Blob Blame Raw
diff -ru icu.orig/source/common/unistr.cpp icu/source/common/unistr.cpp
--- icu.orig/source/common/unistr.cpp	2019-04-12 00:11:18.000000000 +0200
+++ icu/source/common/unistr.cpp	2020-03-04 18:34:07.225801866 +0100
@@ -1340,7 +1340,10 @@
     if(srcLength == 0) {
       return *this;
     }
-    newLength = oldLength + srcLength;
+    if (uprv_add32_overflow(oldLength, srcLength, &newLength)) {
+      setToBogus();
+      return *this;
+    }
     if(newLength <= getCapacity() && isBufferWritable()) {
       UChar *oldArray = getArrayStart();
       // Do not copy characters when