       const char *__string1, int __length1,
-		       const char *__string2, int __length2,
-		       int __start, struct re_registers *__regs, int __stop);
+extern regoff_t re_match_2 (struct re_pattern_buffer *__buffer,
+			    const char *__string1, __re_idx_t __length1,
+			    const char *__string2, __re_idx_t __length2,
+			    __re_idx_t __start, struct re_registers *__regs,
+			    __re_idx_t __stop);
 
 
 /* Set REGS to hold NUM_REGS registers, storing them in STARTS and
@@ -573,7 +613,7 @@
    freeing the old data.  */
 extern void re_set_registers (struct re_pattern_buffer *__buffer,
 			      struct re_registers *__regs,
-			      unsigned int __num_regs,
+			      __re_size_t __num_regs,
 			      regoff_t *__starts, regoff_t *__ends);
 
 #if defined _REGEX_RE_COMP || defined _LIBC
--- a/lib/regex_internal.c
+++ b/lib/regex_internal.c
@@ -17,17 +17,17 @@
    with this program; if not, write to the Free Software Foundation,
    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
 
-static void re_string_construct_common (const char *str, int len,
+static void re_string_construct_common (const char *str, Idx len,
 					re_string_t *pstr,
 					REG_TRANSLATE_TYPE trans, int icase,
 					const re_dfa_t *dfa) internal_function;
 static re_dfastate_t *create_ci_newstate (re_dfa_t *dfa,
 					  const re_node_set *nodes,
-					  unsigned int hash) internal_function;
+					  re_hashval_t hash) internal_function;
 static re_dfastate_t *create_cd_newstate (re_dfa_t *dfa,
 					  const re_node_set *nodes,
 					  unsigned int context,
-					  unsigned int hash) internal_function;
+					  re_hashval_t hash) internal_function;
 
 /* Functions for string operation.  */
 
@@ -36,11 +36,11 @@
 
 static reg_errcode_t
 internal_function
-re_string_allocate (re_string_t *pstr, const char *str, int len, int init_len,
+re_string_allocate (re_string_t *pstr, const char *str, Idx len, Idx init_len,
 		    REG_TRANSLATE_TYPE trans, int icase, const re_dfa_t *dfa)
 {
   reg_errcode_t ret;
-  int init_buf_len;
+  Idx init_buf_len;
 
   /* Ensure at least one character fits into the buffers.  */
   if (init_len < dfa->mb_cur_max)
@@ -64,7 +64,7 @@
 
 static reg_errcode_t
 internal_function
-re_string_construct (re_string_t *pstr, const char *str, int len,
+re_string_construct (re_string_t *pstr, const char *str, Idx len,
 		     REG_TRANSLATE_TYPE trans, int icase, const re_dfa_t *dfa)
 {
   reg_errcode_t ret;
@@ -127,7 +127,7 @@
 
 static reg_errcode_t
 internal_function
-re_string_realloc_buffers (re_string_t *pstr, int new_buf_len)
+re_string_realloc_buffers (re_string_t *pstr, Idx new_buf_len)
 {
 #ifdef RE_ENABLE_I18N
   if (pstr->mb_cur_max > 1)
@@ -138,7 +138,7 @@
       pstr->wcs = new_wcs;
       if (pstr->offsets != NULL)
 	{
-	  int *new_offsets = re_realloc (pstr->offsets, int, new_buf_len);
+	  Idx *new_offsets = re_realloc (pstr->offsets, Idx, new_buf_len);
 	  if (BE (new_offsets == NULL, 0))
 	    return REG_ESPACE;
 	  pstr->offsets = new_offsets;
@@ -160,7 +160,7 @@
 
 static void
 internal_function
-re_string_construct_common (const char *str, int len, re_string_t *pstr,
+re_string_construct_common (const char *str, Idx len, re_string_t *pstr,
 			    REG_TRANSLATE_TYPE trans, int icase,
 			    const re_dfa_t *dfa)
 {
@@ -201,7 +201,7 @@
   unsigned char buf[64];
 #endif
   mbstate_t prev_st;
-  int byte_idx, end_idx, remain_len;
+  Idx byte_idx, end_idx, remain_len;
   size_t mbclen;
 
   /* Build the buffers from pstr->valid_len to either pstr->len or
@@ -263,7 +263,7 @@
 build_wcs_upper_buffer (re_string_t *pstr)
 {
   mbstate_t prev_st;
-  int src_idx, byte_idx, end_idx, remain_len;
+  Idx src_idx, byte_idx, end_idx, remain_len;
   size_t mbclen;
 #ifdef _LIBC
   char buf[MB_LEN_MAX];
@@ -392,7 +392,7 @@
 
 		    if (pstr->offsets == NULL)
 		      {
-			pstr->offsets = re_malloc (int, pstr->bufs_len);
+			pstr->offsets = re_malloc (Idx, pstr->bufs_len);
 
 			if (pstr->offsets == NULL)
 			  return REG_ESPACE;
@@ -474,12 +474,12 @@
 /* Skip characters until the index becomes greater than NEW_RAW_IDX.
    Return the index.  */
 
-static int
+static Idx
 internal_function
-re_string_skip_chars (re_string_t *pstr, int new_raw_idx, wint_t *last_wc)
+re_string_skip_chars (re_string_t *pstr, Idx new_raw_idx, wint_t *last_wc)
 {
   mbstate_t prev_st;
-  int rawbuf_idx;
+  Idx rawbuf_idx;
   size_t mbclen;
   wchar_t wc = 0;
 
@@ -487,7 +487,7 @@
   for (rawbuf_idx = pstr->raw_mbs_idx + pstr->valid_raw_len;
        rawbuf_idx < new_raw_idx;)
     {
-      int remain_len;
+      Idx remain_len;
       remain_len = pstr->len - rawbuf_idx;
       prev_st = pstr->cur_state;
       mbclen = mbrtowc (&wc, (const char *) pstr->raw_mbs + rawbuf_idx,
@@ -513,7 +513,7 @@
 internal_function
 build_upper_buffer (re_string_t *pstr)
 {
-  int char_idx, end_idx;
+  Idx char_idx, end_idx;
   end_idx = (pstr->bufs_len > pstr->len) ? pstr->len : pstr->bufs_len;
 
   for (char_idx = pstr->valid_len; char_idx < end_idx; ++char_idx)
@@ -536,7 +536,7 @@
 internal_function
 re_string_translate_buffer (re_string_t *pstr)
 {
-  int buf_idx, end_idx;
+  Idx buf_idx, end_idx;
   end_idx = (pstr->bufs_len > pstr->len) ? pstr->len : pstr->bufs_len;
 
   for (buf_idx = pstr->valid_len; buf_idx < end_idx; ++buf_idx)
@@ -555,9 +555,9 @@
 
 static reg_errcode_t
 internal_function
-re_string_reconstruct (re_string_t *pstr, int idx, int eflags)
+re_string_reconstruct (re_string_t *pstr, Idx idx, int eflags)
 {
-  int offset = idx - pstr->raw_mbs_idx;
+  regoff_t offset = (regoff_t) idx - (regoff_t) pstr->raw_mbs_idx;
   if (BE (offset < 0, 0))
     {
       /* Reset buffer.  */
@@ -621,7 +621,7 @@
 #ifdef RE_ENABLE_I18N
 	  if (pstr->mb_cur_max > 1)
 	    {
-	      int wcs_idx;
+	      Idx wcs_idx;
 	      wint_t wc = WEOF;
 
 	      if (pstr->is_utf8)
@@ -637,7 +637,7 @@
 		      {
 			mbstate_t cur_state;
 			wchar_t wc2;
-			int mlen = raw + pstr->len - p;
+			Idx mlen = raw + pstr->len - p;
 			unsigned char buf[6];
 
 			q = p;
@@ -732,9 +732,10 @@
 
 static unsigned char
 internal_function __attribute ((pure))
-re_string_peek_byte_case (const re_string_t *pstr, int idx)
+re_string_peek_byte_case (const re_string_t *pstr, Idx idx)
 {
-  int ch, off;
+  int ch;
+  Idx off;
 
   /* Handle the common (easiest) cases first.  */
   if (BE (!pstr->mbs_allocated, 1))
@@ -776,7 +777,8 @@
 #ifdef RE_ENABLE_I18N
   if (pstr->offsets_needed)
     {
-      int off, ch;
+      Idx off;
+      int ch;
 
       /* For tr_TR.UTF-8 [[:islower:]] there is
 	 [[: CAPITAL LETTER I WITH DOT lower:]] in mbs.  Skip
@@ -819,10 +821,10 @@
 
 static unsigned int
 internal_function
-re_string_context_at (const re_string_t *input, int idx, int eflags)
+re_string_context_at (const re_string_t *input, Idx idx, int eflags)
 {
   int c;
-  if (BE (idx < 0, 0))
+  if (BE (! REG_VALID_INDEX (idx), 0))
     /* In this case, we use the value stored in input->tip_context,
        since we can't know the character in input->mbs[-1] here.  */
     return input->tip_context;
@@ -833,7 +835,7 @@
   if (input->mb_cur_max > 1)
     {
       wint_t wc;
-      int wc_idx = idx;
+      Idx wc_idx = idx;
       while(input->wcs[wc_idx] == WEOF)
 	{
 #ifdef DEBUG
@@ -864,11 +866,11 @@
 
 static reg_errcode_t
 internal_function
-re_node_set_alloc (re_node_set *set, int size)
+re_node_set_alloc (re_node_set *set, Idx size)
 {
   set->alloc = size;
   set->nelem = 0;
-  set->elems = re_malloc (int, size);
+  set->elems = re_malloc (Idx, size);
   if (BE (set->elems == NULL, 0))
     return REG_ESPACE;
   return REG_NOERROR;
@@ -876,11 +878,11 @@
 
 static reg_errcode_t
 internal_function
-re_node_set_init_1 (re_node_set *set, int elem)
+re_node_set_init_1 (re_node_set *set, Idx elem)
 {
   set->alloc = 1;
   set->nelem = 1;
-  set->elems = re_malloc (int, 1);
+  set->elems = re_malloc (Idx, 1);
   if (BE (set->elems == NULL, 0))
     {
       set->alloc = set->nelem = 0;
@@ -892,10 +894,10 @@
 
 static reg_errcode_t
 internal_function
-re_node_set_init_2 (re_node_set *set, int elem1, int elem2)
+re_node_set_init_2 (re_node_set *set, Idx elem1, Idx elem2)
 {
   set->alloc = 2;
-  set->elems = re_malloc (int, 2);
+  set->elems = re_malloc (Idx, 2);
   if (BE (set->elems == NULL, 0))
     return REG_ESPACE;
   if (elem1 == elem2)
@@ -928,13 +930,13 @@
   if (src->nelem > 0)
     {
       dest->alloc = dest->nelem;
-      dest->elems = re_malloc (int, dest->alloc);
+      dest->elems = re_malloc (Idx, dest->alloc);
       if (BE (dest->elems == NULL, 0))
 	{
 	  dest->alloc = dest->nelem = 0;
 	  return REG_ESPACE;
 	}
-      memcpy (dest->elems, src->elems, src->nelem * sizeof (int));
+      memcpy (dest->elems, src->elems, src->nelem * sizeof dest->elems[0]);
     }
   else
     re_node_set_init_empty (dest);
@@ -950,7 +952,7 @@
 re_node_set_add_intersect (re_node_set *dest, const re_node_set *src1,
 			   const re_node_set *src2)
 {
-  int i1, i2, is, id, delta, sbase;
+  Idx i1, i2, is, id, delta, sbase;
   if (src1->nelem == 0 || src2->nelem == 0)
     return REG_NOERROR;
 
@@ -958,8 +960,8 @@
      conservative estimate.  */
   if (src1->nelem + src2->nelem + dest->nelem > dest->alloc)
     {
-      int new_alloc = src1->nelem + src2->nelem + dest->alloc;
-      int *new_elems = re_realloc (dest->elems, int, new_alloc);
+      Idx new_alloc = src1->nelem + src2->nelem + dest->alloc;
+      Idx *new_elems = re_realloc (dest->elems, Idx, new_alloc);
       if (BE (new_elems == NULL, 0))
         return REG_ESPACE;
       dest->elems = new_elems;
@@ -977,25 +979,25 @@
       if (src1->elems[i1] == src2->elems[i2])
 	{
 	  /* Try to find the item in DEST.  Maybe we could binary search?  */
-	  while (id >= 0 && dest->elems[id] > src1->elems[i1])
+	  while (REG_VALID_INDEX (id) && dest->elems[id] > src1->elems[i1])
 	    --id;
 
-          if (id < 0 || dest->elems[id] != src1->elems[i1])
+          if (! REG_VALID_INDEX (id) || dest->elems[id] != src1->elems[i1])
             dest->elems[--sbase] = src1->elems[i1];
 
-	  if (--i1 < 0 || --i2 < 0)
+	  if (! REG_VALID_INDEX (--i1) || ! REG_VALID_INDEX (--i2))
 	    break;
 	}
 
       /* Lower the highest of the two items.  */
       else if (src1->elems[i1] < src2->elems[i2])
 	{
-	  if (--i2 < 0)
+	  if (! REG_VALID_INDEX (--i2))
 	    break;
 	}
       else
 	{
-	  if (--i1 < 0)
+	  if (! REG_VALID_INDEX (--i1))
 	    break;
 	}
     }
@@ -1008,7 +1010,7 @@
      DEST elements are already in place; this is more or
      less the same loop that is in re_node_set_merge.  */
   dest->nelem += delta;
-  if (delta > 0 && id >= 0)
+  if (delta > 0 && REG_VALID_INDEX (id))
     for (;;)
       {
         if (dest->elems[is] > dest->elems[id])
@@ -1022,13 +1024,13 @@
           {
             /* Slide from the bottom.  */
             dest->elems[id + delta] = dest->elems[id];
-            if (--id < 0)
+            if (! REG_VALID_INDEX (--id))
               break;
           }
       }
 
   /* Copy remaining SRC elements.  */
-  memcpy (dest->elems, dest->elems + sbase, delta * sizeof (int));
+  memcpy (dest->elems, dest->elems + sbase, delta * sizeof dest->elems[0]);
 
   return REG_NOERROR;
 }
@@ -1041,11 +1043,11 @@
 re_node_set_init_union (re_node_set *dest, const re_node_set *src1,
 			const re_node_set *src2)
 {
-  int i1, i2, id;
+  Idx i1, i2, id;
   if (src1 != NULL && src1->nelem > 0 && src2 != NULL && src2->nelem > 0)
     {
       dest->alloc = src1->nelem + src2->nelem;
-      dest->elems = re_malloc (int, dest->alloc);
+      dest->elems = re_malloc (Idx, dest->alloc);
       if (BE (dest->elems == NULL, 0))
 	return REG_ESPACE;
     }
@@ -1073,13 +1075,13 @@
   if (i1 < src1->nelem)
     {
       memcpy (dest->elems + id, src1->elems + i1,
-	     (src1->nelem - i1) * sizeof (int));
+	     (src1->nelem - i1) * sizeof dest->elems[0]);
       id += src1->nelem - i1;
     }
   else if (i2 < src2->nelem)
     {
       memcpy (dest->elems + id, src2->elems + i2,
-	     (src2->nelem - i2) * sizeof (int));
+	     (src2->nelem - i2) * sizeof dest->elems[0]);
       id += src2->nelem - i2;
     }
   dest->nelem = id;
@@ -1093,13 +1095,13 @@
 internal_function
 re_node_set_merge (re_node_set *dest, const re_node_set *src)
 {
-  int is, id, sbase, delta;
+  Idx is, id, sbase, delta;
   if (src == NULL || src->nelem == 0)
     return REG_NOERROR;
   if (dest->alloc < 2 * src->nelem + dest->nelem)
     {
-      int new_alloc = 2 * (src->nelem + dest->alloc);
-      int *new_buffer = re_realloc (dest->elems, int, new_alloc);
+      Idx new_alloc = 2 * (src->nelem + dest->alloc);
+      Idx *new_buffer = re_realloc (dest->elems, Idx, new_alloc);
       if (BE (new_buffer == NULL, 0))
 	return REG_ESPACE;
       dest->elems = new_buffer;
@@ -1109,14 +1111,15 @@
   if (BE (dest->nelem == 0, 0))
     {
       dest->nelem = src->nelem;
-      memcpy (dest->elems, src->elems, src->nelem * sizeof (int));
+      memcpy (dest->elems, src->elems, src->nelem * sizeof dest->elems[0]);
       return REG_NOERROR;
     }
 
   /* Copy into the top of DEST the items of SRC that are not
      found in DEST.  Maybe we could binary search in DEST?  */
   for (sbase = dest->nelem + 2 * src->nelem,
-       is = src->nelem - 1, id = dest->nelem - 1; is >= 0 && id >= 0; )
+       is = src->nelem - 1, id = dest->nelem - 1;
+       REG_VALID_INDEX (is) && REG_VALID_INDEX (id); )
     {
       if (dest->elems[id] == src->elems[is])
         is--, id--;
@@ -1126,11 +1129,12 @@
         --id;
     }
 
-  if (is >= 0)
+  if (REG_VALID_INDEX (is))
     {
       /* If DEST is exhausted, the remaining items of SRC must be unique.  */
       sbase -= is + 1;
-      memcpy (dest->elems + sbase, src->elems, (is + 1) * sizeof (int));
+      memcpy (dest->elems + sbase, src->elems,
+	      (is + 1) * sizeof dest->elems[0]);
     }
 
   id = dest->nelem - 1;
@@ -1155,11 +1159,11 @@
         {
           /* Slide from the bottom.  */
           dest->elems[id + delta] = dest->elems[id];
-	  if (--id < 0)
+	  if (! REG_VALID_INDEX (--id))
 	    {
 	      /* Copy remaining SRC elements.  */
 	      memcpy (dest->elems, dest->elems + sbase,
-	              delta * sizeof (int));
+	              delta * sizeof dest->elems[0]);
 	      break;
 	    }
 	}
@@ -1174,9 +1178,9 @@
 
 static int
 internal_function
-re_node_set_insert (re_node_set *set, int elem)
+re_node_set_insert (re_node_set *set, Idx elem)
 {
-  int idx;
+  Idx idx;
   /* In case the set is empty.  */
   if (set->alloc == 0)
     {
@@ -1197,9 +1201,9 @@
   /* Realloc if we need.  */
   if (set->alloc == set->nelem)
     {
-      int *new_elems;
+      Idx *new_elems;
       set->alloc = set->alloc * 2;
-      new_elems = re_realloc (set->elems, int, set->alloc);
+      new_elems = re_realloc (set->elems, Idx, set->alloc);
       if (BE (new_elems == NULL, 0))
 	return -1;
       set->elems = new_elems;
@@ -1231,14 +1235,14 @@
 
 static int
 internal_function
-re_node_set_insert_last (re_node_set *set, int elem)
+re_node_set_insert_last (re_node_set *set, Idx elem)
 {
   /* Realloc if we need.  */
   if (set->alloc == set->nelem)
     {
-      int *new_elems;
+      Idx *new_elems;
       set->alloc = (set->alloc + 1) * 2;
-      new_elems = re_realloc (set->elems, int, set->alloc);
+      new_elems = re_realloc (set->elems, Idx, set->alloc);
       if (BE (new_elems == NULL, 0))
 	return -1;
       set->elems = new_elems;
@@ -1256,10 +1260,10 @@
 internal_function __attribute ((pure))
 re_node_set_compare (const re_node_set *set1, const re_node_set *set2)
 {
-  int i;
+  Idx i;
   if (set1 == NULL || set2 == NULL || set1->nelem != set2->nelem)
     return 0;
-  for (i = set1->nelem ; --i >= 0 ; )
+  for (i = set1->nelem ; REG_VALID_INDEX (--i) ; )
     if (set1->elems[i] != set2->elems[i])
       return 0;
   return 1;
@@ -1267,12 +1271,12 @@
 
 /* Return (idx + 1) if SET contains the element ELEM, return 0 otherwise.  */
 
-static int
+static Idx
 internal_function __attribute ((pure))
-re_node_set_contains (const re_node_set *set, int elem)
+re_node_set_contains (const re_node_set *set, Idx elem)
 {
-  unsigned int idx, right, mid;
-  if (set->nelem <= 0)
+  __re_size_t idx, right, mid;
+  if (! REG_VALID_NONZERO_INDEX (set->nelem))
     return 0;
 
   /* Binary search the element.  */
@@ -1291,7 +1295,7 @@
 
 static void
 internal_function
-re_node_set_remove_at (re_node_set *set, int idx)
+re_node_set_remove_at (re_node_set *set, Idx idx)
 {
   if (idx < 0 || idx >= set->nelem)
     return;
@@ -1302,31 +1306,31 @@
 
 
 /* Add the token TOKEN to dfa->nodes, and return the index of the token.
-   Or return -1, if an error will be occured.  */
+   Or return REG_MISSING if an error occurred.  */
 
-static int
+static Idx
 internal_function
 re_dfa_add_node (re_dfa_t *dfa, re_token_t token)
 {
   int type = token.type;
   if (BE (dfa->nodes_len >= dfa->nodes_alloc, 0))
     {
-      int new_nodes_alloc = dfa->nodes_alloc * 2;
-      int *new_nexts, *new_indices;
+      Idx new_nodes_alloc = dfa->nodes_alloc * 2;
+      Idx *new_nexts, *new_indices;
       re_node_set *new_edests, *new_eclosures;
 
       re_token_t *new_nodes = re_realloc (dfa->nodes, re_token_t,
 					  new_nodes_alloc);
       if (BE (new_nodes == NULL, 0))
-	return -1;
+	return REG_MISSING;
       dfa->nodes = new_nodes;
-      new_nexts = re_realloc (dfa->nexts, int, new_nodes_alloc);
-      new_indices = re_realloc (dfa->org_indices, int, new_nodes_alloc);
+      new_nexts = re_realloc (dfa->nexts, Idx, new_nodes_alloc);
+      new_indices = re_realloc (dfa->org_indices, Idx, new_nodes_alloc);
       new_edests = re_realloc (dfa->edests, re_node_set, new_nodes_alloc);
       new_eclosures = re_realloc (dfa->eclosures, re_node_set, new_nodes_alloc);
       if (BE (new_nexts == NULL || new_indices == NULL
 	      || new_edests == NULL || new_eclosures == NULL, 0))
-	return -1;
+	return REG_MISSING;
       dfa->nexts = new_nexts;
       dfa->org_indices = new_indices;
       dfa->edests = new_edests;
@@ -1339,18 +1343,18 @@
   dfa->nodes[dfa->nodes_len].accept_mb =
     (type == OP_PERIOD && dfa->mb_cur_max > 1) || type == COMPLEX_BRACKET;
 #endif
-  dfa->nexts[dfa->nodes_len] = -1;
+  dfa->nexts[dfa->nodes_len] = REG_MISSING;
   re_node_set_init_empty (dfa->edests + dfa->nodes_len);
   re_node_set_init_empty (dfa->eclosures + dfa->nodes_len);
   return dfa->nodes_len++;
 }
 
-static inline unsigned int
+static inline re_hashval_t
 internal_function
 calc_state_hash (const re_node_set *nodes, unsigned int context)
 {
-  unsigned int hash = nodes->nelem + context;
-  int i;
+  re_hashval_t hash = nodes->nelem + context;
+  Idx i;
   for (i = 0 ; i < nodes->nelem ; i++)
     hash += nodes->elems[i];
   return hash;
@@ -1369,10 +1373,10 @@
 internal_function
 re_acquire_state (reg_errcode_t *err, re_dfa_t *dfa, const re_node_set *nodes)
 {
-  unsigned int hash;
+  re_hashval_t hash;
   re_dfastate_t *new_state;
   struct re_state_table_entry *spot;
-  int i;
+  Idx i;
 #ifdef lint
   /* Suppress bogus uninitialized-variable warnings.  */
   *err = REG_NOERROR;
@@ -1420,10 +1424,10 @@
 re_acquire_state_context (reg_errcode_t *err, re_dfa_t *dfa,
 			  const re_node_set *nodes, unsigned int context)
 {
-  unsigned int hash;
+  re_hashval_t hash;
   re_dfastate_t *new_state;
   struct re_state_table_entry *spot;
-  int i;
+  Idx i;
 #ifdef lint
   /* Suppress bogus uninitialized-variable warnings.  */
   *err = REG_NOERROR;
@@ -1461,11 +1465,11 @@
 
 static reg_errcode_t
 internal_function
-register_state (re_dfa_t *dfa, re_dfastate_t *newstate, unsigned int hash)
+register_state (re_dfa_t *dfa, re_dfastate_t *newstate, re_hashval_t hash)
 {
   struct re_state_table_entry *spot;
   reg_errcode_t err;
-  int i;
+  Idx i;
 
   newstate->hash = hash;
   err = re_node_set_alloc (&newstate->non_eps_nodes, newstate->nodes.nelem);
@@ -1473,7 +1477,7 @@
     return REG_ESPACE;
   for (i = 0; i < newstate->nodes.nelem; i++)
     {
-      int elem = newstate->nodes.elems[i];
+      Idx elem = newstate->nodes.elems[i];
       if (!IS_EPSILON_NODE (dfa->nodes[elem].type))
         re_node_set_insert_last (&newstate->non_eps_nodes, elem);
     }
@@ -1481,7 +1485,7 @@
   spot = dfa->state_table + (hash & dfa->state_hash_mask);
   if (BE (spot->alloc <= spot->num, 0))
     {
-      int new_alloc = 2 * spot->num + 2;
+      Idx new_alloc = 2 * spot->num + 2;
       re_dfastate_t **new_array = re_realloc (spot->array, re_dfastate_t *,
 					      new_alloc);
       if (BE (new_array == NULL, 0))
@@ -1498,9 +1502,9 @@
 
 static re_dfastate_t *
 internal_function
-create_ci_newstate (re_dfa_t *dfa, const re_node_set *nodes, unsigned int hash)
+create_ci_newstate (re_dfa_t *dfa, const re_node_set *nodes, re_hashval_t hash)
 {
-  int i;
+  Idx i;
   reg_errcode_t err;
   re_dfastate_t *newstate;
 
@@ -1548,9 +1552,9 @@
 static re_dfastate_t *
 internal_function
 create_cd_newstate (re_dfa_t *dfa, const re_node_set *nodes,
-		    unsigned int context, unsigned int hash)
+		    unsigned int context, re_hashval_t hash)
 {
-  int i, nctx_nodes = 0;
+  Idx i, nctx_nodes = 0;
   reg_errcode_t err;
   re_dfastate_t *newstate;
 
--- a/lib/regex_internal.h
+++ b/lib/regex_internal.h
@@ -121,6 +121,31 @@
 extern const char __re_error_msgid[] attribute_hidden;
 extern const size_t __re_error_msgid_idx[] attribute_hidden;
 
+typedef __re_idx_t Idx;
+
+/* Special return value for failure to match.  */
+#define REG_MISSING ((Idx) -1)
+
+/* Special return value for internal error.  */
+#define REG_ERROR ((Idx) -2)
+
+/* Test whether N is a valid index, and is not one of the above.  */
+#ifdef _REGEX_LARGE_OFFSETS
+# define REG_VALID_INDEX(n) ((Idx) (n) < REG_ERROR)
+#else
+# define REG_VALID_INDEX(n) (0 <= (n))
+#endif
+
+/* Test whether N is a valid nonzero index.  */
+#ifdef _REGEX_LARGE_OFFSETS
+# define REG_VALID_NONZERO_INDEX(n) ((Idx) ((n) - 1) < (Idx) (REG_ERROR - 1))
+#else
+# define REG_VALID_NONZERO_INDEX(n) (0 < (n))
+#endif
+
+/* A hash value, suitable for computing hash tables.  */
+typedef __re_size_t re_hashval_t;
+
 /* Number of bits in an unsinged int.  */
 #define UINT_BITS (sizeof (unsigned int) * CHAR_BIT)
 /* Number of unsigned int in an bit_set.  */
@@ -165,9 +190,9 @@
 
 typedef struct
 {
-  int alloc;
-  int nelem;
-  int *elems;
+  Idx alloc;
+  Idx nelem;
+  Idx *elems;
 } re_node_set;
 
 typedef enum
@@ -253,19 +278,19 @@
   unsigned int non_match : 1;
 
   /* # of multibyte characters.  */
-  int nmbchars;
+  Idx nmbchars;
 
   /* # of collating symbols.  */
-  int ncoll_syms;
+  Idx ncoll_syms;
 
   /* # of equivalence classes. */
-  int nequiv_classes;
+  Idx nequiv_classes;
 
   /* # of range expressions. */
-  int nranges;
+  Idx nranges;
 
   /* # of character classes. */
-  int nchar_classes;
+  Idx nchar_classes;
 } re_charset_t;
 #endif /* RE_ENABLE_I18N */
 
@@ -278,7 +303,7 @@
 #ifdef RE_ENABLE_I18N
     re_charset_t *mbcset;	/* for COMPLEX_BRACKET */
 #endif /* RE_ENABLE_I18N */
-    int idx;			/* for BACK_REF */
+    Idx idx;			/* for BACK_REF */
     re_context_type ctx_type;	/* for ANCHOR */
   } opr;
 #if __GNUC__ >= 2
@@ -312,30 +337,30 @@
 #ifdef RE_ENABLE_I18N
   /* Store the wide character string which is corresponding to MBS.  */
   wint_t *wcs;
-  int *offsets;
+  Idx *offsets;
   mbstate_t cur_state;
 #endif
   /* Index in RAW_MBS.  Each character mbs[i] corresponds to
      raw_mbs[raw_mbs_idx + i].  */
-  int raw_mbs_idx;
+  Idx raw_mbs_idx;
   /* The length of the valid characters in the buffers.  */
-  int valid_len;
+  Idx valid_len;
   /* The corresponding number of bytes in raw_mbs array.  */
-  int valid_raw_len;
+  Idx valid_raw_len;
   /* The length of the buffers MBS and WCS.  */
-  int bufs_len;
+  Idx bufs_len;
   /* The index in MBS, which is updated by re_string_fetch_byte.  */
-  int cur_idx;
+  Idx cur_idx;
   /* length of RAW_MBS array.  */
-  int raw_len;
+  Idx raw_len;
   /* This is RAW_LEN - RAW_MBS_IDX + VALID_LEN - VALID_RAW_LEN.  */
-  int len;
+  Idx len;
   /* End of the buffer may be shorter than its length in the cases such
      as re_match_2, re_search_2.  Then, we use STOP for end of the buffer
      instead of LEN.  */
-  int raw_stop;
+  Idx raw_stop;
   /* This is RAW_STOP - RAW_MBS_IDX adjusted through OFFSETS.  */
-  int stop;
+  Idx stop;
 
   /* The context of mbs[0].  We store the context independently, since
      the context of mbs[0] may be different from raw_mbs[0], which is
@@ -370,7 +395,7 @@
 #endif
 
 static reg_errcode_t re_string_realloc_buffers (re_string_t *pstr,
-						int new_buf_len)
+						Idx new_buf_len)
      internal_function;
 #ifdef RE_ENABLE_I18N
 static void build_wcs_buffer (re_string_t *pstr) internal_function;
@@ -379,8 +404,8 @@
 #endif /* RE_ENABLE_I18N */
 static void build_upper_buffer (re_string_t *pstr) internal_function;
 static void re_string_translate_buffer (re_string_t *pstr) internal_function;
-static unsigned int re_string_context_at (const re_string_t *input, int idx,
-					  int eflags)
+static unsigned int re_string_context_at (const re_string_t *input,
+					  Idx idx, int eflags)
      internal_function __attribute ((pure));
 
 #define re_string_peek_byte(pstr, offset) \
@@ -432,7 +457,7 @@
 
   /* `node_idx' is the index in dfa->nodes, if `type' == 0.
      Otherwise `type' indicate the type of this node.  */
-  int node_idx;
+  Idx node_idx;
 };
 typedef struct bin_tree_t bin_tree_t;
 
@@ -476,7 +501,7 @@
 
 struct re_dfastate_t
 {
-  unsigned int hash;
+  re_hashval_t hash;
   re_node_set nodes;
   re_node_set non_eps_nodes;
   re_node_set inveclosure;
@@ -496,8 +521,8 @@
 
 struct re_state_table_entry
 {
-  int num;
-  int alloc;
+  Idx num;
+  Idx alloc;
   re_dfastate_t **array;
 };
 
@@ -505,8 +530,8 @@
 
 typedef struct
 {
-  int next_idx;
-  int alloc;
+  Idx next_idx;
+  Idx alloc;
   re_dfastate_t **array;
 } state_array_t;
 
@@ -514,8 +539,8 @@
 
 typedef struct
 {
-  int node;
-  int str_idx; /* The position NODE match at.  */
+  Idx node;
+  Idx str_idx; /* The position NODE match at.  */
   state_array_t path;
 } re_sub_match_last_t;
 
@@ -525,20 +550,20 @@
 
 typedef struct
 {
-  int str_idx;
-  int node;
+  Idx str_idx;
+  Idx node;
   state_array_t *path;
-  int alasts; /* Allocation size of LASTS.  */
-  int nlasts; /* The number of LASTS.  */
+  Idx alasts; /* Allocation size of LASTS.  */
+  Idx nlasts; /* The number of LASTS.  */
   re_sub_match_last_t **lasts;
 } re_sub_match_top_t;
 
 struct re_backref_cache_entry
 {
-  int node;
-  int str_idx;
-  int subexp_from;
-  int subexp_to;
+  Idx node;
+  Idx str_idx;
+  Idx subexp_from;
+  Idx subexp_to;
   char more;
   char unused;
   unsigned short int eps_reachable_subexps_map;
@@ -556,18 +581,18 @@
   /* EFLAGS of the argument of regexec.  */
   int eflags;
   /* Where the matching ends.  */
-  int match_last;
-  int last_node;
+  Idx match_last;
+  Idx last_node;
   /* The state log used by the matcher.  */
   re_dfastate_t **state_log;
-  int state_log_top;
+  Idx state_log_top;
   /* Back reference cache.  */
-  int nbkref_ents;
-  int abkref_ents;
+  Idx nbkref_ents;
+  Idx abkref_ents;
   struct re_backref_cache_entry *bkref_ents;
   int max_mb_elem_len;
-  int nsub_tops;
-  int asub_tops;
+  Idx nsub_tops;
+  Idx asub_tops;
   re_sub_match_top_t **sub_tops;
 } re_match_context_t;
 
@@ -575,33 +600,33 @@
 {
   re_dfastate_t **sifted_states;
   re_dfastate_t **limited_states;
-  int last_node;
-  int last_str_idx;
+  Idx last_node;
+  Idx last_str_idx;
   re_node_set limits;
 } re_sift_context_t;
 
 struct re_fail_stack_ent_t
 {
-  int idx;
-  int node;
+  Idx idx;
+  Idx node;
   regmatch_t *regs;
   re_node_set eps_via_nodes;
 };
 
 struct re_fail_stack_t
 {
-  int num;
-  int alloc;
+  Idx num;
+  Idx alloc;
   struct re_fail_stack_ent_t *stack;
 };
 
 struct re_dfa_t
 {
   re_token_t *nodes;
-  int nodes_alloc;
-  int nodes_len;
-  int *nexts;
-  int *org_indices;
+  Idx nodes_alloc;
+  Idx nodes_len;
+  Idx *nexts;
+  Idx *org_indices;
   re_node_set *edests;
   re_node_set *eclosures;
   re_node_set *inveclosures;
@@ -616,9 +641,9 @@
   int str_tree_storage_idx;
 
   /* number of subexpressions `re_nsub' is in regex_t.  */
-  unsigned int state_hash_mask;
-  int init_node;
-  int nbackref; /* The number of backreference in this dfa.  */
+  re_hashval_t state_hash_mask;
+  Idx init_node;
+  Idx nbackref; /* The number of backreference in this dfa.  */
 
   /* Bitmap expressing which backreference is used.  */
   unsigned int used_bkref_map;
@@ -635,7 +660,7 @@
   int mb_cur_max;
   bitset word_char;
   reg_syntax_t syntax;
-  int *subexp_map;
+  Idx *subexp_map;
 #ifdef DEBUG
   char* re_str;
 #endif
@@ -709,7 +734,7 @@
 /* Inline functions for re_string.  */
 static inline int
 internal_function __attribute ((pure))
-re_string_char_size_at (const re_string_t *pstr, int idx)
+re_string_char_size_at (const re_string_t *pstr, Idx idx)
 {
   int byte_idx;
   if (pstr->mb_cur_max == 1)
@@ -722,7 +747,7 @@
 
 static inline wint_t
 internal_function __attribute ((pure))
-re_string_wchar_at (const re_string_t *pstr, int idx)
+re_string_wchar_at (const re_string_t *pstr, Idx idx)
 {
   if (pstr->mb_cur_max == 1)
     return (wint_t) pstr->mbs[idx];
@@ -731,7 +756,7 @@
 
 static int
 internal_function __attribute ((pure))
-re_string_elem_size_at (const re_string_t *pstr, int idx)
+re_string_elem_size_at (const re_string_t *pstr, Idx idx)
 {
 #ifdef _LIBC
   const unsigned char *p, *extra;
--- a/lib/regexec.c
+++ b/lib/regexec.c
@@ -18,52 +18,54 @@
    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */
 
 static reg_errcode_t match_ctx_init (re_match_context_t *cache, int eflags,
-				     int n) internal_function;
+				     Idx n) internal_function;
 static void match_ctx_clean (re_match_context_t *mctx) internal_function;
 static void match_ctx_free (re_match_context_t *cache) internal_function;
-static reg_errcode_t match_ctx_add_entry (re_match_context_t *cache, int node,
-					  int str_idx, int from, int to)
+static reg_errcode_t match_ctx_add_entry (re_match_context_t *cache, Idx node,
+					  Idx str_idx, Idx from, Idx to)
      internal_function;
-static int search_cur_bkref_entry (re_match_context_t *mctx, int str_idx)
+static Idx search_cur_bkref_entry (re_match_context_t *mctx, Idx str_idx)
      internal_function;
-static reg_errcode_t match_ctx_add_subtop (re_match_context_t *mctx, int node,
-					   int str_idx) internal_function;
+static reg_errcode_t match_ctx_add_subtop (re_match_context_t *mctx, Idx node,
+					   Idx str_idx) internal_function;
 static re_sub_match_last_t * match_ctx_add_sublast (re_sub_match_top_t *subtop,
-						   int node, int str_idx)
+						    Idx node, Idx str_idx)
      internal_function;
 static void sift_ctx_init (re_sift_context_t *sctx, re_dfastate_t **sifted_sts,
-			   re_dfastate_t **limited_sts, int last_node,
-			   int last_str_idx)
+			   re_dfastate_t **limited_sts, Idx last_node,
+			   Idx last_str_idx)
      internal_function;
 static reg_errcode_t re_search_internal (const regex_t *preg,
-					 const char *string, int length,
-					 int start, int range, int stop,
+					 const char *string, Idx length,
+					 Idx start, regoff_t range, Idx stop,
 					 size_t nmatch, regmatch_t pmatch[],
 					 int eflags) internal_function;
-static int re_search_2_stub (struct re_pattern_buffer *bufp,
-			     const char *string1, int length1,
-			     const char *string2, int length2,
-			     int start, int range, struct re_registers *regs,
-			     int stop, int ret_len) internal_function;
-static int re_search_stub (struct re_pattern_buffer *bufp,
-			   const char *string, int length, int start,
-			   int range, int stop, struct re_registers *regs,
-			   int ret_len) internal_function;
+static regoff_t re_search_2_stub (struct re_pattern_buffer *bufp,
+				  const char *string1, Idx length1,
+				  const char *string2, Idx length2,
+				  Idx start, regoff_t range,
+				  struct re_registers *regs,
+				  Idx stop, int ret_len) internal_function;
+static regoff_t re_search_stub (struct re_pattern_buffer *bufp,
+				const char *string, Idx length, Idx start,
+				regoff_t range, Idx stop,
+				struct re_registers *regs,
+				int ret_len) internal_function;
 static unsigned re_copy_regs (struct re_registers *regs, regmatch_t *pmatch,
-			      int nregs, int regs_allocated) internal_function;
+			      Idx nregs, int regs_allocated) internal_function;
 static reg_errcode_t prune_impossible_nodes (re_match_context_t *mctx)
      internal_function;
-static int check_matching (re_match_context_t *mctx, int fl_longest_match,
-			   int *p_match_first)
+static Idx check_matching (re_match_context_t *mctx, int fl_longest_match,
+			   Idx *p_match_first)
      internal_function;
-static int check_halt_state_context (const re_match_context_t *mctx,
-				     const re_dfastate_t *state, int idx)
+static Idx check_halt_state_context (const re_match_context_t *mctx,
+				     const re_dfastate_t *state, Idx idx)
      internal_function;
 static void update_regs (re_dfa_t *dfa, regmatch_t *pmatch,
-			 regmatch_t *prev_idx_match, int cur_node,
-			 int cur_idx, int nmatch) internal_function;
+			 regmatch_t *prev_idx_match, Idx cur_node,
+			 Idx cur_idx, Idx nmatch) internal_function;
 static reg_errcode_t push_fail_stack (struct re_fail_stack_t *fs,
-				      int str_idx, int dest_node, int nregs,
+				      Idx str_idx, Idx dest_node, Idx nregs,
 				      regmatch_t *regs,
 				      re_node_set *eps_via_nodes) internal_function;
 static reg_errcode_t set_regs (const regex_t *preg,
@@ -75,41 +77,41 @@
 #ifdef RE_ENABLE_I18N
 static int sift_states_iter_mb (const re_match_context_t *mctx,
 				re_sift_context_t *sctx,
-				int node_idx, int str_idx, int max_str_idx) internal_function;
+				Idx node_idx, Idx str_idx, Idx max_str_idx) internal_function;
 #endif /* RE_ENABLE_I18N */
 static reg_errcode_t sift_states_backward (re_match_context_t *mctx,
 					   re_sift_context_t *sctx) internal_function;
 static reg_errcode_t build_sifted_states (re_match_context_t *mctx,
-					  re_sift_context_t *sctx, int str_idx,
+					  re_sift_context_t *sctx, Idx str_idx,
 					  re_node_set *cur_dest) internal_function;
 static reg_errcode_t update_cur_sifted_state (re_match_context_t *mctx,
 					      re_sift_context_t *sctx,
-					      int str_idx,
+					      Idx str_idx,
 					      re_node_set *dest_nodes) internal_function;
 static reg_errcode_t add_epsilon_src_nodes (re_dfa_t *dfa,
 					    re_node_set *dest_nodes,
 					    const re_node_set *candidates) internal_function;
 static int check_dst_limits (re_match_context_t *mctx, re_node_set *limits,
-			     int dst_node, int dst_idx, int src_node,
-			     int src_idx) internal_function;
+			     Idx dst_node, Idx dst_idx, Idx src_node,
+			     Idx src_idx) internal_function;
 static int check_dst_limits_calc_pos_1 (re_match_context_t *mctx,
-					int boundaries, int subexp_idx,
-					int from_node, int bkref_idx) internal_function;
+					int boundaries, Idx subexp_idx,
+					Idx from_node, Idx bkref_idx) internal_function;
 static int check_dst_limits_calc_pos (re_match_context_t *mctx,
-				      int limit, int subexp_idx,
-				      int node, int str_idx,
-				      int bkref_idx) internal_function;
+				      Idx limit, Idx subexp_idx,
+				      Idx node, Idx str_idx,
+				      Idx bkref_idx) internal_function;
 static reg_errcode_t check_subexp_limits (re_dfa_t *dfa,
 					  re_node_set *dest_nodes,
 					  const re_node_set *candidates,
 					  re_node_set *limits,
 					  struct re_backref_cache_entry *bkref_ents,
-					  int str_idx) internal_function;
+					  Idx str_idx) internal_function;
 static reg_errcode_t sift_states_bkref (re_match_context_t *mctx,
 					re_sift_context_t *sctx,
-					int str_idx, const re_node_set *candidates) internal_function;
+					Idx str_idx, const re_node_set *candidates) internal_function;
 static reg_errcode_t merge_state_array (re_dfa_t *dfa, re_dfastate_t **dst,
-					re_dfastate_t **src, int num) internal_function;
+					re_dfastate_t **src, Idx num) internal_function;
 static re_dfastate_t *find_recover_state (reg_errcode_t *err,
 					 re_match_context_t *mctx) internal_function;
 static re_dfastate_t *transit_state (reg_errcode_t *err,
@@ -120,7 +122,7 @@
 					    re_dfastate_t *next_state) internal_function;
 static reg_errcode_t check_subexp_matching_top (re_match_context_t *mctx,
 						re_node_set *cur_nodes,
-						int str_idx) internal_function;
+						Idx str_idx) internal_function;
 #if 0
 static re_dfastate_t *transit_state_sb (reg_errcode_t *err,
 					re_match_context_t *mctx,
@@ -133,47 +135,47 @@
 static reg_errcode_t transit_state_bkref (re_match_context_t *mctx,
 					  const re_node_set *nodes) internal_function;
 static reg_errcode_t get_subexp (re_match_context_t *mctx,
-				 int bkref_node, int bkref_str_idx) internal_function;
+				 Idx bkref_node, Idx bkref_str_idx) internal_function;
 static reg_errcode_t get_subexp_sub (re_match_context_t *mctx,
 				     const re_sub_match_top_t *sub_top,
 				     re_sub_match_last_t *sub_last,
-				     int bkref_node, int bkref_str) internal_function;
-static int find_subexp_node (const re_dfa_t *dfa, const re_node_set *nodes,
-			     int subexp_idx, int type) internal_function;
+				     Idx bkref_node, Idx bkref_str) internal_function;
+static Idx find_subexp_node (const re_dfa_t *dfa, const re_node_set *nodes,
+			     Idx subexp_idx, int type) internal_function;
 static reg_errcode_t check_arrival (re_match_context_t *mctx,
-				    state_array_t *path, int top_node,
-				    int top_str, int last_node, int last_str,
+				    state_array_t *path, Idx top_node,
+				    Idx top_str, Idx last_node, Idx last_str,
 				    int type) internal_function;
 static reg_errcode_t check_arrival_add_next_nodes (re_match_context_t *mctx,
-						   int str_idx,
+						   Idx str_idx,
 						   re_node_set *cur_nodes,
 						   re_node_set *next_nodes) internal_function;
 static reg_errcode_t check_arrival_expand_ecl (re_dfa_t *dfa,
 					       re_node_set *cur_nodes,
-					       int ex_subexp, int type) internal_function;
+					       Idx ex_subexp, int type) internal_function;
 static reg_errcode_t check_arrival_expand_ecl_sub (re_dfa_t *dfa,
 						   re_node_set *dst_nodes,
-						   int target, int ex_subexp,
+						   Idx target, Idx ex_subexp,
 						   int type) internal_function;
 static reg_errcode_t expand_bkref_cache (re_match_context_t *mctx,
-					 re_node_set *cur_nodes, int cur_str,
-					 int subexp_num, int type) internal_function;
+					 re_node_set *cur_nodes, Idx cur_str,
+					 Idx subexp_num, int type) internal_function;
 static int build_trtable (re_dfa_t *dfa,
 			  re_dfastate_t *state) internal_function;
 #ifdef RE_ENABLE_I18N
-static int check_node_accept_bytes (re_dfa_t *dfa, int node_idx,
-				    const re_string_t *input, int idx) internal_function;
+static int check_node_accept_bytes (re_dfa_t *dfa, Idx node_idx,
+				    const re_string_t *input, Idx idx) internal_function;
 # ifdef _LIBC
 static unsigned int find_collation_sequence_value (const unsigned char *mbs,
 						   size_t name_len) internal_function;
 # endif /* _LIBC */
 #endif /* RE_ENABLE_I18N */
-static int group_nodes_into_DFAstates (re_dfa_t *dfa,
+static Idx group_nodes_into_DFAstates (re_dfa_t *dfa,
 				       const re_dfastate_t *state,
 				       re_node_set *states_node,
 				       bitset *states_ch) internal_function;
 static int check_node_accept (const re_match_context_t *mctx,
-			      const re_token_t *node, int idx) internal_function;
+			      const re_token_t *node, Idx idx) internal_function;
 static reg_errcode_t extend_buffers (re_match_context_t *mctx) internal_function;
 
 /* Entry point for POSIX code.  */
@@ -197,7 +199,7 @@
 	 size_t nmatch, regmatch_t pmatch[], int eflags)
 {
   reg_errcode_t err;
-  int start, length;
+  Idx start, length;
 #ifdef _LIBC
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
 #endif
@@ -276,9 +278,9 @@
    return the position of the start of the match.  Return value -1 means no
    match was found and -2 indicates an internal error.  */
 
-int
+regoff_t
 re_match (struct re_pattern_buffer *bufp, const char *string,
-	  int length, int start, struct re_registers *regs)
+	  Idx length, Idx start, struct re_registers *regs)
 {
   return re_search_stub (bufp, string, length, start, 0, length, regs, 1);
 }
@@ -286,9 +288,9 @@
 weak_alias (__re_match, re_match)
 #endif
 
-int
+regoff_t
 re_search (struct re_pattern_buffer *bufp, const char *string,
-	   int length, int start, int range, struct re_registers *regs)
+	   Idx length, Idx start, regoff_t range, struct re_registers *regs)
 {
   return re_search_stub (bufp, string, length, start, range, length, regs, 0);
 }
@@ -296,11 +298,11 @@
 weak_alias (__re_search, re_search)
 #endif
 
-int
+regoff_t
 re_match_2 (struct re_pattern_buffer *bufp,
-	    const char *string1, int length1,
-	    const char *string2, int length2,
-	    int start, struct re_registers *regs, int stop)
+	    const char *string1, Idx length1,
+	    const char *string2, Idx length2,
+	    Idx start, struct re_registers *regs, Idx stop)
 {
   return re_search_2_stub (bufp, string1, length1, string2, length2,
 			   start, 0, regs, stop, 1);
@@ -309,11 +311,11 @@
 weak_alias (__re_match_2, re_match_2)
 #endif
 
-int
+regoff_t
 re_search_2 (struct re_pattern_buffer *bufp,
-	     const char *string1, int length1,
-	     const char *string2, int length2,
-	     int start, int range, struct re_registers *regs, int stop)
+	     const char *string1, Idx length1,
+	     const char *string2, Idx length2,
+	     Idx start, regoff_t range, struct re_registers *regs, Idx stop)
 {
   return re_search_2_stub (bufp, string1, length1, string2, length2,
 			   start, range, regs, stop, 0);
@@ -322,17 +324,17 @@
 weak_alias (__re_search_2, re_search_2)
 #endif
 
-static int
+static regoff_t
 internal_function
 re_search_2_stub (struct re_pattern_buffer *bufp,
-		  const char *string1, int length1,
-		  const char *string2, int length2,
-		  int start, int range, struct re_registers *regs, int stop,
-		  int ret_len)
+		  const char *string1, Idx length1,
+		  const char *string2, Idx length2,
+		  Idx start, regoff_t range, struct re_registers *regs,
+		  Idx stop, int ret_len)
 {
   const char *str;
-  int rval;
-  int len = length1 + length2;
+  regoff_t rval;
+  Idx len = length1 + length2;
   int free_str = 0;
 
   if (BE (length1 < 0 || length2 < 0 || stop < 0, 0))
@@ -368,16 +370,17 @@
    If RET_LEN is nonzero the length of the match is returned (re_match style);
    otherwise the position of the match is returned.  */
 
-static int
+static regoff_t
 internal_function
 re_search_stub (struct re_pattern_buffer *bufp,
-		const char *string, int length,
-		int start, int range, int stop, struct re_registers *regs,
+		const char *string, Idx length,
+		Idx start, regoff_t range, Idx stop, struct re_registers *regs,
 		int ret_len)
 {
   reg_errcode_t result;
   regmatch_t *pmatch;
-  int nregs, rval;
+  Idx nregs;
+  regoff_t rval;
   int eflags = 0;
 #ifdef _LIBC
   re_dfa_t *dfa = (re_dfa_t *) bufp->re_buffer;
@@ -386,10 +389,22 @@
   /* Check for out-of-range.  */
   if (BE (start < 0 || start > length, 0))
     return -1;
-  if (BE (start + range > length, 0))
-    range = length - start;
-  else if (BE (start + range < 0, 0))
-    range = -start;
+  if (sizeof start < sizeof range)
+    {
+      regoff_t length_offset = length;
+      regoff_t start_offset = start;
+      if (BE (length_offset - start_offset < range, 0))
+	range = length_offset - start_offset;
+      else if (BE (range < - start_offset, 0))
+	range = -start_offset;
+    }
+  else
+    {
+      if (BE (start + range > length, 0))
+	range = length - start;
+      else if (BE (start + range < 0, 0))
+	range = -start;
+    }
 
   __libc_lock_lock (dfa->lock);
 
@@ -461,12 +476,12 @@
 
 static unsigned
 internal_function
-re_copy_regs (struct re_registers *regs, regmatch_t *pmatch, int nregs,
+re_copy_regs (struct re_registers *regs, regmatch_t *pmatch, Idx nregs,
 	      int regs_allocated)
 {
   int rval = REG_REALLOCATE;
-  int i;
-  int need_regs = nregs + 1;
+  Idx i;
+  Idx need_regs = nregs + 1;
   /* We need one extra element beyond `rm_num_regs' for the `-1' marker GNU code
      uses.  */
 
@@ -530,7 +545,7 @@
 
 void
 re_set_registers (struct re_pattern_buffer *bufp, struct re_registers *regs,
-		  unsigned int num_regs, regoff_t *starts, regoff_t *ends)
+		  __re_size_t num_regs, regoff_t *starts, regoff_t *ends)
 {
   if (num_regs)
     {
@@ -578,16 +593,18 @@
 static reg_errcode_t
 internal_function
 re_search_internal (const regex_t *preg,
-		    const char *string, int length,
-		    int start, int range, int stop,
+		    const char *string, Idx length,
+		    Idx start, regoff_t range, Idx stop,
 		    size_t nmatch, regmatch_t pmatch[],
 		    int eflags)
 {
   reg_errcode_t err;
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
-  int left_lim, right_lim, incr;
-  int fl_longest_match, match_first, match_kind, match_last = -1;
-  int extra_nmatch;
+  Idx left_lim, right_lim;
+  int incr;
+  int fl_longest_match, match_kind;
+  Idx match_first, match_last = REG_MISSING;
+  Idx extra_nmatch;
   int sb, ch;
 #if defined _LIBC || (defined __STDC_VERSION__ && __STDC_VERSION__ >= 199901L)
   re_match_context_t mctx = { .dfa = dfa };
@@ -742,8 +759,8 @@
 	    {
 	      /* If MATCH_FIRST is out of the valid range, reconstruct the
 		 buffers.  */
-	      unsigned int offset = match_first - mctx.input.raw_mbs_idx;
-	      if (BE (offset >= (unsigned int) mctx.input.valid_raw_len, 0))
+	      __re_size_t offset = match_first - mctx.input.raw_mbs_idx;
+	      if (BE (offset >= (__re_size_t) mctx.input.valid_raw_len, 0))
 		{
 		  err = re_string_reconstruct (&mctx.input, match_first,
 					       eflags);
@@ -786,9 +803,9 @@
       mctx.state_log_top = mctx.nbkref_ents = mctx.max_mb_elem_len = 0;
       match_last = check_matching (&mctx, fl_longest_match,
 				   range >= 0 ? &match_first : NULL);
-      if (match_last != -1)
+      if (match_last != REG_MISSING)
 	{
-	  if (BE (match_last == -2, 0))
+	  if (BE (match_last == REG_ERROR, 0))
 	    {
 	      err = REG_ESPACE;
 	      goto free_return;
@@ -810,7 +827,7 @@
 		    break;
 		  if (BE (err != REG_NOMATCH, 0))
 		    goto free_return;
-		  match_last = -1;
+		  match_last = REG_MISSING;
 		}
 	      else
 		break; /* We found a match.  */
@@ -821,14 +838,14 @@
     }
 
 #ifdef DEBUG
-  assert (match_last != -1);
+  assert (match_last != REG_MISSING);
   assert (err == REG_NOERROR);
 #endif
 
   /* Set pmatch[] if we need.  */
   if (nmatch > 0)
     {
-      int reg_idx;
+      Idx reg_idx;
 
       /* Initialize registers.  */
       for (reg_idx = 1; reg_idx < nmatch; ++reg_idx)
@@ -837,6 +854,9 @@
       /* Set the points where matching start/end.  */
       pmatch[0].rm_so = 0;
       pmatch[0].rm_eo = mctx.match_last;
+      /* FIXME: This function should fail if mctx.match_last exceeds
+	 the maximum possible regoff_t value.  We need a new error
+	 code REG_OVERFLOW.  */
 
       if (!preg->re_no_sub && nmatch > 1)
 	{
@@ -900,7 +920,7 @@
 prune_impossible_nodes (re_match_context_t *mctx)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int halt_node, match_last;
+  Idx halt_node, match_last;
   reg_errcode_t ret;
   re_dfastate_t **sifted_states;
   re_dfastate_t **lim_states = NULL;
@@ -939,7 +959,7 @@
 	  do
 	    {
 	      --match_last;
-	      if (match_last < 0)
+	      if (! REG_VALID_INDEX (match_last))
 		{
 		  ret = REG_NOMATCH;
 		  goto free_return;
@@ -984,7 +1004,7 @@
 static inline re_dfastate_t *
 __attribute ((always_inline)) internal_function
 acquire_init_state_context (reg_errcode_t *err, const re_match_context_t *mctx,
-			    int idx)
+			    Idx idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
   if (dfa->init_state->has_constraint)
@@ -1015,27 +1035,27 @@
 }
 
 /* Check whether the regular expression match input string INPUT or not,
-   and return the index where the matching end, return -1 if not match,
-   or return -2 in case of an error.
+   and return the index where the matching end.  Return REG_MISSING if
+   there is no match, and return REG_ERROR in case of an error.
    FL_LONGEST_MATCH means we want the POSIX longest matching.
    If P_MATCH_FIRST is not NULL, and the match fails, it is set to the
    next place where we may want to try matching.
    Note that the matcher assume that the maching starts from the current
    index of the buffer.  */
 
-static int
+static Idx
 internal_function
 check_matching (re_match_context_t *mctx, int fl_longest_match,
-		int *p_match_first)
+		Idx *p_match_first)
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int match = 0;
-  int match_last = -1;
-  int cur_str_idx = re_string_cur_idx (&mctx->input);
+  Idx match = 0;
+  Idx match_last = REG_MISSING;
+  Idx cur_str_idx = re_string_cur_idx (&mctx->input);
   re_dfastate_t *cur_state;
   int at_init_state = p_match_first != NULL;
-  int next_start_idx = cur_str_idx;
+  Idx next_start_idx = cur_str_idx;
 
   err = REG_NOERROR;
   cur_state = acquire_init_state_context (&err, mctx, cur_str_idx);
@@ -1043,7 +1063,7 @@
   if (BE (cur_state == NULL, 0))
     {
       assert (err == REG_ESPACE);
-      return -2;
+      return REG_ERROR;
     }
 
   if (mctx->state_log != NULL)
@@ -1087,7 +1107,7 @@
   while (!re_string_eoi (&mctx->input))
     {
       re_dfastate_t *old_state = cur_state;
-      int next_char_idx = re_string_cur_idx (&mctx->input) + 1;
+      Idx next_char_idx = re_string_cur_idx (&mctx->input) + 1;
 
       if (BE (next_char_idx >= mctx->input.bufs_len, 0)
           || (BE (next_char_idx >= mctx->input.valid_len, 0)
@@ -1097,7 +1117,7 @@
           if (BE (err != REG_NOERROR, 0))
 	    {
 	      assert (err == REG_ESPACE);
-	      return -2;
+	      return REG_ERROR;
 	    }
         }
 
@@ -1111,7 +1131,7 @@
 	     state using the state log, if available and if we have not
 	     already found a valid (even if not the longest) match.  */
 	  if (BE (err != REG_NOERROR, 0))
-	    return -2;
+	    return REG_ERROR;
 
 	  if (mctx->state_log == NULL
 	      || (match && !fl_longest_match)
@@ -1157,7 +1177,7 @@
 
 static int
 internal_function
-check_halt_node_context (const re_dfa_t *dfa, int node, unsigned int context)
+check_halt_node_context (const re_dfa_t *dfa, Idx node, unsigned int context)
 {
   re_token_type_t type = dfa->nodes[node].type;
   unsigned int constraint = dfa->nodes[node].constraint;
@@ -1174,12 +1194,12 @@
    Return 0 if not match, if the node, STATE has, is a halt node and
    match the context, return the node.  */
 
-static int
+static Idx
 internal_function
 check_halt_state_context (const re_match_context_t *mctx,
-			  const re_dfastate_t *state, int idx)
+			  const re_dfastate_t *state, Idx idx)
 {
-  int i;
+  Idx i;
   unsigned int context;
 #ifdef DEBUG
   assert (state->halt);
@@ -1193,32 +1213,34 @@
 
 /* Compute the next node to which "NFA" transit from NODE("NFA" is a NFA
    corresponding to the DFA).
-   Return the destination node, and update EPS_VIA_NODES, return -1 in case
-   of errors.  */
-
-static int
+   Return the destination node, and update EPS_VIA_NODES;
+   return REG_MISSING in case of errors.  */
+
+static Idx
 internal_function
 proceed_next_node (const re_match_context_t *mctx,
-		   int nregs, regmatch_t *regs, int *pidx, int node,
+		   Idx nregs, regmatch_t *regs, Idx *pidx, Idx node,
 		   re_node_set *eps_via_nodes, struct re_fail_stack_t *fs)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int i, err;
+  Idx i;
+  int err;
   if (IS_EPSILON_NODE (dfa->nodes[node].type))
     {
       re_node_set *cur_nodes = &mctx->state_log[*pidx]->nodes;
       re_node_set *edests = &dfa->edests[node];
-      int dest_node;
+      Idx dest_node;
       err = re_node_set_insert (eps_via_nodes, node);
       if (BE (err < 0, 0))
-	return -2;
-      /* Pick up a valid destination, or return -1 if none is found.  */
-      for (dest_node = -1, i = 0; i < edests->nelem; ++i)
+	return REG_ERROR;
+      /* Pick up a valid destination, or return REG_MISSING if none
+	 is found.  */
+      for (dest_node = REG_MISSING, i = 0; i < edests->nelem; ++i)
 	{
-	  int candidate = edests->elems[i];
+	  Idx candidate = edests->elems[i];
 	  if (!re_node_set_contains (cur_nodes, candidate))
 	    continue;
-          if (dest_node == -1)
+          if (dest_node == REG_MISSING)
 	    dest_node = candidate;
 
           else
@@ -1232,7 +1254,7 @@
 	      else if (fs != NULL
 		       && push_fail_stack (fs, *pidx, candidate, nregs, regs,
 				           eps_via_nodes))
-		return -2;
+		return REG_ERROR;
 
 	      /* We know we are going to exit.  */
 	      break;
@@ -1242,7 +1264,7 @@
     }
   else
     {
-      int naccepted = 0;
+      Idx naccepted = 0;
       re_token_type_t type = dfa->nodes[node].type;
 
 #ifdef RE_ENABLE_I18N
@@ -1252,27 +1274,27 @@
 #endif /* RE_ENABLE_I18N */
       if (type == OP_BACK_REF)
 	{
-	  int subexp_idx = dfa->nodes[node].opr.idx + 1;
+	  Idx subexp_idx = dfa->nodes[node].opr.idx + 1;
 	  naccepted = regs[subexp_idx].rm_eo - regs[subexp_idx].rm_so;
 	  if (fs != NULL)
 	    {
 	      if (regs[subexp_idx].rm_so == -1 || regs[subexp_idx].rm_eo == -1)
-		return -1;
+		return REG_MISSING;
 	      else if (naccepted)
 		{
 		  char *buf = (char *) re_string_get_buffer (&mctx->input);
 		  if (memcmp (buf + regs[subexp_idx].rm_so, buf + *pidx,
 			      naccepted) != 0)
-		    return -1;
+		    return REG_MISSING;
 		}
 	    }
 
 	  if (naccepted == 0)
 	    {
-	      int dest_node;
+	      Idx dest_node;
 	      err = re_node_set_insert (eps_via_nodes, node);
 	      if (BE (err < 0, 0))
-		return -2;
+		return REG_ERROR;
 	      dest_node = dfa->edests[node].elems[0];
 	      if (re_node_set_contains (&mctx->state_log[*pidx]->nodes,
 					dest_node))
@@ -1283,26 +1305,26 @@
       if (naccepted != 0
 	  || check_node_accept (mctx, dfa->nodes + node, *pidx))
 	{
-	  int dest_node = dfa->nexts[node];
+	  Idx dest_node = dfa->nexts[node];
 	  *pidx = (naccepted == 0) ? *pidx + 1 : *pidx + naccepted;
 	  if (fs && (*pidx > mctx->match_last || mctx->state_log[*pidx] == NULL
 		     || !re_node_set_contains (&mctx->state_log[*pidx]->nodes,
 					       dest_node)))
-	    return -1;
+	    return REG_MISSING;
 	  re_node_set_empty (eps_via_nodes);
 	  return dest_node;
 	}
     }
-  return -1;
+  return REG_MISSING;
 }
 
 static reg_errcode_t
 internal_function
-push_fail_stack (struct re_fail_stack_t *fs, int str_idx, int dest_node,
-		 int nregs, regmatch_t *regs, re_node_set *eps_via_nodes)
+push_fail_stack (struct re_fail_stack_t *fs, Idx str_idx, Idx dest_node,
+		 Idx nregs, regmatch_t *regs, re_node_set *eps_via_nodes)
 {
   reg_errcode_t err;
-  int num = fs->num++;
+  Idx num = fs->num++;
   if (fs->num == fs->alloc)
     {
       struct re_fail_stack_ent_t *new_array =
@@ -1322,13 +1344,13 @@
   return err;
 }
 
-static int
+static Idx
 internal_function
-pop_fail_stack (struct re_fail_stack_t *fs, int *pidx,
-		int nregs, regmatch_t *regs, re_node_set *eps_via_nodes)
+pop_fail_stack (struct re_fail_stack_t *fs, Idx *pidx,
+		Idx nregs, regmatch_t *regs, re_node_set *eps_via_nodes)
 {
-  int num = --fs->num;
-  assert (num >= 0);
+  Idx num = --fs->num;
+  assert (REG_VALID_INDEX (num));
   *pidx = fs->stack[num].idx;
   memcpy (regs, fs->stack[num].regs, sizeof (regmatch_t) * nregs);
   re_node_set_free (eps_via_nodes);
@@ -1348,7 +1370,7 @@
 	  size_t nmatch, regmatch_t *pmatch, int fl_backtrack)
 {
   re_dfa_t *dfa = (re_dfa_t *) preg->re_buffer;
-  int idx, cur_node;
+  Idx idx, cur_node;
   re_node_set eps_via_nodes;
   struct re_fail_stack_t *fs;
   struct re_fail_stack_t fs_body = { 0, 2, NULL };
@@ -1392,7 +1414,7 @@
 
       if (idx == pmatch[0].rm_eo && cur_node == mctx->last_node)
 	{
-	  int reg_idx;
+	  Idx reg_idx;
 	  if (fs)
 	    {
 	      for (reg_idx = 0; reg_idx < nmatch; ++reg_idx)
@@ -1421,9 +1443,9 @@
       cur_node = proceed_next_node (mctx, nmatch, pmatch, &idx, cur_node,
 				    &eps_via_nodes, fs);
 
-      if (BE (cur_node < 0, 0))
+      if (BE (! REG_VALID_INDEX (cur_node), 0))
 	{
-	  if (BE (cur_node == -2, 0))
+	  if (BE (cur_node == REG_ERROR, 0))
 	    {
 	      re_node_set_free (&eps_via_nodes);
 	      if (prev_idx_match_malloced)
@@ -1455,7 +1477,7 @@
 {
   if (fs)
     {
-      int fs_idx;
+      Idx fs_idx;
       for (fs_idx = 0; fs_idx < fs->num; ++fs_idx)
 	{
 	  re_node_set_free (&fs->stack[fs_idx].eps_via_nodes);
@@ -1469,12 +1491,12 @@
 static void
 internal_function
 update_regs (re_dfa_t *dfa, regmatch_t *pmatch, regmatch_t *prev_idx_match,
-	     int cur_node, int cur_idx, int nmatch)
+	     Idx cur_node, Idx cur_idx, Idx nmatch)
 {
   int type = dfa->nodes[cur_node].type;
   if (type == OP_OPEN_SUBEXP)
     {
-      int reg_num = dfa->nodes[cur_node].opr.idx + 1;
+      Idx reg_num = dfa->nodes[cur_node].opr.idx + 1;
 
       /* We are at the first node of this sub expression.  */
       if (reg_num < nmatch)
@@ -1485,7 +1507,7 @@
     }
   else if (type == OP_CLOSE_SUBEXP)
     {
-      int reg_num = dfa->nodes[cur_node].opr.idx + 1;
+      Idx reg_num = dfa->nodes[cur_node].opr.idx + 1;
       if (reg_num < nmatch)
 	{
 	  /* We are at the last node of this sub expression.  */
@@ -1544,7 +1566,7 @@
 {
   reg_errcode_t err;
   int null_cnt = 0;
-  int str_idx = sctx->last_str_idx;
+  Idx str_idx = sctx->last_str_idx;
   re_node_set cur_dest;
 
 #ifdef DEBUG
@@ -1599,11 +1621,11 @@
 static reg_errcode_t
 internal_function
 build_sifted_states (re_match_context_t *mctx, re_sift_context_t *sctx,
-		     int str_idx, re_node_set *cur_dest)
+		     Idx str_idx, re_node_set *cur_dest)
 {
   re_dfa_t *const dfa = mctx->dfa;
   re_node_set *cur_src = &mctx->state_log[str_idx]->non_eps_nodes;
-  int i;
+  Idx i;
 
   /* Then build the next sifted state.
      We build the next sifted state on `cur_dest', and update
@@ -1614,7 +1636,7 @@
      (with the epsilon nodes pre-filtered out).  */
   for (i = 0; i < cur_src->nelem; i++)
     {
-      int prev_node = cur_src->elems[i];
+      Idx prev_node = cur_src->elems[i];
       int naccepted = 0;
       int ret;
 
@@ -1642,7 +1664,7 @@
 
       if (sctx->limits.nelem)
 	{
-	  int to_idx = str_idx + naccepted;
+	  Idx to_idx = str_idx + naccepted;
 	  if (check_dst_limits (mctx, &sctx->limits,
 				dfa->nexts[prev_node], to_idx,
 				prev_node, str_idx))
@@ -1660,9 +1682,9 @@
 
 static reg_errcode_t
 internal_function
-clean_state_log_if_needed (re_match_context_t *mctx, int next_state_log_idx)
+clean_state_log_if_needed (re_match_context_t *mctx, Idx next_state_log_idx)
 {
-  int top = mctx->state_log_top;
+  Idx top = mctx->state_log_top;
 
   if (next_state_log_idx >= mctx->input.bufs_len
       || (next_state_log_idx >= mctx->input.valid_len
@@ -1686,9 +1708,9 @@
 static reg_errcode_t
 internal_function
 merge_state_array (re_dfa_t *dfa, re_dfastate_t **dst, re_dfastate_t **src,
-		   int num)
+		   Idx num)
 {
-  int st_idx;
+  Idx st_idx;
   reg_errcode_t err;
   for (st_idx = 0; st_idx < num; ++st_idx)
     {
@@ -1713,7 +1735,7 @@
 static reg_errcode_t
 internal_function
 update_cur_sifted_state (re_match_context_t *mctx, re_sift_context_t *sctx,
-			 int str_idx, re_node_set *dest_nodes)
+			 Idx str_idx, re_node_set *dest_nodes)
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
@@ -1763,7 +1785,7 @@
 		       const re_node_set *candidates)
 {
   reg_errcode_t err = REG_NOERROR;
-  int i;
+  Idx i;
 
   re_dfastate_t *state = re_acquire_state (&err, dfa, dest_nodes);
   if (BE (err != REG_NOERROR, 0))
@@ -1784,27 +1806,27 @@
 
 static reg_errcode_t
 internal_function
-sub_epsilon_src_nodes (re_dfa_t *dfa, int node, re_node_set *dest_nodes,
+sub_epsilon_src_nodes (re_dfa_t *dfa, Idx node, re_node_set *dest_nodes,
 		       const re_node_set *candidates)
 {
-    int ecl_idx;
+    Idx ecl_idx;
     reg_errcode_t err;
     re_node_set *inv_eclosure = dfa->inveclosures + node;
     re_node_set except_nodes;
     re_node_set_init_empty (&except_nodes);
     for (ecl_idx = 0; ecl_idx < inv_eclosure->nelem; ++ecl_idx)
       {
-	int cur_node = inv_eclosure->elems[ecl_idx];
+	Idx cur_node = inv_eclosure->elems[ecl_idx];
 	if (cur_node == node)
 	  continue;
 	if (IS_EPSILON_NODE (dfa->nodes[cur_node].type))
 	  {
-	    int edst1 = dfa->edests[cur_node].elems[0];
-	    int edst2 = ((dfa->edests[cur_node].nelem > 1)
-			 ? dfa->edests[cur_node].elems[1] : -1);
+	    Idx edst1 = dfa->edests[cur_node].elems[0];
+	    Idx edst2 = ((dfa->edests[cur_node].nelem > 1)
+			 ? dfa->edests[cur_node].elems[1] : REG_MISSING);
 	    if ((!re_node_set_contains (inv_eclosure, edst1)
 		 && re_node_set_contains (dest_nodes, edst1))
-		|| (edst2 > 0
+		|| (REG_VALID_NONZERO_INDEX (edst2)
 		    && !re_node_set_contains (inv_eclosure, edst2)
 		    && re_node_set_contains (dest_nodes, edst2)))
 	      {
@@ -1820,10 +1842,10 @@
       }
     for (ecl_idx = 0; ecl_idx < inv_eclosure->nelem; ++ecl_idx)
       {
-	int cur_node = inv_eclosure->elems[ecl_idx];
+	Idx cur_node = inv_eclosure->elems[ecl_idx];
 	if (!re_node_set_contains (&except_nodes, cur_node))
 	  {
-	    int idx = re_node_set_contains (dest_nodes, cur_node) - 1;
+	    Idx idx = re_node_set_contains (dest_nodes, cur_node) - 1;
 	    re_node_set_remove_at (dest_nodes, idx);
 	  }
       }
@@ -1834,16 +1856,16 @@
 static int
 internal_function
 check_dst_limits (re_match_context_t *mctx, re_node_set *limits,
-		  int dst_node, int dst_idx, int src_node, int src_idx)
+		  Idx dst_node, Idx dst_idx, Idx src_node, Idx src_idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int lim_idx, src_pos, dst_pos;
-
-  int dst_bkref_idx = search_cur_bkref_entry (mctx, dst_idx);
-  int src_bkref_idx = search_cur_bkref_entry (mctx, src_idx);
+  Idx lim_idx, src_pos, dst_pos;
+
+  Idx dst_bkref_idx = search_cur_bkref_entry (mctx, dst_idx);
+  Idx src_bkref_idx = search_cur_bkref_entry (mctx, src_idx);
   for (lim_idx = 0; lim_idx < limits->nelem; ++lim_idx)
     {
-      int subexp_idx;
+      Idx subexp_idx;
       struct re_backref_cache_entry *ent;
       ent = mctx->bkref_ents + limits->elems[lim_idx];
       subexp_idx = dfa->nodes[ent->node].opr.idx;
@@ -1870,26 +1892,27 @@
 static int
 internal_function
 check_dst_limits_calc_pos_1 (re_match_context_t *mctx, int boundaries,
-			     int subexp_idx, int from_node, int bkref_idx)
+			     Idx subexp_idx, Idx from_node, Idx bkref_idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
   re_node_set *eclosures = dfa->eclosures + from_node;
-  int node_idx;
+  Idx node_idx;
 
   /* Else, we are on the boundary: examine the nodes on the epsilon
      closure.  */
   for (node_idx = 0; node_idx < eclosures->nelem; ++node_idx)
     {
-      int node = eclosures->elems[node_idx];
+      Idx node = eclosures->elems[node_idx];
       switch (dfa->nodes[node].type)
 	{
 	case OP_BACK_REF:
-	  if (bkref_idx != -1)
+	  if (bkref_idx != REG_MISSING)
 	    {
 	      struct re_backref_cache_entry *ent = mctx->bkref_ents + bkref_idx;
 	      do
 	        {
-		  int dst, cpos;
+		  Idx dst;
+		  int cpos;
 
 		  if (ent->node != node)
 		    continue;
@@ -1950,8 +1973,8 @@
 
 static int
 internal_function
-check_dst_limits_calc_pos (re_match_context_t *mctx, int limit, int subexp_idx,
-			   int from_node, int str_idx, int bkref_idx)
+check_dst_limits_calc_pos (re_match_context_t *mctx, Idx limit, Idx subexp_idx,
+			   Idx from_node, Idx str_idx, Idx bkref_idx)
 {
   struct re_backref_cache_entry *lim = mctx->bkref_ents + limit;
   int boundaries;
@@ -1981,14 +2004,14 @@
 internal_function
 check_subexp_limits (re_dfa_t *dfa, re_node_set *dest_nodes,
 		     const re_node_set *candidates, re_node_set *limits,
-		     struct re_backref_cache_entry *bkref_ents, int str_idx)
+		     struct re_backref_cache_entry *bkref_ents, Idx str_idx)
 {
   reg_errcode_t err;
-  int node_idx, lim_idx;
+  Idx node_idx, lim_idx;
 
   for (lim_idx = 0; lim_idx < limits->nelem; ++lim_idx)
     {
-      int subexp_idx;
+      Idx subexp_idx;
       struct re_backref_cache_entry *ent;
       ent = bkref_ents + limits->elems[lim_idx];
 
@@ -1998,11 +2021,11 @@
       subexp_idx = dfa->nodes[ent->node].opr.idx;
       if (ent->subexp_to == str_idx)
 	{
-	  int ops_node = -1;
-	  int cls_node = -1;
+	  Idx ops_node = REG_MISSING;
+	  Idx cls_node = REG_MISSING;
 	  for (node_idx = 0; node_idx < dest_nodes->nelem; ++node_idx)
 	    {
-	      int node = dest_nodes->elems[node_idx];
+	      Idx node = dest_nodes->elems[node_idx];
 	      re_token_type_t type = dfa->nodes[node].type;
 	      if (type == OP_OPEN_SUBEXP
 		  && subexp_idx == dfa->nodes[node].opr.idx)
@@ -2014,7 +2037,7 @@
 
 	  /* Check the limitation of the open subexpression.  */
 	  /* Note that (ent->subexp_to = str_idx != ent->subexp_from).  */
-	  if (ops_node >= 0)
+	  if (REG_VALID_INDEX (ops_node))
 	    {
 	      err = sub_epsilon_src_nodes (dfa, ops_node, dest_nodes,
 					   candidates);
@@ -2023,10 +2046,10 @@
 	    }
 
 	  /* Check the limitation of the close subexpression.  */
-	  if (cls_node >= 0)
+	  if (REG_VALID_INDEX (cls_node))
 	    for (node_idx = 0; node_idx < dest_nodes->nelem; ++node_idx)
 	      {
-		int node = dest_nodes->elems[node_idx];
+		Idx node = dest_nodes->elems[node_idx];
 		if (!re_node_set_contains (dfa->inveclosures + node,
 					   cls_node)
 		    && !re_node_set_contains (dfa->eclosures + node,
@@ -2046,7 +2069,7 @@
 	{
 	  for (node_idx = 0; node_idx < dest_nodes->nelem; ++node_idx)
 	    {
-	      int node = dest_nodes->elems[node_idx];
+	      Idx node = dest_nodes->elems[node_idx];
 	      re_token_type_t type = dfa->nodes[node].type;
 	      if (type == OP_CLOSE_SUBEXP || type == OP_OPEN_SUBEXP)
 		{
@@ -2068,22 +2091,22 @@
 static reg_errcode_t
 internal_function
 sift_states_bkref (re_match_context_t *mctx, re_sift_context_t *sctx,
-		   int str_idx, const re_node_set *candidates)
+		   Idx str_idx, const re_node_set *candidates)
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int node_idx, node;
+  Idx node_idx, node;
   re_sift_context_t local_sctx;
-  int first_idx = search_cur_bkref_entry (mctx, str_idx);
-
-  if (first_idx == -1)
+  Idx first_idx = search_cur_bkref_entry (mctx, str_idx);
+
+  if (first_idx == REG_MISSING)
     return REG_NOERROR;
 
   local_sctx.sifted_states = NULL; /* Mark that it hasn't been initialized.  */
 
   for (node_idx = 0; node_idx < candidates->nelem; ++node_idx)
     {
-      int enabled_idx;
+      Idx enabled_idx;
       re_token_type_t type;
       struct re_backref_cache_entry *entry;
       node = candidates->elems[node_idx];
@@ -2098,7 +2121,7 @@
       enabled_idx = first_idx;
       do
 	{
-	  int subexp_len, to_idx, dst_node, ret;
+	  Idx subexp_len, to_idx, dst_node, ret;
 	  re_dfastate_t *cur_state;
 
 	  if (entry->node != node)
@@ -2165,7 +2188,7 @@
 static int
 internal_function
 sift_states_iter_mb (const re_match_context_t *mctx, re_sift_context_t *sctx,
-		     int node_idx, int str_idx, int max_str_idx)
+		     Idx node_idx, Idx str_idx, Idx max_str_idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
   int naccepted;
@@ -2256,7 +2279,7 @@
 		      re_dfastate_t *next_state)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int cur_idx = re_string_cur_idx (&mctx->input);
+  Idx cur_idx = re_string_cur_idx (&mctx->input);
 
   if (cur_idx > mctx->state_log_top)
     {
@@ -2336,8 +2359,8 @@
   re_dfastate_t *cur_state = NULL;
   do
     {
-      int max = mctx->state_log_top;
-      int cur_str_idx = re_string_cur_idx (&mctx->input);
+      Idx max = mctx->state_log_top;
+      Idx cur_str_idx = re_string_cur_idx (&mctx->input);
 
       do
 	{
@@ -2363,10 +2386,10 @@
 static reg_errcode_t
 internal_function
 check_subexp_matching_top (re_match_context_t *mctx, re_node_set *cur_nodes,
-			   int str_idx)
+			   Idx str_idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int node_idx;
+  Idx node_idx;
   reg_errcode_t err;
 
   /* TODO: This isn't efficient.
@@ -2376,7 +2399,7 @@
 	   E.g. RE: (a){2}  */
   for (node_idx = 0; node_idx < cur_nodes->nelem; ++node_idx)
     {
-      int node = cur_nodes->elems[node_idx];
+      Idx node = cur_nodes->elems[node_idx];
       if (dfa->nodes[node].type == OP_OPEN_SUBEXP
 	  && dfa->nodes[node].opr.idx < CHAR_BIT * sizeof dfa->used_bkref_map
 	  && dfa->used_bkref_map & (1u << dfa->nodes[node].opr.idx))
@@ -2400,7 +2423,7 @@
   re_dfa_t *const dfa = mctx->dfa;
   re_node_set next_nodes;
   re_dfastate_t *next_state;
-  int node_cnt, cur_str_idx = re_string_cur_idx (&mctx->input);
+  Idx node_cnt, cur_str_idx = re_string_cur_idx (&mctx->input);
   unsigned int context;
 
   *err = re_node_set_alloc (&next_nodes, state->nodes.nelem + 1);
@@ -2408,7 +2431,7 @@
     return NULL;
   for (node_cnt = 0; node_cnt < state->nodes.nelem; ++node_cnt)
     {
-      int cur_node = state->nodes.elems[node_cnt];
+      Idx cur_node = state->nodes.elems[node_cnt];
       if (check_node_accept (mctx, dfa->nodes + cur_node, cur_str_idx))
 	{
 	  *err = re_node_set_merge (&next_nodes,
@@ -2438,13 +2461,14 @@
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int i;
+  Idx i;
 
   for (i = 0; i < pstate->nodes.nelem; ++i)
     {
       re_node_set dest_nodes, *new_nodes;
-      int cur_node_idx = pstate->nodes.elems[i];
-      int naccepted, dest_idx;
+      Idx cur_node_idx = pstate->nodes.elems[i];
+      int naccepted;
+      Idx dest_idx;
       unsigned int context;
       re_dfastate_t *dest_state;
 
@@ -2475,7 +2499,7 @@
       if (BE (err != REG_NOERROR, 0))
 	return err;
 #ifdef DEBUG
-      assert (dfa->nexts[cur_node_idx] != -1);
+      assert (dfa->nexts[cur_node_idx] != REG_MISSING);
 #endif
       new_nodes = dfa->eclosures + dfa->nexts[cur_node_idx];
 
@@ -2507,13 +2531,13 @@
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int i;
-  int cur_str_idx = re_string_cur_idx (&mctx->input);
+  Idx i;
+  Idx cur_str_idx = re_string_cur_idx (&mctx->input);
 
   for (i = 0; i < nodes->nelem; ++i)
     {
-      int dest_str_idx, prev_nelem, bkc_idx;
-      int node_idx = nodes->elems[i];
+      Idx dest_str_idx, prev_nelem, bkc_idx;
+      Idx node_idx = nodes->elems[i];
       unsigned int context;
       const re_token_t *node = dfa->nodes + node_idx;
       re_node_set *new_dest_nodes;
@@ -2540,11 +2564,11 @@
       /* And add the epsilon closures (which is `new_dest_nodes') of
 	 the backreference to appropriate state_log.  */
 #ifdef DEBUG
-      assert (dfa->nexts[node_idx] != -1);
+      assert (dfa->nexts[node_idx] != REG_MISSING);
 #endif
       for (; bkc_idx < mctx->nbkref_ents; ++bkc_idx)
 	{
-	  int subexp_len;
+	  Idx subexp_len;
 	  re_dfastate_t *dest_state;
 	  struct re_backref_cache_entry *bkref_ent;
 	  bkref_ent = mctx->bkref_ents + bkc_idx;
@@ -2617,14 +2641,14 @@
 
 static reg_errcode_t
 internal_function
-get_subexp (re_match_context_t *mctx, int bkref_node, int bkref_str_idx)
+get_subexp (re_match_context_t *mctx, Idx bkref_node, Idx bkref_str_idx)
 {
   re_dfa_t *const dfa = mctx->dfa;
-  int subexp_num, sub_top_idx;
+  Idx subexp_num, sub_top_idx;
   const char *buf = (const char *) re_string_get_buffer (&mctx->input);
   /* Return if we have already checked BKREF_NODE at BKREF_STR_IDX.  */
-  int cache_idx = search_cur_bkref_entry (mctx, bkref_str_idx);
-  if (cache_idx != -1)
+  Idx cache_idx = search_cur_bkref_entry (mctx, bkref_str_idx);
+  if (cache_idx != REG_MISSING)
     {
       const struct re_backref_cache_entry *entry = mctx->bkref_ents + cache_idx;
       do
@@ -2641,7 +2665,7 @@
       reg_errcode_t err;
       re_sub_match_top_t *sub_top = mctx->sub_tops[sub_top_idx];
       re_sub_match_last_t *sub_last;
-      int sub_last_idx, sl_str, bkref_str_off;
+      Idx sub_last_idx, sl_str, bkref_str_off;
 
       if (dfa->nodes[sub_top->node].opr.idx != subexp_num)
 	continue; /* It isn't related.  */
@@ -2652,7 +2676,7 @@
 	 evaluated.  */
       for (sub_last_idx = 0; sub_last_idx < sub_top->nlasts; ++sub_last_idx)
 	{
-	  int sl_str_diff;
+	  regoff_t sl_str_diff;
 	  sub_last = sub_top->lasts[sub_last_idx];
 	  sl_str_diff = sub_last->str_idx - sl_str;
 	  /* The matched string by the sub expression match with the substring
@@ -2697,7 +2721,8 @@
       /* Then, search for the other last nodes of the sub expression.  */
       for (; sl_str <= bkref_str_idx; ++sl_str)
 	{
-	  int cls_node, sl_str_off;
+	  Idx cls_node;
+	  regoff_t sl_str_off;
 	  const re_node_set *nodes;
 	  sl_str_off = sl_str - sub_top->str_idx;
 	  /* The matched string by the sub expression match with the substring
@@ -2725,7 +2750,7 @@
 	  /* Does this state have a ')' of the sub expression?  */
 	  nodes = &mctx->state_log[sl_str]->nodes;
 	  cls_node = find_subexp_node (dfa, nodes, subexp_num, OP_CLOSE_SUBEXP);
-	  if (cls_node == -1)
+	  if (cls_node == REG_MISSING)
 	    continue; /* No.  */
 	  if (sub_top->path == NULL)
 	    {
@@ -2763,10 +2788,10 @@
 static reg_errcode_t
 internal_function
 get_subexp_sub (re_match_context_t *mctx, const re_sub_match_top_t *sub_top,
-		re_sub_match_last_t *sub_last, int bkref_node, int bkref_str)
+		re_sub_match_last_t *sub_last, Idx bkref_node, Idx bkref_str)
 {
   reg_errcode_t err;
-  int to_idx;
+  Idx to_idx;
   /* Can the subexpression arrive the back reference?  */
   err = check_arrival (mctx, &sub_last->path, sub_last->node,
 		       sub_last->str_idx, bkref_node, bkref_str, OP_OPEN_SUBEXP);
@@ -2788,21 +2813,21 @@
 	 nodes.
 	 E.g. RE: (a){2}  */
 
-static int
+static Idx
 internal_function
 find_subexp_node (const re_dfa_t *dfa, const re_node_set *nodes,
-		  int subexp_idx, int type)
+		  Idx subexp_idx, int type)
 {
-  int cls_idx;
+  Idx cls_idx;
   for (cls_idx = 0; cls_idx < nodes->nelem; ++cls_idx)
     {
-      int cls_node = nodes->elems[cls_idx];
+      Idx cls_node = nodes->elems[cls_idx];
       const re_token_t *node = dfa->nodes + cls_node;
       if (node->type == type
 	  && node->opr.idx == subexp_idx)
 	return cls_node;
     }
-  return -1;
+  return REG_MISSING;
 }
 
 /* Check whether the node TOP_NODE at TOP_STR can arrive to the node
@@ -2813,12 +2838,12 @@
 static reg_errcode_t
 internal_function
 check_arrival (re_match_context_t *mctx, state_array_t *path,
-	       int top_node, int top_str, int last_node, int last_str,
+	       Idx top_node, Idx top_str, Idx last_node, Idx last_str,
 	       int type)
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int subexp_num, backup_cur_idx, str_idx, null_cnt;
+  Idx subexp_num, backup_cur_idx, str_idx, null_cnt;
   re_dfastate_t *cur_state = NULL;
   re_node_set *cur_nodes, next_nodes;
   re_dfastate_t **backup_state_log;
@@ -2829,7 +2854,7 @@
   if (BE (path->alloc < last_str + mctx->max_mb_elem_len + 1, 0))
     {
       re_dfastate_t **new_array;
-      int old_alloc = path->alloc;
+      Idx old_alloc = path->alloc;
       path->alloc += last_str + mctx->max_mb_elem_len + 1;
       new_array = re_realloc (path->array, re_dfastate_t *, path->alloc);
       if (new_array == NULL)
@@ -2973,20 +2998,20 @@
 
 static reg_errcode_t
 internal_function
-check_arrival_add_next_nodes (re_match_context_t *mctx, int str_idx,
+check_arrival_add_next_nodes (re_match_context_t *mctx, Idx str_idx,
 			      re_node_set *cur_nodes,
 			      re_node_set *next_nodes)
 {
   re_dfa_t *const dfa = mctx->dfa;
   int result;
-  int cur_idx;
+  Idx cur_idx;
   reg_errcode_t err;
   re_node_set union_set;
   re_node_set_init_empty (&union_set);
   for (cur_idx = 0; cur_idx < cur_nodes->nelem; ++cur_idx)
     {
       int naccepted = 0;
-      int cur_node = cur_nodes->elems[cur_idx];
+      Idx cur_node = cur_nodes->elems[cur_idx];
 #ifdef DEBUG
       re_token_type_t type = dfa->nodes[cur_node].type;
       assert (!IS_EPSILON_NODE (type));
@@ -3000,8 +3025,8 @@
 	  if (naccepted > 1)
 	    {
 	      re_dfastate_t *dest_state;
-	      int next_node = dfa->nexts[cur_node];
-	      int next_idx = str_idx + naccepted;
+	      Idx next_node = dfa->nexts[cur_node];
+	      Idx next_idx = str_idx + naccepted;
 	      dest_state = mctx->state_log[next_idx];
 	      re_node_set_empty (&union_set);
 	      if (dest_state)
@@ -3054,10 +3079,10 @@
 static reg_errcode_t
 internal_function
 check_arrival_expand_ecl (re_dfa_t *dfa, re_node_set *cur_nodes,
-			  int ex_subexp, int type)
+			  Idx ex_subexp, int type)
 {
   reg_errcode_t err;
-  int idx, outside_node;
+  Idx idx, outside_node;
   re_node_set new_nodes;
 #ifdef DEBUG
   assert (cur_nodes->nelem);
@@ -3070,10 +3095,10 @@
 
   for (idx = 0; idx < cur_nodes->nelem; ++idx)
     {
-      int cur_node = cur_nodes->elems[idx];
+      Idx cur_node = cur_nodes->elems[idx];
       re_node_set *eclosure = dfa->eclosures + cur_node;
       outside_node = find_subexp_node (dfa, eclosure, ex_subexp, type);
-      if (outside_node == -1)
+      if (outside_node == REG_MISSING)
 	{
 	  /* There are no problematic nodes, just merge them.  */
 	  err = re_node_set_merge (&new_nodes, eclosure);
@@ -3107,9 +3132,9 @@
 static reg_errcode_t
 internal_function
 check_arrival_expand_ecl_sub (re_dfa_t *dfa, re_node_set *dst_nodes,
-			      int target, int ex_subexp, int type)
+			      Idx target, Idx ex_subexp, int type)
 {
-  int cur_node;
+  Idx cur_node;
   for (cur_node = target; !re_node_set_contains (dst_nodes, cur_node);)
     {
       int err;
@@ -3152,21 +3177,21 @@
 static reg_errcode_t
 internal_function
 expand_bkref_cache (re_match_context_t *mctx, re_node_set *cur_nodes,
-		    int cur_str, int subexp_num, int type)
+		    Idx cur_str, Idx subexp_num, int type)
 {
   re_dfa_t *const dfa = mctx->dfa;
   reg_errcode_t err;
-  int cache_idx_start = search_cur_bkref_entry (mctx, cur_str);
+  Idx cache_idx_start = search_cur_bkref_entry (mctx, cur_str);
   struct re_backref_cache_entry *ent;
 
-  if (cache_idx_start == -1)
+  if (cache_idx_start == REG_MISSING)
     return REG_NOERROR;
 
  restart:
   ent = mctx->bkref_ents + cache_idx_start;
   do
     {
-      int to_idx, next_node;
+      Idx to_idx, next_node;
 
       /* Is this entry ENT is appropriate?  */
       if (!re_node_set_contains (cur_nodes, ent->node))
@@ -3243,10 +3268,11 @@
 build_trtable (re_dfa_t *dfa, re_dfastate_t *state)
 {
   reg_errcode_t err;
-  int i, j, ch, need_word_trtable = 0;
+  Idx i, j;
+  int ch, need_word_trtable = 0;
   unsigned int elem, mask;
   int dests_node_malloced = 0, dest_states_malloced = 0;
-  int ndests; /* Number of the destination states from `state'.  */
+  Idx ndests; /* Number of the destination states from `state'.  */
   re_dfastate_t **trtable;
   re_dfastate_t **dest_states = NULL, **dest_states_word, **dest_states_nl;
   re_node_set follows, *dests_node;
@@ -3276,7 +3302,7 @@
   /* At first, group all nodes belonging to `state' into several
      destinations.  */
   ndests = group_nodes_into_DFAstates (dfa, state, dests_node, dests_ch);
-  if (BE (ndests <= 0, 0))
+  if (BE (! REG_VALID_NONZERO_INDEX (ndests), 0))
     {
       if (dests_node_malloced)
 	free (dests_node);
@@ -3322,13 +3348,13 @@
   /* Then build the states for all destinations.  */
   for (i = 0; i < ndests; ++i)
     {
-      int next_node;
+      Idx next_node;
       re_node_set_empty (&follows);
       /* Merge the follows of this destination states.  */
       for (j = 0; j < dests_node[i].nelem; ++j)
 	{
 	  next_node = dfa->nexts[dests_node[i].elems[j]];
-	  if (next_node != -1)
+	  if (next_node != REG_MISSING)
 	    {
 	      err = re_node_set_merge (&follows, dfa->eclosures + next_node);
 	      if (BE (err != REG_NOERROR, 0))
@@ -3456,15 +3482,15 @@
    to DESTS_NODE[i] and set the characters accepted by the destination
    to DEST_CH[i].  This function return the number of destinations.  */
 
-static int
+static Idx
 internal_function
 group_nodes_into_DFAstates (re_dfa_t *dfa, const re_dfastate_t *state,
 			    re_node_set *dests_node, bitset *dests_ch)
 {
   reg_errcode_t err;
   int result;
-  int i, j, k;
-  int ndests; /* Number of the destinations from `state'.  */
+  Idx i, j, k;
+  Idx ndests; /* Number of the destinations from `state'.  */
   bitset accepts; /* Characters a node can accept.  */
   const re_node_set *cur_nodes = &state->nodes;
   bitset_empty (accepts);
@@ -3634,7 +3660,7 @@
  error_return:
   for (j = 0; j < ndests; ++j)
     re_node_set_free (dests_node + j);
-  return -1;
+  return REG_MISSING;
 }
 
 #ifdef RE_ENABLE_I18N
@@ -3648,12 +3674,12 @@
 
 static int
 internal_function
-check_node_accept_bytes (re_dfa_t *dfa, int node_idx,
-			 const re_string_t *input, int str_idx)
+check_node_accept_bytes (re_dfa_t *dfa, Idx node_idx,
+			 const re_string_t *input, Idx str_idx)
 {
   const re_token_t *node = dfa->nodes + node_idx;
   int char_len, elem_len;
-  int i;
+  Idx i;
 
   if (BE (node->type == OP_UTF8_PERIOD, 0))
     {
@@ -3732,7 +3758,7 @@
 # ifdef _LIBC
       const unsigned char *pin
 	= ((const unsigned char *) re_string_get_buffer (input) + str_idx);
-      int j;
+      Idx j;
       uint32_t nrules;
 # endif /* _LIBC */
       int match_len = 0;
@@ -3831,7 +3857,7 @@
 		    size_t weight_len = weights[idx];
 		    if (weight_len == weights[equiv_class_idx])
 		      {
-			int cnt = 0;
+			Idx cnt = 0;
 			while (cnt <= weight_len
 			       && (weights[equiv_class_idx + 1 + cnt]
 				   == weights[idx + 1 + cnt]))
@@ -3947,7 +3973,7 @@
 static int
 internal_function
 check_node_accept (const re_match_context_t *mctx, const re_token_t *node,
-		   int idx)
+		   Idx idx)
 {
   unsigned char ch;
   ch = re_string_byte_at (&mctx->input, idx);
@@ -4055,10 +4081,10 @@
 
 static reg_errcode_t
 internal_function
-match_ctx_init (re_match_context_t *mctx, int eflags, int n)
+match_ctx_init (re_match_context_t *mctx, int eflags, Idx n)
 {
   mctx->eflags = eflags;
-  mctx->match_last = -1;
+  mctx->match_last = REG_MISSING;
   if (n > 0)
     {
       mctx->bkref_ents = re_malloc (struct re_backref_cache_entry, n);
@@ -4085,10 +4111,10 @@
 internal_function
 match_ctx_clean (re_match_context_t *mctx)
 {
-  int st_idx;
+  Idx st_idx;
   for (st_idx = 0; st_idx < mctx->nsub_tops; ++st_idx)
     {
-      int sl_idx;
+      Idx sl_idx;
       re_sub_match_top_t *top = mctx->sub_tops[st_idx];
       for (sl_idx = 0; sl_idx < top->nlasts; ++sl_idx)
 	{
@@ -4128,8 +4154,8 @@
 
 static reg_errcode_t
 internal_function
-match_ctx_add_entry (re_match_context_t *mctx, int node, int str_idx,
-		     int from, int to)
+match_ctx_add_entry (re_match_context_t *mctx, Idx node, Idx str_idx,
+		     Idx from, Idx to)
 {
   if (mctx->nbkref_ents >= mctx->abkref_ents)
     {
@@ -4172,14 +4198,14 @@
   return REG_NOERROR;
 }
 
-/* Search for the first entry which has the same str_idx, or -1 if none is
+/* Return the first entry with the same str_idx, or REG_MISSING if none is
    found.  Note that MCTX->BKREF_ENTS is already sorted by MCTX->STR_IDX.  */
 
-static int
+static Idx
 internal_function
-search_cur_bkref_entry (re_match_context_t *mctx, int str_idx)
+search_cur_bkref_entry (re_match_context_t *mctx, Idx str_idx)
 {
-  int left, right, mid, last;
+  Idx left, right, mid, last;
   last = right = mctx->nbkref_ents;
   for (left = 0; left < right;)
     {
@@ -4192,7 +4218,7 @@
   if (left < last && mctx->bkref_ents[left].str_idx == str_idx)
     return left;
   else
-    return -1;
+    return REG_MISSING;
 }
 
 /* Register the node NODE, whose type is OP_OPEN_SUBEXP, and which matches
@@ -4200,7 +4226,7 @@
 
 static reg_errcode_t
 internal_function
-match_ctx_add_subtop (re_match_context_t *mctx, int node, int str_idx)
+match_ctx_add_subtop (re_match_context_t *mctx, Idx node, Idx str_idx)
 {
 #ifdef DEBUG
   assert (mctx->sub_tops != NULL);
@@ -4208,7 +4234,7 @@
 #endif
   if (BE (mctx->nsub_tops == mctx->asub_tops, 0))
     {
-      int new_asub_tops = mctx->asub_tops * 2;
+      Idx new_asub_tops = mctx->asub_tops * 2;
       re_sub_match_top_t **new_array = re_realloc (mctx->sub_tops,
 						   re_sub_match_top_t *,
 						   new_asub_tops);
@@ -4230,12 +4256,12 @@
 
 static re_sub_match_last_t *
 internal_function
-match_ctx_add_sublast (re_sub_match_top_t *subtop, int node, int str_idx)
+match_ctx_add_sublast (re_sub_match_top_t *subtop, Idx node, Idx str_idx)
 {
   re_sub_match_last_t *new_entry;
   if (BE (subtop->nlasts == subtop->alasts, 0))
     {
-      int new_alasts = 2 * subtop->alasts + 1;
+      Idx new_alasts = 2 * subtop->alasts + 1;
       re_sub_match_last_t **new_array = re_realloc (subtop->lasts,
 						    re_sub_match_last_t *,
 						    new_alasts);
@@ -4260,7 +4286,7 @@
 sift_ctx_init (re_sift_context_t *sctx,
 	       re_dfastate_t **sifted_sts,
 	       re_dfastate_t **limited_sts,
-	       int last_node, int last_str_idx)
+	       Idx last_node, Idx last_str_idx)
 {
   sctx->sifted_states = sifted_sts;
   sctx->limited_states = limited_sts;
--- a/m4/ChangeLog
+++ b/m4/ChangeLog
@@ -1,3 +1,9 @@
+2005-08-31  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* regex.m4 (gl_REGEX): Require AC_SYS_LARGEFILE, Define
+	_REGEX_LARGE_OFFSETS).  Test for regoff_t/off_t bug in 64-bit
+	and large-file glibc and in 32-bit large-file Solaris.
+
 2005-08-28  Bruno Haible  <bruno@clisp.org>
 
 	* gnulib-tool.m4: New file.
--- a/m4/regex.m4
+++ b/m4/regex.m4
@@ -1,4 +1,4 @@
-#serial 28
+#serial 29
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005 Free
 # Software Foundation, Inc.
@@ -14,6 +14,10 @@
 
 AC_DEFUN([gl_REGEX],
 [
+  AC_REQUIRE([AC_SYS_LARGEFILE]) dnl for a sufficently-wide off_t
+  AC_DEFINE([_REGEX_LARGE_OFFSETS], 1,
+    [Define if you want regoff_t to be at least as wide POSIX requires.])
+
   AC_LIBSOURCES(
     [regcomp.c, regex.c, regex.h,
      regex_internal.c, regex_internal.h, regexec.c])
@@ -97,6 +101,13 @@
 	    if (! REG_STARTEND)
 	      exit (1);
 
+	    /* Reject hosts whose regoff_t values are too narrow.
+	       These include glibc 2.3.5 on hosts with 64-bit off_t
+	       and 32-bit int, and Solaris 10 on hosts with 32-bit int
+	       and _FILE_OFFSET_BITS=64.  */
+	    if (sizeof (regoff_t) < sizeof (off_t))
+	      exit (1);
+
 	    exit (0);]])],
        [gl_cv_func_re_compile_pattern_broken=no],
        [gl_cv_func_re_compile_pattern_broken=yes],