Apply a security patch for ICU regex. (http://bugs.icu-project.org/trac/ticke...

third_party/icu38/source/i18n/regexcmp.cpp

 
 //
 //  file:  regexcmp.cpp
 //
-//  Copyright (C) 2002-2007 International Business Machines Corporation and others.
+//  Copyright (C) 2002-2008 International Business Machines Corporation and others.
 //  All Rights Reserved.
 //
 //  This file contains the ICU regular expression compiler, which is responsible
 //  for processing a regular expression pattern into the compiled form that
 //  is used by the match finding engine.
 //
 
 #include "unicode/utypes.h"
 
 #if !UCONFIG_NO_REGULAR_EXPRESSIONS
@@ skipping 1163 matching lines @@
                     break;
                 }
                 nextCharLL();
             }
 
             // Scan of the back reference in the source regexp is complete.  Now generate
             //  the compiled code for it. 
             // Because capture groups can be forward-referenced by back-references,
             //  we fill the operand with the capture group number.  At the end
             //  of compilation, it will be changed to the variable's location.
-            U_ASSERT(groupNum > 0);
-            int32_t  op;
-            if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
-                op = URX_BUILD(URX_BACKREF_I, groupNum);
+            if (groupNum < 1) { 
+                error(U_REGEX_INVALID_BACK_REF);
             } else {
-                op = URX_BUILD(URX_BACKREF, groupNum);
+                int32_t  op;
+                if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
+                    op = URX_BUILD(URX_BACKREF_I, groupNum);
+                } else {
+                    op = URX_BUILD(URX_BACKREF, groupNum);
+                }
+                fRXPat->fCompiledPat->addElement(op, *fStatus);
             }
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
         }
         break;
 
 
     case doPossessivePlus:
         // Possessive ++ quantifier.
         // Compiles to
         //       1.   STO_SP
         //       2.      body of stuff being iterated over
         //       3.   STATE_SAVE 5
@@ skipping 2313 matching lines @@
         uset =  NULL;
     }
 
     nextChar(fC);      // Continue overall regex pattern processing with char after the '}'
     return uset;
 }
 
 U_NAMESPACE_END
 #endif  // !UCONFIG_NO_REGULAR_EXPRESSIONS