Re: lex(1): signed integer overflow in repetition count

Sorry about that.  doxygen's pre.l uses {0,1000} on several string
patterns (lines 642, 645, 658, 668, 685), which exceeds OpenBSD's
RE_DUP_MAX at 255.

The UBSan trigger I was originally fixing is "lb - 1" wrapping when
lb is INT_MIN (sscanf("%d") clamps overflow that way on OpenBSD).
That only requires forbidding negative values, not capping at 255.
The grammars-too-large case is already caught downstream by the
"input rules are too complicated" check in mkstate().

Minimal follow-up that keeps the overflow guard but drops the cap:

Index: usr.bin/lex/nfa.c
===================================================================
RCS file: /cvs/src/usr.bin/lex/nfa.c,v
retrieving revision 1.13
diff -u -p -r1.13 nfa.c
--- usr.bin/lex/nfa.c	15 May 2026 14:24:44 -0000	1.13
+++ usr.bin/lex/nfa.c
@@ -554,9 +554,8 @@ mkrep(int mach, int lb, int ub)
 {
 	int base_mach, tail, copy, i;

-	if (lb > RE_DUP_MAX || (ub > RE_DUP_MAX &&
-	    ub != INFINITE_REPEAT))
-		flexfatal(_("repetition value too large"));
+	if (lb < 0 || (ub < 0 && ub != INFINITE_REPEAT))
+		flexfatal(_("negative repetition value"));

 	base_mach = copysingl(mach, lb - 1);

Verified on amd64, i386, and arm64 against doxygen and the original
issue.

OK?