Fix buffer overflow in _canonicalize.

patches/canonicalize.patch

Index: patches/canonicalize.patch
===================================================================
--- patches/canonicalize.patch	(revision 0)
+++ patches/canonicalize.patch	(revision 0)
@@ -0,0 +1,22 @@
+Index: source/common/uloc.c
+===================================================================
+--- source/common/uloc.c	(revision 113138)
++++ source/common/uloc.c	(working copy)
+@@ -1797,7 +1797,7 @@
+                 int32_t variantLen = _deleteVariant(variant, uprv_min(variantSize, (nameCapacity-len)), variantToCompare, n);
+                 len -= variantLen;
+                 if (variantLen > 0) {
+-                    if (name[len-1] == '_') { /* delete trailing '_' */
++                    if (len > 0 && name[len-1] == '_') { /* delete trailing '_' */
+                         --len;
+                     }
+                     addKeyword = VARIANT_MAP[j].keyword;
+@@ -1805,7 +1805,7 @@
+                     break;
+                 }
+             }
+-            if (name[len-1] == '_') { /* delete trailing '_' */
++            if (len > 0 && len <= nameCapacity && name[len-1] == '_') { /* delete trailing '_' */
+                 --len;
+             }
+         }