Fix CVE-2007-{4770,4771} (sync with upstream by patch-db).

Bump PKGREVISION.  Pointed out by drochner@ in private e-mail.

3 files changed, 952 insertions, 3 deletions

diff --git a/misc/openoffice2/Makefile b/misc/openoffice2/Makefile
index 3665469f678..2f903c81247 100644
--- a/misc/openoffice2/Makefile
+++ b/misc/openoffice2/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.39 2008/03/09 12:57:27 joerg Exp $
+# $NetBSD: Makefile,v 1.40 2008/03/21 09:20:55 hira Exp $
 #
 
 OO_VER=			2.3.1
-PKGREVISION=		4
+PKGREVISION=		5
 DISTNAME=		openoffice-${OO_VER}
 PKGNAME=		openoffice2-${OO_VER}
 CATEGORIES=		misc
diff --git a/misc/openoffice2/distinfo b/misc/openoffice2/distinfo
index fa29a75d335..bccac44f0a3 100644
--- a/misc/openoffice2/distinfo
+++ b/misc/openoffice2/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.34 2008/02/06 16:41:07 hira Exp $
+$NetBSD: distinfo,v 1.35 2008/03/21 09:20:56 hira Exp $
 
 SHA1 (openoffice-2.3.1/OOo_2.3.1_src_binfilter.tar.bz2) = 0643c52da3850a164928342e7651897b7a76ca1f
 RMD160 (openoffice-2.3.1/OOo_2.3.1_src_binfilter.tar.bz2) = 497aec1de49ea941ab8305331a9fc9e8e04a5162
@@ -68,3 +68,4 @@ SHA1 (patch-cx) = 1c2efe192b0535ff6b2dc59e6a138c9931e6e946
 SHA1 (patch-cy) = 8d47bcf1da6f351f4f0cbf6a8355903094b0baee
 SHA1 (patch-cz) = e9850759fccff68914b104f4075e79c61b1010eb
 SHA1 (patch-da) = c2c9332dcf22d2d201215813ac9fc7e7ac401c6d
+SHA1 (patch-db) = 2760f1dd5a19afb7e329796318beedfc6972f039
diff --git a/misc/openoffice2/patches/patch-db b/misc/openoffice2/patches/patch-db
new file mode 100644
index 00000000000..6cfc3ee5089
--- /dev/null
+++ b/misc/openoffice2/patches/patch-db
@@ -0,0 +1,948 @@
+$NetBSD: patch-db,v 1.1 2008/03/21 09:20:56 hira Exp $
+
+Fix CVE-2007-4770 and CVE-2007-4771.
+
+--- icu/icu-3.6.patch.orig	2007-10-25 23:01:33.000000000 +0900
++++ icu/icu-3.6.patch	2008-03-21 17:38:36.000000000 +0900
+@@ -1,5 +1,5 @@
+ *** misc/icu/source/common/putil.c	Mon Jul 31 20:14:28 2006
+---- misc/build/icu/source/common/putil.c	Tue Sep 18 19:30:30 2007
++--- misc/build/icu/source/common/putil.c	Mon Jan 28 21:31:50 2008
+ ***************
+ *** 48,54 ****
+   #endif
+@@ -19,7 +19,7 @@
+   #endif
+   
+ *** misc/icu/source/common/unicode/pwin32.h	Tue Aug 29 23:34:38 2006
+---- misc/build/icu/source/common/unicode/pwin32.h	Tue Sep 18 19:30:30 2007
++--- misc/build/icu/source/common/unicode/pwin32.h	Mon Jan 28 21:31:50 2008
+ ***************
+ *** 266,273 ****
+ --- 266,278 ----
+@@ -37,10 +37,10 @@
+   /*===========================================================================*/
+   /* Code alignment and C function inlining                                    */
+ *** misc/icu/source/common/unicode/rbbi.h	Fri Aug 11 07:46:40 2006
+---- misc/build/icu/source/common/unicode/rbbi.h	Tue Sep 18 19:35:01 2007
++--- misc/build/icu/source/common/unicode/rbbi.h	Mon Jan 28 21:31:50 2008
+ ***************
+-*** 611,616 ****
+---- 611,617 ----
++*** 611,622 ****
++--- 611,624 ----
+       virtual int32_t getBreakType() const;
+   #endif
+   
+@@ -48,9 +48,6 @@
+       /**
+         * Set the type of the break iterator.
+         * @internal
+-***************
+-*** 617,622 ****
+---- 618,624 ----
+         */
+       virtual void setBreakType(int32_t type);
+   
+@@ -59,7 +56,7 @@
+         * Common initialization function, used by constructors and bufferClone.
+         *   (Also used by DictionaryBasedBreakIterator::createBufferClone().)
+ *** misc/icu/source/common/unicode/umachine.h	Tue Feb  7 02:54:16 2006
+---- misc/build/icu/source/common/unicode/umachine.h	Tue Sep 18 19:30:30 2007
++--- misc/build/icu/source/common/unicode/umachine.h	Mon Jan 28 21:31:50 2008
+ ***************
+ *** 322,328 ****
+    */
+@@ -78,7 +75,7 @@
+   #else
+       typedef uint16_t UChar;
+ *** misc/icu/source/common/unicode/unistr.h	Tue Aug 29 23:52:50 2006
+---- misc/build/icu/source/common/unicode/unistr.h	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/common/unicode/unistr.h	Mon Jan 28 21:31:50 2008
+ ***************
+ *** 3280,3286 ****
+   //========================================
+@@ -182,7 +179,7 @@
+   }
+   
+ *** misc/icu/source/common/unicode/ustring.h	Tue Aug 29 23:52:50 2006
+---- misc/build/icu/source/common/unicode/ustring.h	Tue Sep 18 19:30:30 2007
++--- misc/build/icu/source/common/unicode/ustring.h	Mon Jan 28 21:31:50 2008
+ ***************
+ *** 918,924 ****
+    * </pre>
+@@ -200,8 +197,180 @@
+   #   define U_STRING_DECL(var, cs, length) static const wchar_t var[(length)+1]={ L ## cs }
+       /**@stable ICU 2.0 */
+   #   define U_STRING_INIT(var, cs, length)
++*** misc/icu/source/common/uvectr32.cpp	Wed Aug 27 03:01:30 2003
++--- misc/build/icu/source/common/uvectr32.cpp	Mon Jan 28 21:31:51 2008
++***************
++*** 1,6 ****
++  /*
++  ******************************************************************************
++! * Copyright (C) 1999-2003, International Business Machines Corporation and   *
++  * others. All Rights Reserved.                                               *
++  ******************************************************************************
++  *   Date        Name        Description
++--- 1,6 ----
++  /*
++  ******************************************************************************
++! * Copyright (C) 1999-2008, International Business Machines Corporation and   *
++  * others. All Rights Reserved.                                               *
++  ******************************************************************************
++  *   Date        Name        Description
++***************
++*** 26,31 ****
++--- 26,32 ----
++  UVector32::UVector32(UErrorCode &status) :
++      count(0),
++      capacity(0),
+++     maxCapacity(0),
++      elements(NULL)
++  {
++      _init(DEFUALT_CAPACITY, status);
++***************
++*** 34,39 ****
++--- 35,41 ----
++  UVector32::UVector32(int32_t initialCapacity, UErrorCode &status) :
++      count(0),
++      capacity(0),
+++     maxCapacity(0),
++      elements(0)
++  {
++      _init(initialCapacity, status);
++***************
++*** 46,51 ****
++--- 48,56 ----
++      if (initialCapacity < 1) {
++          initialCapacity = DEFUALT_CAPACITY;
++      }
+++     if (maxCapacity>0 && maxCapacity<initialCapacity) {
+++         initialCapacity = maxCapacity;
+++     }
++      elements = (int32_t *)uprv_malloc(sizeof(int32_t)*initialCapacity);
++      if (elements == 0) {
++          status = U_MEMORY_ALLOCATION_ERROR;
++***************
++*** 189,209 ****
++  UBool UVector32::expandCapacity(int32_t minimumCapacity, UErrorCode &status) {
++      if (capacity >= minimumCapacity) {
++          return TRUE;
++!     } else {
++!         int32_t newCap = capacity * 2;
++!         if (newCap < minimumCapacity) {
++!             newCap = minimumCapacity;
++!         }
++!         int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
++!         if (newElems == 0) {
++!             status = U_MEMORY_ALLOCATION_ERROR;
++!             return FALSE;
++!         }
++!         uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
++!         uprv_free(elements);
++!         elements = newElems;
++!         capacity = newCap;
++!         return TRUE;
++      }
++  }
++  
++--- 194,228 ----
++  UBool UVector32::expandCapacity(int32_t minimumCapacity, UErrorCode &status) {
++      if (capacity >= minimumCapacity) {
++          return TRUE;
++!     }
++!     if (maxCapacity>0 && minimumCapacity>maxCapacity) {
++!         status = U_BUFFER_OVERFLOW_ERROR;
++!         return FALSE;
++!     }
++!     int32_t newCap = capacity * 2;
++!     if (newCap < minimumCapacity) {
++!         newCap = minimumCapacity;
++!     }
++!     if (maxCapacity > 0 && newCap > maxCapacity) {
++!         newCap = maxCapacity;
++!     }
++!     int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
++!     if (newElems == 0) {
++!         status = U_MEMORY_ALLOCATION_ERROR;
++!         return FALSE;
++!     }
++!     uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
++!     uprv_free(elements);
++!     elements = newElems;
++!     capacity = newCap;
++!     return TRUE;
++! }
++! 
++! void UVector32::setMaxCapacity(int32_t limit) {
++!     U_ASSERT(limit >= 0);
++!     maxCapacity = limit;
++!     if (maxCapacity < 0) {
++!         maxCapacity = 0;
++      }
++  }
++  
++*** misc/icu/source/common/uvectr32.h	Wed Jan 18 04:52:04 2006
++--- misc/build/icu/source/common/uvectr32.h	Mon Jan 28 21:31:51 2008
++***************
++*** 1,6 ****
++  /*
++  **********************************************************************
++! *   Copyright (C) 1999-2006, International Business Machines
++  *   Corporation and others.  All Rights Reserved.
++  **********************************************************************
++  */
++--- 1,6 ----
++  /*
++  **********************************************************************
++! *   Copyright (C) 1999-2008, International Business Machines
++  *   Corporation and others.  All Rights Reserved.
++  **********************************************************************
++  */
++***************
++*** 61,66 ****
++--- 61,68 ----
++      int32_t   count;
++  
++      int32_t   capacity;
+++     
+++     int32_t   maxCapacity;   // Limit beyond which capacity is not permitted to grow.
++  
++      int32_t*  elements;
++  
++***************
++*** 162,167 ****
++--- 164,177 ----
++      int32_t *getBuffer() const;
++  
++      /**
+++      * Set the maximum allowed buffer capacity for this vector/stack.
+++      * Default with no limit set is unlimited, go until malloc() fails.
+++      * A Limit of zero means unlimited capacity.
+++      * Units are vector elements (32 bits each), not bytes.
+++      */
+++     void setMaxCapacity(int32_t limit);
+++ 
+++     /**
++       * ICU "poor man's RTTI", returns a UClassID for this class.
++       */
++      static UClassID U_EXPORT2 getStaticClassID();
++***************
++*** 221,227 ****
++  }
++  
++  inline int32_t *UVector32::reserveBlock(int32_t size, UErrorCode &status) {
++!     ensureCapacity(count+size, status);
++      int32_t  *rp = elements+count;
++      count += size;
++      return rp;
++--- 231,239 ----
++  }
++  
++  inline int32_t *UVector32::reserveBlock(int32_t size, UErrorCode &status) {
++!     if (ensureCapacity(count+size, status) == FALSE) {
++!         return NULL;
++!     }
++      int32_t  *rp = elements+count;
++      count += size;
++      return rp;
+ *** misc/icu/source/config/mh-darwin	Wed Feb  1 08:52:42 2006
+---- misc/build/icu/source/config/mh-darwin	Tue Sep 18 19:30:30 2007
++--- misc/build/icu/source/config/mh-darwin	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 25,31 ****
+   SHLIB.cc=	$(CXX) -dynamiclib -dynamic $(CXXFLAGS) $(LDFLAGS)
+@@ -220,7 +389,7 @@
+   ## Compiler switch to embed a runtime search path
+   LD_RPATH=
+ *** misc/icu/source/config/mh-irix	Thu Mar 23 19:51:52 2006
+---- misc/build/icu/source/config/mh-irix	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/config/mh-irix	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 23,28 ****
+ --- 23,31 ----
+@@ -234,25 +403,26 @@
+   THREADSCPPFLAGS = -D_REENTRANT -D_PTHREADS
+   LIBCPPFLAGS =
+ *** misc/icu/source/config/mh-linux	Thu Mar 23 19:51:52 2006
+---- misc/build/icu/source/config/mh-linux	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/config/mh-linux	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 20,25 ****
+---- 20,32 ----
++--- 20,33 ----
+   LD_RPATH=	
+   LD_RPATH_PRE = -Wl,-rpath,
+   
+ + ## Force RPATH=$ORIGIN to locate own dependencies w/o need for LD_LIBRARY_PATH
+++ ## (incl. the C++ runtime libs potentially found in the URE lib dir):
+ + ENABLE_RPATH=YES
+-+ RPATHLDFLAGS=${LD_RPATH_PRE}'$$ORIGIN'
+++ RPATHLDFLAGS=${LD_RPATH_PRE}'$$ORIGIN:$$ORIGIN/../ure-link/lib'
+ + 
+ + #SH#  ENABLE_RPATH=YES
+-+ #SH#  RPATHLDFLAGS="${LD_RPATH_PRE}'$$ORIGIN'"
+++ #SH#  RPATHLDFLAGS="${LD_RPATH_PRE}'$$ORIGIN:$$ORIGIN/../ure-link/lib'"
+ + 
+   ## These are the library specific LDFLAGS
+   LDFLAGSICUDT=-nodefaultlibs -nostdlib
+   
+ *** misc/icu/source/config/mh-mingw	Tue Aug 15 10:24:14 2006
+---- misc/build/icu/source/config/mh-mingw	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/config/mh-mingw	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 54,59 ****
+ --- 54,62 ----
+@@ -274,16 +444,19 @@
+   # Current full path directory for use in source code in a -D compiler option.
+   CURR_SRCCODE_FULL_DIR=$(subst /,\\\\,$(shell pwd -W))#M#
+   
+---- 74,80 ----
++--- 74,83 ----
+   
+   # The #M# is used to delete lines for icu-config
+   # Current full path directory.
+ ! CURR_FULL_DIR=$(subst \,/,$(shell cygpath -aw .))#M#
++! SRCDIRW:=$(SRCDIR)
++! SRCDIR:=$(foreach p,$(SRCDIR),$(shell cygpath -u $(subst \,/,$(p))))#M#
++! DATAFILEPATHS:=$(foreach p,$(DATAFILEPATHS),$(shell cygpath -u $(subst \,/,$(p))))#M#
+   # Current full path directory for use in source code in a -D compiler option.
+   CURR_SRCCODE_FULL_DIR=$(subst /,\\\\,$(shell pwd -W))#M#
+   
+ *** misc/icu/source/config/mh-solaris	Fri Feb 24 20:31:14 2006
+---- misc/build/icu/source/config/mh-solaris	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/config/mh-solaris	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 18,34 ****
+   
+@@ -330,7 +503,7 @@
+   
+   ## Compiler switch to embed a library name
+ *** misc/icu/source/data/Makefile.in	Sat Aug 12 00:22:24 2006
+---- misc/build/icu/source/data/Makefile.in	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/data/Makefile.in	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 344,350 ****
+   ifneq ($(ICUDATA_SOURCE_IS_NATIVE_TARGET),YES)
+@@ -348,27 +521,195 @@
+   else
+   	@echo "$@" > $@
+   endif
+-*** misc/icu/source/i18n/windtfmt.cpp	Tue Aug 15 08:48:02 2006
+---- misc/build/icu/source/i18n/windtfmt.cpp	Tue Sep 18 19:30:31 2007
++*** misc/icu/source/i18n/regexcmp.cpp	Thu Feb  2 05:37:14 2006
++--- misc/build/icu/source/i18n/regexcmp.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+-*** 232,238 ****
+-      UChar stackBuffer[STACK_BUFFER_SIZE];
+-      UChar *buffer = stackBuffer;
++*** 2,8 ****
++  //
++  //  file:  regexcmp.cpp
++  //
++! //  Copyright (C) 2002-2006 International Business Machines Corporation and others.
++  //  All Rights Reserved.
++  //
++  //  This file contains the ICU regular expression compiler, which is responsible
++--- 2,8 ----
++  //
++  //  file:  regexcmp.cpp
++  //
++! //  Copyright (C) 2002-2008 International Business Machines Corporation and others.
++  //  All Rights Reserved.
++  //
++  //  This file contains the ICU regular expression compiler, which is responsible
++***************
++*** 1187,1200 ****
++              // Because capture groups can be forward-referenced by back-references,
++              //  we fill the operand with the capture group number.  At the end
++              //  of compilation, it will be changed to the variable's location.
++!             U_ASSERT(groupNum > 0);
++!             int32_t  op;
++!             if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
++!                 op = URX_BUILD(URX_BACKREF_I, groupNum);
++              } else {
++!                 op = URX_BUILD(URX_BACKREF, groupNum);
++              }
++-             fRXPat->fCompiledPat->addElement(op, *fStatus);
++          }
++          break;
+   
+-!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, buffer, STACK_BUFFER_SIZE);
++--- 1187,1203 ----
++              // Because capture groups can be forward-referenced by back-references,
++              //  we fill the operand with the capture group number.  At the end
++              //  of compilation, it will be changed to the variable's location.
++!             if (groupNum < 1) { 
++!                 error(U_REGEX_INVALID_BACK_REF);
++              } else {
++!                 int32_t  op;
++!                 if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
++!                     op = URX_BUILD(URX_BACKREF_I, groupNum);
++!                 } else {
++!                     op = URX_BUILD(URX_BACKREF, groupNum);
++!                 }
++!                 fRXPat->fCompiledPat->addElement(op, *fStatus);
++              }
++          }
++          break;
+   
+-      if (result == 0) {
+-          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+---- 232,238 ----
++*** misc/icu/source/i18n/rematch.cpp	Thu Aug 25 20:02:20 2005
++--- misc/build/icu/source/i18n/rematch.cpp	Mon Jan 28 21:31:51 2008
++***************
++*** 6,12 ****
++  //
++  /*
++  **************************************************************************
++! *   Copyright (C) 2002-2005 International Business Machines Corporation  *
++  *   and others. All rights reserved.                                     *
++  **************************************************************************
++  */
++--- 6,12 ----
++  //
++  /*
++  **************************************************************************
++! *   Copyright (C) 2002-2008 International Business Machines Corporation  *
++  *   and others. All rights reserved.                                     *
++  **************************************************************************
++  */
++***************
++*** 30,35 ****
++--- 30,44 ----
++  
++  U_NAMESPACE_BEGIN
++  
+++ // Limit the size of the back track stack, to avoid system failures caused
+++ //   by heap exhaustion.  Units are in 32 bit words, not bytes.
+++ // This value puts ICU's limits higher than most other regexp implementations,
+++ //  which use recursion rather than the heap, and take more storage per
+++ //  backtrack point.
+++ // This constant is _temporary_.  Proper API to control the value will added.
+++ //
+++ static const int32_t BACKTRACK_STACK_CAPACITY = 8000000;
+++ 
++  //-----------------------------------------------------------------------------
++  //
++  //   Constructor and Destructor
++***************
++*** 53,60 ****
++      }
++      if (fStack == NULL || fData == NULL) {
++          fDeferredStatus = U_MEMORY_ALLOCATION_ERROR;
++      }
++-         
++      reset(*RegexStaticSets::gStaticSets->fEmptyString);
++  }
++  
++--- 62,70 ----
++      }
++      if (fStack == NULL || fData == NULL) {
++          fDeferredStatus = U_MEMORY_ALLOCATION_ERROR;
+++     } else {
+++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
++      }
++      reset(*RegexStaticSets::gStaticSets->fEmptyString);
++  }
++  
++***************
++*** 78,83 ****
++--- 88,95 ----
++      }
++      if (fStack == NULL || fData == NULL) {
++          status = U_MEMORY_ALLOCATION_ERROR;
+++     } else {
+++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
++      }
++      reset(input);
++  }
++***************
++*** 102,107 ****
++--- 114,121 ----
++      }
++      if (fStack == NULL || fData == NULL) {
++          status = U_MEMORY_ALLOCATION_ERROR;
+++     } else {
+++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
++      }
++      reset(*RegexStaticSets::gStaticSets->fEmptyString);
++  }
++***************
++*** 1015,1020 ****
++--- 1029,1042 ----
++  inline REStackFrame *RegexMatcher::StateSave(REStackFrame *fp, int32_t savePatIdx, int32_t frameSize, UErrorCode &status) {
++      // push storage for a new frame. 
++      int32_t *newFP = fStack->reserveBlock(frameSize, status);
+++     if (newFP == NULL) {
+++         // Heap allocation error on attempted stack expansion.
+++         // We need to return a writable stack frame, so just return the
+++         //    previous frame.  The match operation will stop quickly
+++         //    becuase of the error status, after which the frame will never
+++         //    be looked at again.
+++         return fp;
+++     }
++      fp = (REStackFrame *)(newFP - frameSize);  // in case of realloc of stack.
++      
++      // New stack frame = copy of old top frame.
++***************
++*** 1030,1037 ****
++      fp->fPatIdx = savePatIdx;
++      return (REStackFrame *)newFP;
++  }
++!     
++!             
++  //--------------------------------------------------------------------------------
++  //
++  //   MatchAt      This is the actual matching engine.
++--- 1052,1059 ----
++      fp->fPatIdx = savePatIdx;
++      return (REStackFrame *)newFP;
++  }
++! 
++! 
++  //--------------------------------------------------------------------------------
++  //
++  //   MatchAt      This is the actual matching engine.
++***************
++*** 2262,2267 ****
++--- 2284,2290 ----
++          }
++  
++          if (U_FAILURE(status)) {
+++             isMatch = FALSE;
++              break;
++          }
++      }
++*** misc/icu/source/i18n/windtfmt.cpp	Tue Aug 15 08:48:02 2006
++--- misc/build/icu/source/i18n/windtfmt.cpp	Mon Jan 28 21:31:51 2008
++***************
++*** 232,249 ****
+       UChar stackBuffer[STACK_BUFFER_SIZE];
+       UChar *buffer = stackBuffer;
+   
+-!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
++!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, buffer, STACK_BUFFER_SIZE);
+   
+       if (result == 0) {
+           if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+-***************
+-*** 239,249 ****
+               int newLength = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, NULL, 0);
+   
+               buffer = NEW_ARRAY(UChar, newLength);
+@@ -380,7 +721,14 @@
+   
+       if (buffer != stackBuffer) {
+           DELETE_ARRAY(buffer);
+---- 239,249 ----
++--- 232,249 ----
++      UChar stackBuffer[STACK_BUFFER_SIZE];
++      UChar *buffer = stackBuffer;
++  
++!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
++  
++      if (result == 0) {
++          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+               int newLength = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, NULL, 0);
+   
+               buffer = NEW_ARRAY(UChar, newLength);
+@@ -393,7 +741,7 @@
+       if (buffer != stackBuffer) {
+           DELETE_ARRAY(buffer);
+ ***************
+-*** 258,264 ****
++*** 258,275 ****
+       UChar stackBuffer[STACK_BUFFER_SIZE];
+       UChar *buffer = stackBuffer;
+   
+@@ -401,16 +749,6 @@
+   
+       if (result == 0) {
+           if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+---- 258,264 ----
+-      UChar stackBuffer[STACK_BUFFER_SIZE];
+-      UChar *buffer = stackBuffer;
+-  
+-!     result = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
+-  
+-      if (result == 0) {
+-          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+-***************
+-*** 265,275 ****
+               int newLength = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, NULL, 0);
+   
+               buffer = NEW_ARRAY(UChar, newLength);
+@@ -422,7 +760,14 @@
+   
+       if (buffer != stackBuffer) {
+           DELETE_ARRAY(buffer);
+---- 265,275 ----
++--- 258,275 ----
++      UChar stackBuffer[STACK_BUFFER_SIZE];
++      UChar *buffer = stackBuffer;
++  
++!     result = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
++  
++      if (result == 0) {
++          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
+               int newLength = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, NULL, 0);
+   
+               buffer = NEW_ARRAY(UChar, newLength);
+@@ -435,7 +780,7 @@
+       if (buffer != stackBuffer) {
+           DELETE_ARRAY(buffer);
+ *** misc/icu/source/i18n/winnmfmt.cpp	Thu Aug 17 07:21:06 2006
+---- misc/build/icu/source/i18n/winnmfmt.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/i18n/winnmfmt.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 86,95 ****
+       GetLocaleInfoA(lcid, LOCALE_SGROUPING, buf, 10);
+@@ -573,7 +918,7 @@
+       if (buffer != stackBuffer) {
+           DELETE_ARRAY(buffer);
+ *** misc/icu/source/layout/CoverageTables.cpp	Sat May  8 01:28:42 2004
+---- misc/build/icu/source/layout/CoverageTables.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/CoverageTables.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 44,49 ****
+ --- 44,53 ----
+@@ -588,7 +933,7 @@
+       le_uint16 probe = power;
+       le_uint16 index = 0;
+ *** misc/icu/source/layout/DeviceTables.cpp	Fri Jan 14 18:25:12 2005
+---- misc/build/icu/source/layout/DeviceTables.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/DeviceTables.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 22,28 ****
+       le_uint16 format = SWAPW(deltaFormat) - 1;
+@@ -608,7 +953,7 @@
+           le_uint16 bits = fieldBits[format];
+           le_uint16 count = 16 / bits;
+ *** misc/icu/source/layout/GXLayoutEngine.cpp	Fri Sep  2 20:22:10 2005
+---- misc/build/icu/source/layout/GXLayoutEngine.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/GXLayoutEngine.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 39,45 ****
+           return 0;
+@@ -627,7 +972,7 @@
+       if (LE_FAILURE(success)) {
+           return 0;
+ *** misc/icu/source/layout/IndicClassTables.cpp	Wed Aug 23 02:12:40 2006
+---- misc/build/icu/source/layout/IndicClassTables.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/IndicClassTables.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 94,100 ****
+       _dr, _db, _db, _db, _db, _xx, _xx, _l1, _dl, _xx, _xx, _s1, _s2, _vr, _xx, _xx, // 09C0 - 09CF
+@@ -646,14 +991,14 @@
+   
+   static const IndicClassTable::CharClass punjCharClasses[] =
+ ***************
+-*** 120,127 ****
+---- 120,140 ----
++*** 120,125 ****
++--- 120,138 ----
+       _iv, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx  // 0AE0 - 0AEF
+   };
+   
+ + #if 1
+-  static const IndicClassTable::CharClass oryaCharClasses[] =
+-  {
+++ static const IndicClassTable::CharClass oryaCharClasses[] =
+++ {
+ +     _xx, _ma, _mp, _mp, _xx, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _xx, _xx, _iv, /* 0B00 - 0B0F */
+ +     _iv, _xx, _xx, _iv, _iv, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _ct, _bb, /* 0B10 - 0B1F */
+ +     _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _xx, _bb, _bb, _bb, _bb, _bb, _pb, /* 0B20 - 0B2F */
+@@ -664,11 +1009,9 @@
+ +     _xx, _bb                                                                        /* 0B70 - 0B71 */
+ + };
+ + #else
+-+ static const IndicClassTable::CharClass oryaCharClasses[] =
+-+ {
++  static const IndicClassTable::CharClass oryaCharClasses[] =
++  {
+       _xx, _ma, _mp, _mp, _xx, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _xx, _xx, _iv, // 0B00 - 0B0F
+-      _iv, _xx, _xx, _iv, _iv, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, // 0B10 - 0B1F
+-      _ct, _ct, _ct, _ct, _bb, _ct, _ct, _ct, _bb, _xx, _ct, _ct, _bb, _bb, _bb, _pb, // 0B20 - 0B2F
+ ***************
+ *** 131,136 ****
+ --- 144,150 ----
+@@ -763,7 +1106,7 @@
+   //
+   // IndicClassTable addresses
+ *** misc/icu/source/layout/IndicReordering.cpp	Tue Apr 25 21:08:12 2006
+---- misc/build/icu/source/layout/IndicReordering.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/IndicReordering.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 50,55 ****
+ --- 50,63 ----
+@@ -868,7 +1211,7 @@
+                   output.writeMbelow();
+                   output.writeSMbelow(); // FIXME: there are no SMs in these scripts...
+ *** misc/icu/source/layout/LESwaps.h	Thu Jun 23 00:39:36 2005
+---- misc/build/icu/source/layout/LESwaps.h	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/LESwaps.h	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 2,7 ****
+ --- 2,8 ----
+@@ -944,7 +1287,7 @@
+    * This class is used to access data which stored in big endian order
+    * regardless of the conventions of the platform. It has been designed
+ *** misc/icu/source/layout/MPreFixups.cpp	Sat May  8 01:28:44 2004
+---- misc/build/icu/source/layout/MPreFixups.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/MPreFixups.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 40,45 ****
+ --- 40,51 ----
+@@ -961,7 +1304,7 @@
+   {
+       for (le_int32 fixup = 0; fixup < fFixupCount; fixup += 1) {
+ *** misc/icu/source/layout/MPreFixups.h	Mon Apr 12 20:51:32 2004
+---- misc/build/icu/source/layout/MPreFixups.h	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/layout/MPreFixups.h	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 31,36 ****
+ --- 31,38 ----
+@@ -974,10 +1317,10 @@
+       FixupData *fFixupData;
+       le_int32   fFixupCount;
+ *** misc/icu/source/stubdata/Makefile.in	Fri Dec  2 11:21:34 2005
+---- misc/build/icu/source/stubdata/Makefile.in	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/stubdata/Makefile.in	Mon Jan 28 21:31:51 2008
+ ***************
+-*** 25,31 ****
+---- 25,37 ----
++*** 25,30 ****
++--- 25,36 ----
+   ## Target information
+   
+   TARGET_STUBNAME=$(DATA_STUBNAME)
+@@ -985,14 +1328,13 @@
+ + FINAL_SO_TARGET=$(STUBDATA_LIBDIR)$(LIBICU)$(TARGET_STUBNAME)$(ICULIBSUFFIX)$(SO_TARGET_VERSION_MAJOR)$(STUB_SUFFIX).$(SO)
+ + %$(STUB_SUFFIX).$(SO): %$(SO_TARGET_VERSION_MAJOR)$(STUB_SUFFIX).$(SO)
+ + 	$(RM) $@ && ln $< $@
+-  
+-+ endif
+ + 
+++ endif
++  
+   ifneq ($(ENABLE_STATIC),)
+   TARGET = $(STUBDATA_LIBDIR)$(LIBSICU)$(TARGET_STUBNAME)$(ICULIBSUFFIX).$(A)
+-  endif
+ *** misc/icu/source/test/intltest/loctest.cpp	Thu Jul  6 03:50:04 2006
+---- misc/build/icu/source/test/intltest/loctest.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/test/intltest/loctest.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 4,9 ****
+ --- 4,10 ----
+@@ -1003,8 +1345,116 @@
+   #include "loctest.h"
+   #include "unicode/decimfmt.h"
+   #include "unicode/ucurr.h"
++*** misc/icu/source/test/intltest/regextst.cpp	Tue Jul  5 20:39:00 2005
++--- misc/build/icu/source/test/intltest/regextst.cpp	Mon Jan 28 23:18:47 2008
++***************
++*** 1,6 ****
++  /********************************************************************
++   * COPYRIGHT:
++!  * Copyright (c) 2002-2005, International Business Machines Corporation and
++   * others. All Rights Reserved.
++   ********************************************************************/
++  
++--- 1,6 ----
++  /********************************************************************
++   * COPYRIGHT:
++!  * Copyright (c) 2002-2008, International Business Machines Corporation and
++   * others. All Rights Reserved.
++   ********************************************************************/
++  
++***************
++*** 66,71 ****
++--- 66,75 ----
++          case 6: name = "PerlTests";
++              if (exec) PerlTests();
++              break;
+++         case 7: name = "Bug 6149";
+++             if (exec) Bug6149();
+++             break;
+++             
++  
++  
++          default: name = "";
++***************
++*** 1639,1644 ****
++--- 1643,1661 ----
++  
++  }
++  
+++     
+++     // Invalid Back Reference \0
+++     //    For ICU 3.8 and earlier
+++     //    For ICU versions newer than 3.8, \0 introduces an octal escape.
+++     //
+++ #ifndef _MSC_VER
+++ // erAck: 2008-01-28T23:16+0100 MSVC doesn't digest the escaped backslash and
+++ // mumbles something about  
+++ // error C2501: 'regex_err' : missing storage-class or type specifiers
+++ // error C2078: too many initializers
+++ // We're not interested in fixing that deficiency just for a testcase.
+++     REGEX_ERR("(ab)\\0", 1, 6, U_REGEX_INVALID_BACK_REF);
+++ #endif
++  
++  //-------------------------------------------------------------------------------
++  //
++***************
++*** 2119,2124 ****
++--- 2136,2161 ----
++  }
++  
++  
+++ //--------------------------------------------------------------
+++ //
+++ //  Bug6149   Verify limits to heap expansion for backtrack stack.
+++ //             Use this pattern,
+++ //                 "(a?){1,}"
+++ //             The zero-length match will repeat forever.
+++ //                (That this goes into a loop is another bug)
+++ //
+++ //---------------------------------------------------------------
+++ void RegexTest::Bug6149() {
+++     UnicodeString pattern("(a?){1,}");
+++     UnicodeString s("xyz");
+++     uint32_t flags = 0;
+++     UErrorCode status = U_ZERO_ERROR;
+++     
+++     RegexMatcher  matcher(pattern, s, flags, status);
+++     UBool result = false;
+++     REGEX_ASSERT_FAIL(result=matcher.matches(status), U_BUFFER_OVERFLOW_ERROR);
+++     REGEX_ASSERT(result == FALSE);
+++  }
++  
++  #endif  /* !UCONFIG_NO_REGULAR_EXPRESSIONS  */
++  
++*** misc/icu/source/test/intltest/regextst.h	Wed Dec  3 07:58:28 2003
++--- misc/build/icu/source/test/intltest/regextst.h	Mon Jan 28 21:31:51 2008
++***************
++*** 1,6 ****
++  /********************************************************************
++   * COPYRIGHT: 
++!  * Copyright (c) 2002-2003, International Business Machines Corporation and
++   * others. All Rights Reserved.
++   ********************************************************************/
++  
++--- 1,6 ----
++  /********************************************************************
++   * COPYRIGHT: 
++!  * Copyright (c) 2002-2008, International Business Machines Corporation and
++   * others. All Rights Reserved.
++   ********************************************************************/
++  
++***************
++*** 30,35 ****
++--- 30,36 ----
++      virtual void Extended();
++      virtual void Errors();
++      virtual void PerlTests();
+++     virtual void Bug6149();
++  
++      // The following functions are internal to the regexp tests.
++      virtual UBool doRegexLMTest(const char *pat, const char *text, UBool looking, UBool match, int line);
+ *** misc/icu/source/test/intltest/tsputil.cpp	Wed Jul 19 00:18:10 2006
+---- misc/build/icu/source/test/intltest/tsputil.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/test/intltest/tsputil.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 4,9 ****
+ --- 4,10 ----
+@@ -1016,7 +1466,7 @@
+   
+   #include <float.h> // DBL_MAX, DBL_MIN
+ *** misc/icu/source/test/intltest/uobjtest.cpp	Thu Mar 23 01:54:12 2006
+---- misc/build/icu/source/test/intltest/uobjtest.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/test/intltest/uobjtest.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 4,9 ****
+ --- 4,10 ----
+@@ -1028,7 +1478,7 @@
+   #include "cmemory.h" // UAlignedMemory
+   #include <string.h>
+ *** misc/icu/source/test/intltest/ustrtest.cpp	Tue Dec 28 22:13:54 2004
+---- misc/build/icu/source/test/intltest/ustrtest.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/test/intltest/ustrtest.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 4,9 ****
+ --- 4,10 ----
+@@ -1040,7 +1490,7 @@
+   #include "unicode/unistr.h"
+   #include "unicode/uchar.h"
+ *** misc/icu/source/tools/icupkg/icupkg.cpp	Fri Jul 21 23:17:52 2006
+---- misc/build/icu/source/tools/icupkg/icupkg.cpp	Tue Sep 18 19:30:31 2007
++--- misc/build/icu/source/tools/icupkg/icupkg.cpp	Mon Jan 28 21:31:51 2008
+ ***************
+ *** 332,337 ****
+ --- 332,341 ----
+@@ -1054,3 +1504,63 @@
+   extern int
+   main(int argc, char *argv[]) {
+       const char *pname, *sourcePath, *destPath, *inFilename, *outFilename, *outComment;
++*** misc/icu/source/tools/pkgdata/make.c	Wed Mar 22 09:14:10 2006
++--- misc/build/icu/source/tools/pkgdata/make.c	Tue Nov 13 13:03:52 2007
++***************
++*** 172,178 ****
++--- 172,180 ----
++                      "MODE=%s\n"
++                      "MAKEFILE=%s\n"
++                      "ENTRYPOINT=%s\n"
+++ #ifndef __MINGW32__
++                      "include %s\n"
+++ #endif
++                      "\n\n\n",
++                      o->shortName,
++                      o->libName,
++***************
++*** 182,189 ****
++--- 184,195 ----
++                      o->srcDir,
++                      o->mode,
++                      o->makeFile,
+++ #ifdef __MINGW32__
+++                     o->entryName);
+++ #else
++                      o->entryName,
++                      o->options);
+++ #endif
++      T_FileStream_writeLine(f, linebuf);
++      
++      /* TEMP_PATH  and TARG_PATH will be empty if the respective dir is . */
++***************
++*** 233,238 ****
++--- 239,252 ----
++  
++      pkg_writeCharListWrap(f, o->filePaths, " ", " \\\n",0);
++  
+++ #ifdef __MINGW32__
+++     sprintf(linebuf, "\n"
+++                     "include %s\n"
+++                     "\n\n\n",
+++                     o->options);
+++     T_FileStream_writeLine(f, linebuf);
+++ #endif
+++     
++      T_FileStream_writeLine(f, "\n\n\n");
++  
++  }
++***************
++*** 396,402 ****
++--- 410,420 ----
++      T_FileStream_writeLine(f, "BASE_OBJECTS=$(NAME)_dat.o\n");
++      T_FileStream_writeLine(f, "\n");
++      T_FileStream_writeLine(f, "$(TEMP_DIR)/$(NAME).dat: $(CMNLIST) $(DATAFILEPATHS)\n");
+++ #ifdef __MINGW32__
+++     T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCMN) -c -e $(ENTRYPOINT) -n $(NAME) -s $(SRCDIRW) -t dat -d $(TEMP_DIR) 0 $(CMNLIST)\n");
+++ #else
++      T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCMN) -c -e $(ENTRYPOINT) -n $(NAME) -s $(SRCDIR) -t dat -d $(TEMP_DIR) 0 $(CMNLIST)\n");
+++ #endif
++      T_FileStream_writeLine(f, "\n");
++      T_FileStream_writeLine(f, "$(TEMP_DIR)/$(NAME)_dat.o : $(TEMP_DIR)/$(NAME).dat\n");
++      T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCCODE) $(GENCCODE_ASSEMBLY) -n $(NAME) -e $(ENTRYPOINT) -d $(TEMP_DIR) $<\n");