Blob Blame History Raw
Index: icu/source/i18n/regexcmp.cpp
===================================================================
--- icu/source/i18n/regexcmp.cpp	(revision 36723)
+++ icu/source/i18n/regexcmp.cpp	(revision 36724)
@@ -2136,4 +2136,8 @@
             int32_t minML    = minMatchLength(fMatchOpenParen, patEnd);
             int32_t maxML    = maxMatchLength(fMatchOpenParen, patEnd);
+            if (URX_TYPE(maxML) != 0) {
+                error(U_REGEX_LOOK_BEHIND_LIMIT);
+                break;
+            }
             if (maxML == INT32_MAX) {
                 error(U_REGEX_LOOK_BEHIND_LIMIT);
@@ -2169,4 +2173,8 @@
             int32_t minML    = minMatchLength(fMatchOpenParen, patEnd);
             int32_t maxML    = maxMatchLength(fMatchOpenParen, patEnd);
+            if (URX_TYPE(maxML) != 0) {
+                error(U_REGEX_LOOK_BEHIND_LIMIT);
+                break;
+            }
             if (maxML == INT32_MAX) {
                 error(U_REGEX_LOOK_BEHIND_LIMIT);
Index: icu/source/test/testdata/regextst.txt
===================================================================
--- icu/source/test/testdata/regextst.txt	(revision 36723)
+++ icu/source/test/testdata/regextst.txt	(revision 36724)
@@ -1201,4 +1201,12 @@
 "A|B|\U00012345"                "hello <0>\U00012345</0>"
 "A|B|\U00010000"                "hello \ud800"
+
+# Bug 11370
+#   Max match length computation of look-behind expression gives result that is too big to fit in the
+#   in the 24 bit operand portion of the compiled code. Expressions should fail to compile
+#   (Look-behind match length must be bounded. This case is treated as unbounded, an error.)
+
+"(?<!(0123456789a){10000000})x"         E  "no match"
+"(?<!\\ubeaf(\\ubeaf{11000}){11000})"   E  "no match"
 
 #  Random debugging, Temporary