path: root/misc/openoffice2/patches/patch-db

$NetBSD: patch-db,v 1.1 2008/03/21 09:20:56 hira Exp $

Fix CVE-2007-4770 and CVE-2007-4771.

--- icu/icu-3.6.patch.orig	2007-10-25 23:01:33.000000000 +0900
+++ icu/icu-3.6.patch	2008-03-21 17:38:36.000000000 +0900
@@ -1,5 +1,5 @@
 *** misc/icu/source/common/putil.c	Mon Jul 31 20:14:28 2006
---- misc/build/icu/source/common/putil.c	Tue Sep 18 19:30:30 2007
+--- misc/build/icu/source/common/putil.c	Mon Jan 28 21:31:50 2008
 ***************
 *** 48,54 ****
   #endif
@@ -19,7 +19,7 @@
   #endif
   
 *** misc/icu/source/common/unicode/pwin32.h	Tue Aug 29 23:34:38 2006
---- misc/build/icu/source/common/unicode/pwin32.h	Tue Sep 18 19:30:30 2007
+--- misc/build/icu/source/common/unicode/pwin32.h	Mon Jan 28 21:31:50 2008
 ***************
 *** 266,273 ****
 --- 266,278 ----
@@ -37,10 +37,10 @@
   /*===========================================================================*/
   /* Code alignment and C function inlining                                    */
 *** misc/icu/source/common/unicode/rbbi.h	Fri Aug 11 07:46:40 2006
---- misc/build/icu/source/common/unicode/rbbi.h	Tue Sep 18 19:35:01 2007
+--- misc/build/icu/source/common/unicode/rbbi.h	Mon Jan 28 21:31:50 2008
 ***************
-*** 611,616 ****
---- 611,617 ----
+*** 611,622 ****
+--- 611,624 ----
       virtual int32_t getBreakType() const;
   #endif
   
@@ -48,9 +48,6 @@
       /**
         * Set the type of the break iterator.
         * @internal
-***************
-*** 617,622 ****
---- 618,624 ----
         */
       virtual void setBreakType(int32_t type);
   
@@ -59,7 +56,7 @@
         * Common initialization function, used by constructors and bufferClone.
         *   (Also used by DictionaryBasedBreakIterator::createBufferClone().)
 *** misc/icu/source/common/unicode/umachine.h	Tue Feb  7 02:54:16 2006
---- misc/build/icu/source/common/unicode/umachine.h	Tue Sep 18 19:30:30 2007
+--- misc/build/icu/source/common/unicode/umachine.h	Mon Jan 28 21:31:50 2008
 ***************
 *** 322,328 ****
    */
@@ -78,7 +75,7 @@
   #else
       typedef uint16_t UChar;
 *** misc/icu/source/common/unicode/unistr.h	Tue Aug 29 23:52:50 2006
---- misc/build/icu/source/common/unicode/unistr.h	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/common/unicode/unistr.h	Mon Jan 28 21:31:50 2008
 ***************
 *** 3280,3286 ****
   //========================================
@@ -182,7 +179,7 @@
   }
   
 *** misc/icu/source/common/unicode/ustring.h	Tue Aug 29 23:52:50 2006
---- misc/build/icu/source/common/unicode/ustring.h	Tue Sep 18 19:30:30 2007
+--- misc/build/icu/source/common/unicode/ustring.h	Mon Jan 28 21:31:50 2008
 ***************
 *** 918,924 ****
    * </pre>
@@ -200,8 +197,180 @@
   #   define U_STRING_DECL(var, cs, length) static const wchar_t var[(length)+1]={ L ## cs }
       /**@stable ICU 2.0 */
   #   define U_STRING_INIT(var, cs, length)
+*** misc/icu/source/common/uvectr32.cpp	Wed Aug 27 03:01:30 2003
+--- misc/build/icu/source/common/uvectr32.cpp	Mon Jan 28 21:31:51 2008
+***************
+*** 1,6 ****
+  /*
+  ******************************************************************************
+! * Copyright (C) 1999-2003, International Business Machines Corporation and   *
+  * others. All Rights Reserved.                                               *
+  ******************************************************************************
+  *   Date        Name        Description
+--- 1,6 ----
+  /*
+  ******************************************************************************
+! * Copyright (C) 1999-2008, International Business Machines Corporation and   *
+  * others. All Rights Reserved.                                               *
+  ******************************************************************************
+  *   Date        Name        Description
+***************
+*** 26,31 ****
+--- 26,32 ----
+  UVector32::UVector32(UErrorCode &status) :
+      count(0),
+      capacity(0),
++     maxCapacity(0),
+      elements(NULL)
+  {
+      _init(DEFUALT_CAPACITY, status);
+***************
+*** 34,39 ****
+--- 35,41 ----
+  UVector32::UVector32(int32_t initialCapacity, UErrorCode &status) :
+      count(0),
+      capacity(0),
++     maxCapacity(0),
+      elements(0)
+  {
+      _init(initialCapacity, status);
+***************
+*** 46,51 ****
+--- 48,56 ----
+      if (initialCapacity < 1) {
+          initialCapacity = DEFUALT_CAPACITY;
+      }
++     if (maxCapacity>0 && maxCapacity<initialCapacity) {
++         initialCapacity = maxCapacity;
++     }
+      elements = (int32_t *)uprv_malloc(sizeof(int32_t)*initialCapacity);
+      if (elements == 0) {
+          status = U_MEMORY_ALLOCATION_ERROR;
+***************
+*** 189,209 ****
+  UBool UVector32::expandCapacity(int32_t minimumCapacity, UErrorCode &status) {
+      if (capacity >= minimumCapacity) {
+          return TRUE;
+!     } else {
+!         int32_t newCap = capacity * 2;
+!         if (newCap < minimumCapacity) {
+!             newCap = minimumCapacity;
+!         }
+!         int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
+!         if (newElems == 0) {
+!             status = U_MEMORY_ALLOCATION_ERROR;
+!             return FALSE;
+!         }
+!         uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
+!         uprv_free(elements);
+!         elements = newElems;
+!         capacity = newCap;
+!         return TRUE;
+      }
+  }
+  
+--- 194,228 ----
+  UBool UVector32::expandCapacity(int32_t minimumCapacity, UErrorCode &status) {
+      if (capacity >= minimumCapacity) {
+          return TRUE;
+!     }
+!     if (maxCapacity>0 && minimumCapacity>maxCapacity) {
+!         status = U_BUFFER_OVERFLOW_ERROR;
+!         return FALSE;
+!     }
+!     int32_t newCap = capacity * 2;
+!     if (newCap < minimumCapacity) {
+!         newCap = minimumCapacity;
+!     }
+!     if (maxCapacity > 0 && newCap > maxCapacity) {
+!         newCap = maxCapacity;
+!     }
+!     int32_t* newElems = (int32_t *)uprv_malloc(sizeof(int32_t)*newCap);
+!     if (newElems == 0) {
+!         status = U_MEMORY_ALLOCATION_ERROR;
+!         return FALSE;
+!     }
+!     uprv_memcpy(newElems, elements, sizeof(elements[0]) * count);
+!     uprv_free(elements);
+!     elements = newElems;
+!     capacity = newCap;
+!     return TRUE;
+! }
+! 
+! void UVector32::setMaxCapacity(int32_t limit) {
+!     U_ASSERT(limit >= 0);
+!     maxCapacity = limit;
+!     if (maxCapacity < 0) {
+!         maxCapacity = 0;
+      }
+  }
+  
+*** misc/icu/source/common/uvectr32.h	Wed Jan 18 04:52:04 2006
+--- misc/build/icu/source/common/uvectr32.h	Mon Jan 28 21:31:51 2008
+***************
+*** 1,6 ****
+  /*
+  **********************************************************************
+! *   Copyright (C) 1999-2006, International Business Machines
+  *   Corporation and others.  All Rights Reserved.
+  **********************************************************************
+  */
+--- 1,6 ----
+  /*
+  **********************************************************************
+! *   Copyright (C) 1999-2008, International Business Machines
+  *   Corporation and others.  All Rights Reserved.
+  **********************************************************************
+  */
+***************
+*** 61,66 ****
+--- 61,68 ----
+      int32_t   count;
+  
+      int32_t   capacity;
++     
++     int32_t   maxCapacity;   // Limit beyond which capacity is not permitted to grow.
+  
+      int32_t*  elements;
+  
+***************
+*** 162,167 ****
+--- 164,177 ----
+      int32_t *getBuffer() const;
+  
+      /**
++      * Set the maximum allowed buffer capacity for this vector/stack.
++      * Default with no limit set is unlimited, go until malloc() fails.
++      * A Limit of zero means unlimited capacity.
++      * Units are vector elements (32 bits each), not bytes.
++      */
++     void setMaxCapacity(int32_t limit);
++ 
++     /**
+       * ICU "poor man's RTTI", returns a UClassID for this class.
+       */
+      static UClassID U_EXPORT2 getStaticClassID();
+***************
+*** 221,227 ****
+  }
+  
+  inline int32_t *UVector32::reserveBlock(int32_t size, UErrorCode &status) {
+!     ensureCapacity(count+size, status);
+      int32_t  *rp = elements+count;
+      count += size;
+      return rp;
+--- 231,239 ----
+  }
+  
+  inline int32_t *UVector32::reserveBlock(int32_t size, UErrorCode &status) {
+!     if (ensureCapacity(count+size, status) == FALSE) {
+!         return NULL;
+!     }
+      int32_t  *rp = elements+count;
+      count += size;
+      return rp;
 *** misc/icu/source/config/mh-darwin	Wed Feb  1 08:52:42 2006
---- misc/build/icu/source/config/mh-darwin	Tue Sep 18 19:30:30 2007
+--- misc/build/icu/source/config/mh-darwin	Mon Jan 28 21:31:51 2008
 ***************
 *** 25,31 ****
   SHLIB.cc=	$(CXX) -dynamiclib -dynamic $(CXXFLAGS) $(LDFLAGS)
@@ -220,7 +389,7 @@
   ## Compiler switch to embed a runtime search path
   LD_RPATH=
 *** misc/icu/source/config/mh-irix	Thu Mar 23 19:51:52 2006
---- misc/build/icu/source/config/mh-irix	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/config/mh-irix	Mon Jan 28 21:31:51 2008
 ***************
 *** 23,28 ****
 --- 23,31 ----
@@ -234,25 +403,26 @@
   THREADSCPPFLAGS = -D_REENTRANT -D_PTHREADS
   LIBCPPFLAGS =
 *** misc/icu/source/config/mh-linux	Thu Mar 23 19:51:52 2006
---- misc/build/icu/source/config/mh-linux	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/config/mh-linux	Mon Jan 28 21:31:51 2008
 ***************
 *** 20,25 ****
---- 20,32 ----
+--- 20,33 ----
   LD_RPATH=	
   LD_RPATH_PRE = -Wl,-rpath,
   
 + ## Force RPATH=$ORIGIN to locate own dependencies w/o need for LD_LIBRARY_PATH
++ ## (incl. the C++ runtime libs potentially found in the URE lib dir):
 + ENABLE_RPATH=YES
-+ RPATHLDFLAGS=${LD_RPATH_PRE}'$$ORIGIN'
++ RPATHLDFLAGS=${LD_RPATH_PRE}'$$ORIGIN:$$ORIGIN/../ure-link/lib'
 + 
 + #SH#  ENABLE_RPATH=YES
-+ #SH#  RPATHLDFLAGS="${LD_RPATH_PRE}'$$ORIGIN'"
++ #SH#  RPATHLDFLAGS="${LD_RPATH_PRE}'$$ORIGIN:$$ORIGIN/../ure-link/lib'"
 + 
   ## These are the library specific LDFLAGS
   LDFLAGSICUDT=-nodefaultlibs -nostdlib
   
 *** misc/icu/source/config/mh-mingw	Tue Aug 15 10:24:14 2006
---- misc/build/icu/source/config/mh-mingw	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/config/mh-mingw	Mon Jan 28 21:31:51 2008
 ***************
 *** 54,59 ****
 --- 54,62 ----
@@ -274,16 +444,19 @@
   # Current full path directory for use in source code in a -D compiler option.
   CURR_SRCCODE_FULL_DIR=$(subst /,\\\\,$(shell pwd -W))#M#
   
---- 74,80 ----
+--- 74,83 ----
   
   # The #M# is used to delete lines for icu-config
   # Current full path directory.
 ! CURR_FULL_DIR=$(subst \,/,$(shell cygpath -aw .))#M#
+! SRCDIRW:=$(SRCDIR)
+! SRCDIR:=$(foreach p,$(SRCDIR),$(shell cygpath -u $(subst \,/,$(p))))#M#
+! DATAFILEPATHS:=$(foreach p,$(DATAFILEPATHS),$(shell cygpath -u $(subst \,/,$(p))))#M#
   # Current full path directory for use in source code in a -D compiler option.
   CURR_SRCCODE_FULL_DIR=$(subst /,\\\\,$(shell pwd -W))#M#
   
 *** misc/icu/source/config/mh-solaris	Fri Feb 24 20:31:14 2006
---- misc/build/icu/source/config/mh-solaris	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/config/mh-solaris	Mon Jan 28 21:31:51 2008
 ***************
 *** 18,34 ****
   
@@ -330,7 +503,7 @@
   
   ## Compiler switch to embed a library name
 *** misc/icu/source/data/Makefile.in	Sat Aug 12 00:22:24 2006
---- misc/build/icu/source/data/Makefile.in	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/data/Makefile.in	Mon Jan 28 21:31:51 2008
 ***************
 *** 344,350 ****
   ifneq ($(ICUDATA_SOURCE_IS_NATIVE_TARGET),YES)
@@ -348,27 +521,195 @@
   else
   	@echo "$@" > $@
   endif
-*** misc/icu/source/i18n/windtfmt.cpp	Tue Aug 15 08:48:02 2006
---- misc/build/icu/source/i18n/windtfmt.cpp	Tue Sep 18 19:30:31 2007
+*** misc/icu/source/i18n/regexcmp.cpp	Thu Feb  2 05:37:14 2006
+--- misc/build/icu/source/i18n/regexcmp.cpp	Mon Jan 28 21:31:51 2008
 ***************
-*** 232,238 ****
-      UChar stackBuffer[STACK_BUFFER_SIZE];
-      UChar *buffer = stackBuffer;
+*** 2,8 ****
+  //
+  //  file:  regexcmp.cpp
+  //
+! //  Copyright (C) 2002-2006 International Business Machines Corporation and others.
+  //  All Rights Reserved.
+  //
+  //  This file contains the ICU regular expression compiler, which is responsible
+--- 2,8 ----
+  //
+  //  file:  regexcmp.cpp
+  //
+! //  Copyright (C) 2002-2008 International Business Machines Corporation and others.
+  //  All Rights Reserved.
+  //
+  //  This file contains the ICU regular expression compiler, which is responsible
+***************
+*** 1187,1200 ****
+              // Because capture groups can be forward-referenced by back-references,
+              //  we fill the operand with the capture group number.  At the end
+              //  of compilation, it will be changed to the variable's location.
+!             U_ASSERT(groupNum > 0);
+!             int32_t  op;
+!             if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
+!                 op = URX_BUILD(URX_BACKREF_I, groupNum);
+              } else {
+!                 op = URX_BUILD(URX_BACKREF, groupNum);
+              }
+-             fRXPat->fCompiledPat->addElement(op, *fStatus);
+          }
+          break;
   
-!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, buffer, STACK_BUFFER_SIZE);
+--- 1187,1203 ----
+              // Because capture groups can be forward-referenced by back-references,
+              //  we fill the operand with the capture group number.  At the end
+              //  of compilation, it will be changed to the variable's location.
+!             if (groupNum < 1) { 
+!                 error(U_REGEX_INVALID_BACK_REF);
+              } else {
+!                 int32_t  op;
+!                 if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
+!                     op = URX_BUILD(URX_BACKREF_I, groupNum);
+!                 } else {
+!                     op = URX_BUILD(URX_BACKREF, groupNum);
+!                 }
+!                 fRXPat->fCompiledPat->addElement(op, *fStatus);
+              }
+          }
+          break;
   
-      if (result == 0) {
-          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
---- 232,238 ----
+*** misc/icu/source/i18n/rematch.cpp	Thu Aug 25 20:02:20 2005
+--- misc/build/icu/source/i18n/rematch.cpp	Mon Jan 28 21:31:51 2008
+***************
+*** 6,12 ****
+  //
+  /*
+  **************************************************************************
+! *   Copyright (C) 2002-2005 International Business Machines Corporation  *
+  *   and others. All rights reserved.                                     *
+  **************************************************************************
+  */
+--- 6,12 ----
+  //
+  /*
+  **************************************************************************
+! *   Copyright (C) 2002-2008 International Business Machines Corporation  *
+  *   and others. All rights reserved.                                     *
+  **************************************************************************
+  */
+***************
+*** 30,35 ****
+--- 30,44 ----
+  
+  U_NAMESPACE_BEGIN
+  
++ // Limit the size of the back track stack, to avoid system failures caused
++ //   by heap exhaustion.  Units are in 32 bit words, not bytes.
++ // This value puts ICU's limits higher than most other regexp implementations,
++ //  which use recursion rather than the heap, and take more storage per
++ //  backtrack point.
++ // This constant is _temporary_.  Proper API to control the value will added.
++ //
++ static const int32_t BACKTRACK_STACK_CAPACITY = 8000000;
++ 
+  //-----------------------------------------------------------------------------
+  //
+  //   Constructor and Destructor
+***************
+*** 53,60 ****
+      }
+      if (fStack == NULL || fData == NULL) {
+          fDeferredStatus = U_MEMORY_ALLOCATION_ERROR;
+      }
+-         
+      reset(*RegexStaticSets::gStaticSets->fEmptyString);
+  }
+  
+--- 62,70 ----
+      }
+      if (fStack == NULL || fData == NULL) {
+          fDeferredStatus = U_MEMORY_ALLOCATION_ERROR;
++     } else {
++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
+      }
+      reset(*RegexStaticSets::gStaticSets->fEmptyString);
+  }
+  
+***************
+*** 78,83 ****
+--- 88,95 ----
+      }
+      if (fStack == NULL || fData == NULL) {
+          status = U_MEMORY_ALLOCATION_ERROR;
++     } else {
++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
+      }
+      reset(input);
+  }
+***************
+*** 102,107 ****
+--- 114,121 ----
+      }
+      if (fStack == NULL || fData == NULL) {
+          status = U_MEMORY_ALLOCATION_ERROR;
++     } else {
++         fStack->setMaxCapacity(BACKTRACK_STACK_CAPACITY);
+      }
+      reset(*RegexStaticSets::gStaticSets->fEmptyString);
+  }
+***************
+*** 1015,1020 ****
+--- 1029,1042 ----
+  inline REStackFrame *RegexMatcher::StateSave(REStackFrame *fp, int32_t savePatIdx, int32_t frameSize, UErrorCode &status) {
+      // push storage for a new frame. 
+      int32_t *newFP = fStack->reserveBlock(frameSize, status);
++     if (newFP == NULL) {
++         // Heap allocation error on attempted stack expansion.
++         // We need to return a writable stack frame, so just return the
++         //    previous frame.  The match operation will stop quickly
++         //    becuase of the error status, after which the frame will never
++         //    be looked at again.
++         return fp;
++     }
+      fp = (REStackFrame *)(newFP - frameSize);  // in case of realloc of stack.
+      
+      // New stack frame = copy of old top frame.
+***************
+*** 1030,1037 ****
+      fp->fPatIdx = savePatIdx;
+      return (REStackFrame *)newFP;
+  }
+!     
+!             
+  //--------------------------------------------------------------------------------
+  //
+  //   MatchAt      This is the actual matching engine.
+--- 1052,1059 ----
+      fp->fPatIdx = savePatIdx;
+      return (REStackFrame *)newFP;
+  }
+! 
+! 
+  //--------------------------------------------------------------------------------
+  //
+  //   MatchAt      This is the actual matching engine.
+***************
+*** 2262,2267 ****
+--- 2284,2290 ----
+          }
+  
+          if (U_FAILURE(status)) {
++             isMatch = FALSE;
+              break;
+          }
+      }
+*** misc/icu/source/i18n/windtfmt.cpp	Tue Aug 15 08:48:02 2006
+--- misc/build/icu/source/i18n/windtfmt.cpp	Mon Jan 28 21:31:51 2008
+***************
+*** 232,249 ****
       UChar stackBuffer[STACK_BUFFER_SIZE];
       UChar *buffer = stackBuffer;
   
-!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
+!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, buffer, STACK_BUFFER_SIZE);
   
       if (result == 0) {
           if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
-***************
-*** 239,249 ****
               int newLength = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, NULL, 0);
   
               buffer = NEW_ARRAY(UChar, newLength);
@@ -380,7 +721,14 @@
   
       if (buffer != stackBuffer) {
           DELETE_ARRAY(buffer);
---- 239,249 ----
+--- 232,249 ----
+      UChar stackBuffer[STACK_BUFFER_SIZE];
+      UChar *buffer = stackBuffer;
+  
+!     result = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
+  
+      if (result == 0) {
+          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
               int newLength = GetDateFormatW(fLCID, dfFlags[fDateStyle - kDateOffset], st, NULL, NULL, 0);
   
               buffer = NEW_ARRAY(UChar, newLength);
@@ -393,7 +741,7 @@
       if (buffer != stackBuffer) {
           DELETE_ARRAY(buffer);
 ***************
-*** 258,264 ****
+*** 258,275 ****
       UChar stackBuffer[STACK_BUFFER_SIZE];
       UChar *buffer = stackBuffer;
   
@@ -401,16 +749,6 @@
   
       if (result == 0) {
           if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
---- 258,264 ----
-      UChar stackBuffer[STACK_BUFFER_SIZE];
-      UChar *buffer = stackBuffer;
-  
-!     result = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
-  
-      if (result == 0) {
-          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
-***************
-*** 265,275 ****
               int newLength = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, NULL, 0);
   
               buffer = NEW_ARRAY(UChar, newLength);
@@ -422,7 +760,14 @@
   
       if (buffer != stackBuffer) {
           DELETE_ARRAY(buffer);
---- 265,275 ----
+--- 258,275 ----
+      UChar stackBuffer[STACK_BUFFER_SIZE];
+      UChar *buffer = stackBuffer;
+  
+!     result = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, reinterpret_cast<LPWSTR>(buffer), STACK_BUFFER_SIZE);
+  
+      if (result == 0) {
+          if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
               int newLength = GetTimeFormatW(fLCID, tfFlags[fTimeStyle], st, NULL, NULL, 0);
   
               buffer = NEW_ARRAY(UChar, newLength);
@@ -435,7 +780,7 @@
       if (buffer != stackBuffer) {
           DELETE_ARRAY(buffer);
 *** misc/icu/source/i18n/winnmfmt.cpp	Thu Aug 17 07:21:06 2006
---- misc/build/icu/source/i18n/winnmfmt.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/i18n/winnmfmt.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 86,95 ****
       GetLocaleInfoA(lcid, LOCALE_SGROUPING, buf, 10);
@@ -573,7 +918,7 @@
       if (buffer != stackBuffer) {
           DELETE_ARRAY(buffer);
 *** misc/icu/source/layout/CoverageTables.cpp	Sat May  8 01:28:42 2004
---- misc/build/icu/source/layout/CoverageTables.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/CoverageTables.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 44,49 ****
 --- 44,53 ----
@@ -588,7 +933,7 @@
       le_uint16 probe = power;
       le_uint16 index = 0;
 *** misc/icu/source/layout/DeviceTables.cpp	Fri Jan 14 18:25:12 2005
---- misc/build/icu/source/layout/DeviceTables.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/DeviceTables.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 22,28 ****
       le_uint16 format = SWAPW(deltaFormat) - 1;
@@ -608,7 +953,7 @@
           le_uint16 bits = fieldBits[format];
           le_uint16 count = 16 / bits;
 *** misc/icu/source/layout/GXLayoutEngine.cpp	Fri Sep  2 20:22:10 2005
---- misc/build/icu/source/layout/GXLayoutEngine.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/GXLayoutEngine.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 39,45 ****
           return 0;
@@ -627,7 +972,7 @@
       if (LE_FAILURE(success)) {
           return 0;
 *** misc/icu/source/layout/IndicClassTables.cpp	Wed Aug 23 02:12:40 2006
---- misc/build/icu/source/layout/IndicClassTables.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/IndicClassTables.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 94,100 ****
       _dr, _db, _db, _db, _db, _xx, _xx, _l1, _dl, _xx, _xx, _s1, _s2, _vr, _xx, _xx, // 09C0 - 09CF
@@ -646,14 +991,14 @@
   
   static const IndicClassTable::CharClass punjCharClasses[] =
 ***************
-*** 120,127 ****
---- 120,140 ----
+*** 120,125 ****
+--- 120,138 ----
       _iv, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx, _xx  // 0AE0 - 0AEF
   };
   
 + #if 1
-  static const IndicClassTable::CharClass oryaCharClasses[] =
-  {
++ static const IndicClassTable::CharClass oryaCharClasses[] =
++ {
 +     _xx, _ma, _mp, _mp, _xx, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _xx, _xx, _iv, /* 0B00 - 0B0F */
 +     _iv, _xx, _xx, _iv, _iv, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _ct, _bb, /* 0B10 - 0B1F */
 +     _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _bb, _xx, _bb, _bb, _bb, _bb, _bb, _pb, /* 0B20 - 0B2F */
@@ -664,11 +1009,9 @@
 +     _xx, _bb                                                                        /* 0B70 - 0B71 */
 + };
 + #else
-+ static const IndicClassTable::CharClass oryaCharClasses[] =
-+ {
+  static const IndicClassTable::CharClass oryaCharClasses[] =
+  {
       _xx, _ma, _mp, _mp, _xx, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _iv, _xx, _xx, _iv, // 0B00 - 0B0F
-      _iv, _xx, _xx, _iv, _iv, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, _ct, // 0B10 - 0B1F
-      _ct, _ct, _ct, _ct, _bb, _ct, _ct, _ct, _bb, _xx, _ct, _ct, _bb, _bb, _bb, _pb, // 0B20 - 0B2F
 ***************
 *** 131,136 ****
 --- 144,150 ----
@@ -763,7 +1106,7 @@
   //
   // IndicClassTable addresses
 *** misc/icu/source/layout/IndicReordering.cpp	Tue Apr 25 21:08:12 2006
---- misc/build/icu/source/layout/IndicReordering.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/IndicReordering.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 50,55 ****
 --- 50,63 ----
@@ -868,7 +1211,7 @@
                   output.writeMbelow();
                   output.writeSMbelow(); // FIXME: there are no SMs in these scripts...
 *** misc/icu/source/layout/LESwaps.h	Thu Jun 23 00:39:36 2005
---- misc/build/icu/source/layout/LESwaps.h	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/LESwaps.h	Mon Jan 28 21:31:51 2008
 ***************
 *** 2,7 ****
 --- 2,8 ----
@@ -944,7 +1287,7 @@
    * This class is used to access data which stored in big endian order
    * regardless of the conventions of the platform. It has been designed
 *** misc/icu/source/layout/MPreFixups.cpp	Sat May  8 01:28:44 2004
---- misc/build/icu/source/layout/MPreFixups.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/MPreFixups.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 40,45 ****
 --- 40,51 ----
@@ -961,7 +1304,7 @@
   {
       for (le_int32 fixup = 0; fixup < fFixupCount; fixup += 1) {
 *** misc/icu/source/layout/MPreFixups.h	Mon Apr 12 20:51:32 2004
---- misc/build/icu/source/layout/MPreFixups.h	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/layout/MPreFixups.h	Mon Jan 28 21:31:51 2008
 ***************
 *** 31,36 ****
 --- 31,38 ----
@@ -974,10 +1317,10 @@
       FixupData *fFixupData;
       le_int32   fFixupCount;
 *** misc/icu/source/stubdata/Makefile.in	Fri Dec  2 11:21:34 2005
---- misc/build/icu/source/stubdata/Makefile.in	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/stubdata/Makefile.in	Mon Jan 28 21:31:51 2008
 ***************
-*** 25,31 ****
---- 25,37 ----
+*** 25,30 ****
+--- 25,36 ----
   ## Target information
   
   TARGET_STUBNAME=$(DATA_STUBNAME)
@@ -985,14 +1328,13 @@
 + FINAL_SO_TARGET=$(STUBDATA_LIBDIR)$(LIBICU)$(TARGET_STUBNAME)$(ICULIBSUFFIX)$(SO_TARGET_VERSION_MAJOR)$(STUB_SUFFIX).$(SO)
 + %$(STUB_SUFFIX).$(SO): %$(SO_TARGET_VERSION_MAJOR)$(STUB_SUFFIX).$(SO)
 + 	$(RM) $@ && ln $< $@
-  
-+ endif
 + 
++ endif
+  
   ifneq ($(ENABLE_STATIC),)
   TARGET = $(STUBDATA_LIBDIR)$(LIBSICU)$(TARGET_STUBNAME)$(ICULIBSUFFIX).$(A)
-  endif
 *** misc/icu/source/test/intltest/loctest.cpp	Thu Jul  6 03:50:04 2006
---- misc/build/icu/source/test/intltest/loctest.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/test/intltest/loctest.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 4,9 ****
 --- 4,10 ----
@@ -1003,8 +1345,116 @@
   #include "loctest.h"
   #include "unicode/decimfmt.h"
   #include "unicode/ucurr.h"
+*** misc/icu/source/test/intltest/regextst.cpp	Tue Jul  5 20:39:00 2005
+--- misc/build/icu/source/test/intltest/regextst.cpp	Mon Jan 28 23:18:47 2008
+***************
+*** 1,6 ****
+  /********************************************************************
+   * COPYRIGHT:
+!  * Copyright (c) 2002-2005, International Business Machines Corporation and
+   * others. All Rights Reserved.
+   ********************************************************************/
+  
+--- 1,6 ----
+  /********************************************************************
+   * COPYRIGHT:
+!  * Copyright (c) 2002-2008, International Business Machines Corporation and
+   * others. All Rights Reserved.
+   ********************************************************************/
+  
+***************
+*** 66,71 ****
+--- 66,75 ----
+          case 6: name = "PerlTests";
+              if (exec) PerlTests();
+              break;
++         case 7: name = "Bug 6149";
++             if (exec) Bug6149();
++             break;
++             
+  
+  
+          default: name = "";
+***************
+*** 1639,1644 ****
+--- 1643,1661 ----
+  
+  }
+  
++     
++     // Invalid Back Reference \0
++     //    For ICU 3.8 and earlier
++     //    For ICU versions newer than 3.8, \0 introduces an octal escape.
++     //
++ #ifndef _MSC_VER
++ // erAck: 2008-01-28T23:16+0100 MSVC doesn't digest the escaped backslash and
++ // mumbles something about  
++ // error C2501: 'regex_err' : missing storage-class or type specifiers
++ // error C2078: too many initializers
++ // We're not interested in fixing that deficiency just for a testcase.
++     REGEX_ERR("(ab)\\0", 1, 6, U_REGEX_INVALID_BACK_REF);
++ #endif
+  
+  //-------------------------------------------------------------------------------
+  //
+***************
+*** 2119,2124 ****
+--- 2136,2161 ----
+  }
+  
+  
++ //--------------------------------------------------------------
++ //
++ //  Bug6149   Verify limits to heap expansion for backtrack stack.
++ //             Use this pattern,
++ //                 "(a?){1,}"
++ //             The zero-length match will repeat forever.
++ //                (That this goes into a loop is another bug)
++ //
++ //---------------------------------------------------------------
++ void RegexTest::Bug6149() {
++     UnicodeString pattern("(a?){1,}");
++     UnicodeString s("xyz");
++     uint32_t flags = 0;
++     UErrorCode status = U_ZERO_ERROR;
++     
++     RegexMatcher  matcher(pattern, s, flags, status);
++     UBool result = false;
++     REGEX_ASSERT_FAIL(result=matcher.matches(status), U_BUFFER_OVERFLOW_ERROR);
++     REGEX_ASSERT(result == FALSE);
++  }
+  
+  #endif  /* !UCONFIG_NO_REGULAR_EXPRESSIONS  */
+  
+*** misc/icu/source/test/intltest/regextst.h	Wed Dec  3 07:58:28 2003
+--- misc/build/icu/source/test/intltest/regextst.h	Mon Jan 28 21:31:51 2008
+***************
+*** 1,6 ****
+  /********************************************************************
+   * COPYRIGHT: 
+!  * Copyright (c) 2002-2003, International Business Machines Corporation and
+   * others. All Rights Reserved.
+   ********************************************************************/
+  
+--- 1,6 ----
+  /********************************************************************
+   * COPYRIGHT: 
+!  * Copyright (c) 2002-2008, International Business Machines Corporation and
+   * others. All Rights Reserved.
+   ********************************************************************/
+  
+***************
+*** 30,35 ****
+--- 30,36 ----
+      virtual void Extended();
+      virtual void Errors();
+      virtual void PerlTests();
++     virtual void Bug6149();
+  
+      // The following functions are internal to the regexp tests.
+      virtual UBool doRegexLMTest(const char *pat, const char *text, UBool looking, UBool match, int line);
 *** misc/icu/source/test/intltest/tsputil.cpp	Wed Jul 19 00:18:10 2006
---- misc/build/icu/source/test/intltest/tsputil.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/test/intltest/tsputil.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 4,9 ****
 --- 4,10 ----
@@ -1016,7 +1466,7 @@
   
   #include <float.h> // DBL_MAX, DBL_MIN
 *** misc/icu/source/test/intltest/uobjtest.cpp	Thu Mar 23 01:54:12 2006
---- misc/build/icu/source/test/intltest/uobjtest.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/test/intltest/uobjtest.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 4,9 ****
 --- 4,10 ----
@@ -1028,7 +1478,7 @@
   #include "cmemory.h" // UAlignedMemory
   #include <string.h>
 *** misc/icu/source/test/intltest/ustrtest.cpp	Tue Dec 28 22:13:54 2004
---- misc/build/icu/source/test/intltest/ustrtest.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/test/intltest/ustrtest.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 4,9 ****
 --- 4,10 ----
@@ -1040,7 +1490,7 @@
   #include "unicode/unistr.h"
   #include "unicode/uchar.h"
 *** misc/icu/source/tools/icupkg/icupkg.cpp	Fri Jul 21 23:17:52 2006
---- misc/build/icu/source/tools/icupkg/icupkg.cpp	Tue Sep 18 19:30:31 2007
+--- misc/build/icu/source/tools/icupkg/icupkg.cpp	Mon Jan 28 21:31:51 2008
 ***************
 *** 332,337 ****
 --- 332,341 ----
@@ -1054,3 +1504,63 @@
   extern int
   main(int argc, char *argv[]) {
       const char *pname, *sourcePath, *destPath, *inFilename, *outFilename, *outComment;
+*** misc/icu/source/tools/pkgdata/make.c	Wed Mar 22 09:14:10 2006
+--- misc/build/icu/source/tools/pkgdata/make.c	Tue Nov 13 13:03:52 2007
+***************
+*** 172,178 ****
+--- 172,180 ----
+                      "MODE=%s\n"
+                      "MAKEFILE=%s\n"
+                      "ENTRYPOINT=%s\n"
++ #ifndef __MINGW32__
+                      "include %s\n"
++ #endif
+                      "\n\n\n",
+                      o->shortName,
+                      o->libName,
+***************
+*** 182,189 ****
+--- 184,195 ----
+                      o->srcDir,
+                      o->mode,
+                      o->makeFile,
++ #ifdef __MINGW32__
++                     o->entryName);
++ #else
+                      o->entryName,
+                      o->options);
++ #endif
+      T_FileStream_writeLine(f, linebuf);
+      
+      /* TEMP_PATH  and TARG_PATH will be empty if the respective dir is . */
+***************
+*** 233,238 ****
+--- 239,252 ----
+  
+      pkg_writeCharListWrap(f, o->filePaths, " ", " \\\n",0);
+  
++ #ifdef __MINGW32__
++     sprintf(linebuf, "\n"
++                     "include %s\n"
++                     "\n\n\n",
++                     o->options);
++     T_FileStream_writeLine(f, linebuf);
++ #endif
++     
+      T_FileStream_writeLine(f, "\n\n\n");
+  
+  }
+***************
+*** 396,402 ****
+--- 410,420 ----
+      T_FileStream_writeLine(f, "BASE_OBJECTS=$(NAME)_dat.o\n");
+      T_FileStream_writeLine(f, "\n");
+      T_FileStream_writeLine(f, "$(TEMP_DIR)/$(NAME).dat: $(CMNLIST) $(DATAFILEPATHS)\n");
++ #ifdef __MINGW32__
++     T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCMN) -c -e $(ENTRYPOINT) -n $(NAME) -s $(SRCDIRW) -t dat -d $(TEMP_DIR) 0 $(CMNLIST)\n");
++ #else
+      T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCMN) -c -e $(ENTRYPOINT) -n $(NAME) -s $(SRCDIR) -t dat -d $(TEMP_DIR) 0 $(CMNLIST)\n");
++ #endif
+      T_FileStream_writeLine(f, "\n");
+      T_FileStream_writeLine(f, "$(TEMP_DIR)/$(NAME)_dat.o : $(TEMP_DIR)/$(NAME).dat\n");
+      T_FileStream_writeLine(f, "\t$(INVOKE) $(GENCCODE) $(GENCCODE_ASSEMBLY) -n $(NAME) -e $(ENTRYPOINT) -d $(TEMP_DIR) $<\n");