mirror fixes for fdo#78906 and deb#766788 into icu

(cherry picked from commit a66451887425ddd9387e2b25d5125916f4a35f83)
(cherry picked from commit bff0fe902686d8c126a73e1d2c914f5d65c6ffaf)

Conflicts:
	external/icu/UnpackedTarball_icu.mk

Change-Id: I9325bb28eb267b023f628e24fea216ad580759e9
Reviewed-on: https://gerrit.libreoffice.org/13222
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Reviewed-by: Eike Rathke <erack@redhat.com>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

3 files changed, 128 insertions, 0 deletions

diff --git a/external/icu/UnpackedTarball_icu.mk b/external/icu/UnpackedTarball_icu.mk
index f8b5dd8a094f..aefc159b9fa9 100644
--- a/external/icu/UnpackedTarball_icu.mk
+++ b/external/icu/UnpackedTarball_icu.mk
@@ -23,6 +23,8 @@ $(eval $(call gb_UnpackedTarball_add_patches,icu,\
 	external/icu/icu4c-$(if $(filter ANDROID,$(OS)),android,rpath).patch \
 	external/icu/icu4c-icu11054.patch.1 \
 	external/icu/icu4c-icu11100.patch.1 \
+	external/icu/icu4c-icu11131.patch.1 \
+	external/icu/icu4c-scriptrun.patch \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/icu/icu4c-icu11131.patch.1 b/external/icu/icu4c-icu11131.patch.1
new file mode 100644
index 000000000000..e9978aba7a8e
--- /dev/null
+++ b/external/icu/icu4c-icu11131.patch.1
@@ -0,0 +1,68 @@
+--- icu/source/i18n/smpdtfmt.cpp.orig	2014-08-27 10:29:29.849821672 +0530
++++ icu/source/i18n/smpdtfmt.cpp	2014-08-27 10:29:49.323821401 +0530
+@@ -1082,6 +1082,7 @@
+             }
+         } else {
+             status = U_MEMORY_ALLOCATION_ERROR;
++            return;
+         }
+     }
+     umtx_unlock(&LOCK);
+--- icu/source/common/usprep.cpp.orig	2014-08-27 10:38:24.360821077 +0530
++++ icu/source/common/usprep.cpp	2014-08-27 10:38:38.696821312 +0530
+@@ -796,16 +796,23 @@ usprep_prepare(   const UStringPrepProfi
+     }
+ 
+ CLEANUP:
+-    if(b1!=b1Stack){
+-        uprv_free(b1);
+-        b1=NULL;
+-    }
+-
+-    if(b2!=b1Stack && b2!=b2Stack && b2!=b1 /* b1 should not be freed twice */){
+-        uprv_free(b2);
+-        b2=NULL;
+-    }
+-    return u_terminateUChars(dest, destCapacity, b2Len, status);
++    	if(b2==b1 && b1!=b1Stack){
++		uprv_free(b1);
++		b1=NULL;
++		b2=NULL;
++	}
++	else
++	{
++    		if(b1!=b1Stack){
++        		uprv_free(b1);
++        		b1=NULL;
++    		}
++		if(b2!=b1Stack && b2!=b2Stack && b2!=b1 /* b1 should not be freed twice */){
++        		uprv_free(b2);
++        		b2=NULL;
++		}
++	}
++    	return u_terminateUChars(dest, destCapacity, b2Len, status);
+ }
+
+
+--- icu/source/common/ubidi.c.orig	2014-08-29 14:32:24.007259924 +0100
++++ icu/source/common/ubidi.c	2014-08-29 14:33:21.555833532 +0100
+@@ -2521,11 +2521,18 @@
+     pBiDi->trailingWSStart=saveTrailingWSStart;
+     /* free memory for mapping table and visual text */
+     uprv_free(runsOnlyMemory);
++    runsOnlyMemory=NULL;
+     if(pBiDi->runCount>1) {
+         pBiDi->direction=UBIDI_MIXED;
+     }
+   cleanup3:
+-    pBiDi->reorderingMode=UBIDI_REORDER_RUNS_ONLY;
++    if(runsOnlyMemory != NULL)
++    {
++	pBiDi->reorderingMode=UBIDI_REORDER_RUNS_ONLY;
++	uprv_free(runsOnlyMemory);
++    }
++    else
++	pBiDi->reorderingMode=UBIDI_REORDER_RUNS_ONLY;
+ }
+ 
+ /* ubidi_setPara ------------------------------------------------------------ */
diff --git a/external/icu/icu4c-scriptrun.patch b/external/icu/icu4c-scriptrun.patch
new file mode 100644
index 000000000000..e307811acaad
--- /dev/null
+++ b/external/icu/icu4c-scriptrun.patch
@@ -0,0 +1,58 @@
+--- misc/icu/source/extra/scrptrun/scrptrun.cpp
++++ misc/build/icu/source/extra/scrptrun/scrptrun.cpp
+@@ -150,7 +150,11 @@
+         // characters above it on the stack will be poped.
+         if (pairIndex >= 0) {
+             if ((pairIndex & 1) == 0) {
+-                parenStack[++parenSP].pairIndex = pairIndex;
++                ++parenSP;
++                int32_t nVecSize = parenStack.size();
++                if (parenSP == nVecSize)
++                    parenStack.resize(nVecSize + 128);
++                parenStack[parenSP].pairIndex = pairIndex;
+                 parenStack[parenSP].scriptCode  = scriptCode;
+             } else if (parenSP >= 0) {
+                 int32_t pi = pairIndex & ~1;
+@@ -184,7 +188,14 @@
+             // pop it from the stack
+             if (pairIndex >= 0 && (pairIndex & 1) != 0 && parenSP >= 0) {
+                 parenSP -= 1;
+-                startSP -= 1;
++                /* decrement startSP only if it is >= 0,
++                   decrementing it unnecessarily will lead to memory corruption
++                   while processing the above while block.
++                   e.g. startSP = -4 , parenSP = -1
++                */
++                if (startSP >= 0) {
++                    startSP -= 1;
++                }
+             }
+         } else {
+             // if the run broke on a surrogate pair,
+--- misc/icu/source/extra/scrptrun/scrptrun.h
++++ misc/build/icu/source/extra/scrptrun/scrptrun.h
+@@ -17,6 +17,7 @@
+ #include "unicode/utypes.h"
+ #include "unicode/uobject.h"
+ #include "unicode/uscript.h"
++#include <vector>
+ 
+ struct ScriptRecord
+ {
+@@ -79,7 +80,7 @@
+     int32_t scriptEnd;
+     UScriptCode scriptCode;
+ 
+-    ParenStackEntry parenStack[128];
++    std::vector<ParenStackEntry> parenStack;
+     int32_t parenSP;
+ 
+     static int8_t highBit(int32_t value);
+@@ -133,6 +134,7 @@
+     scriptEnd   = charStart;
+     scriptCode  = USCRIPT_INVALID_CODE;
+     parenSP     = -1;
++    parenStack.resize(128);
+ }
+ 
+ inline void ScriptRun::reset(int32_t start, int32_t length)