Onigmo up to and including 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.
k-takata onigmo