From 864f405e048a96ed563e631f8664d373e5cff457 Mon Sep 17 00:00:00 2001
From: Felix Zhang <fezhang@suse.com>
Date: Thu, 26 Mar 2015 16:55:25 +0800
Subject: [PATCH] bsc917129: CVE-2014-9654

backported from http://bugs.icu-project.org/trac/changeset/36801
---
 source/common/unicode/utypes.h    |   1 +
 source/common/utypes.c            |   3 +-
 source/i18n/regexcmp.cpp          | 724 ++++++++++++++++++--------------------
 source/i18n/regexcmp.h            |  12 +
 source/i18n/regeximp.h            |   1 -
 source/test/intltest/regextst.cpp |  46 +++
 source/test/intltest/regextst.h   |   1 +
 7 files changed, 403 insertions(+), 385 deletions(-)

diff --git a/source/common/unicode/utypes.h b/source/common/unicode/utypes.h
index 12977ed..f97e4f6 100644
--- a/source/common/unicode/utypes.h
+++ b/source/common/unicode/utypes.h
@@ -732,6 +732,7 @@ typedef enum UErrorCode {
     U_REGEX_STACK_OVERFLOW,               /**< Regular expression backtrack stack overflow.       */
     U_REGEX_TIME_OUT,                     /**< Maximum allowed match time exceeded                */
     U_REGEX_STOPPED_BY_CALLER,            /**< Matching operation aborted by user callback fn.    */
+    U_REGEX_PATTERN_TOO_BIG,              /**< Pattern exceeds limits on size or complexity.   @draft ICU 55   */
     U_REGEX_ERROR_LIMIT,                  /**< This must always be the last value to indicate the limit for regexp errors */
 
     /*
diff --git a/source/common/utypes.c b/source/common/utypes.c
index 0e24e6a..7cac13d 100644
--- a/source/common/utypes.c
+++ b/source/common/utypes.c
@@ -159,7 +159,8 @@ _uRegexErrorName[U_REGEX_ERROR_LIMIT - U_REGEX_ERROR_START] = {
     "U_REGEX_INVALID_RANGE",
     "U_REGEX_STACK_OVERFLOW",
     "U_REGEX_TIME_OUT",
-    "U_REGEX_STOPPED_BY_CALLER"
+    "U_REGEX_STOPPED_BY_CALLER",
+    "U_REGEX_PATTERN_TOO_BIG"
 };
 
 static const char * const
diff --git a/source/i18n/regexcmp.cpp b/source/i18n/regexcmp.cpp
index dd4370c..369e196 100644
--- a/source/i18n/regexcmp.cpp
+++ b/source/i18n/regexcmp.cpp
@@ -264,7 +264,7 @@ void    RegexCompile::compile(
                 break;
             }
             where = fRXPat->fGroupMap->elementAti(where-1);
-            op    = URX_BUILD(opType, where);
+            op    = buildOp(opType, where);
             fRXPat->fCompiledPat->setElementAt(op, loc);
         }
     }
@@ -352,9 +352,9 @@ UBool RegexCompile::doParseActions(int32_t action)
         //                    the start of an ( grouping.
         //4   NOP             Resreved, will be replaced by a save if there are
         //                    OR | operators at the top level
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_STATE_SAVE, 2), *fStatus);
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_JMP,  3), *fStatus);
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_FAIL, 0), *fStatus);
+        appendOp(URX_STATE_SAVE, 2);
+        appendOp(URX_JMP,  3);
+        appendOp(URX_FAIL, 0);
 
         // Standard open nonCapture paren action emits the two NOPs and
         //   sets up the paren stack frame.
@@ -377,7 +377,7 @@ UBool RegexCompile::doParseActions(int32_t action)
         }
 
         // add the END operation to the compiled pattern.
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_END, 0), *fStatus);
+        appendOp(URX_END, 0);
 
         // Terminate the pattern compilation state machine.
         returnVal = FALSE;
@@ -396,14 +396,13 @@ UBool RegexCompile::doParseActions(int32_t action)
             int32_t savePosition = fParenStack.popi();
             int32_t op = fRXPat->fCompiledPat->elementAti(savePosition);
             U_ASSERT(URX_TYPE(op) == URX_NOP);  // original contents of reserved location
-            op = URX_BUILD(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+1);
+            op = buildOp(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+1);
             fRXPat->fCompiledPat->setElementAt(op, savePosition);
 
             // Append an JMP operation into the compiled pattern.  The operand for
             //  the JMP will eventually be the location following the ')' for the
             //  group.  This will be patched in later, when the ')' is encountered.
-            op = URX_BUILD(URX_JMP, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_JMP, 0);
 
             // Push the position of the newly added JMP op onto the parentheses stack.
             // This registers if for fixup when this block's close paren is encountered.
@@ -412,7 +411,7 @@ UBool RegexCompile::doParseActions(int32_t action)
             // Append a NOP to the compiled pattern.  This is the slot reserved
             //   for a SAVE in the event that there is yet another '|' following
             //   this one.
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
+            appendOp(URX_NOP, 0);
             fParenStack.push(fRXPat->fCompiledPat->size()-1, *fStatus);
         }
         break;
@@ -437,12 +436,10 @@ UBool RegexCompile::doParseActions(int32_t action)
         //      encountered.  This will be promoted to a completed capture when (and if) the corresponding
         //      END_CAPure is encountered.
         {
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
-            int32_t  varsLoc    = fRXPat->fFrameSize;    // Reserve three slots in match stack frame.
-            fRXPat->fFrameSize += 3;
-            int32_t  cop        = URX_BUILD(URX_START_CAPTURE, varsLoc);
-            fRXPat->fCompiledPat->addElement(cop, *fStatus);
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
+            appendOp(URX_NOP, 0);
+            int32_t  varsLoc = allocateStackData(3);    // Reserve three slots in match stack frame.
+            appendOp(URX_START_CAPTURE, varsLoc);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the two NOPs.  Depending on what follows in the pattern, the
@@ -466,8 +463,8 @@ UBool RegexCompile::doParseActions(int32_t action)
         //      - NOP, which may later be replaced by a save-state if there
         //             is an '|' alternation within the parens.
         {
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
+            appendOp(URX_NOP, 0);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the two NOPs.
@@ -488,12 +485,10 @@ UBool RegexCompile::doParseActions(int32_t action)
         //      - NOP, which may later be replaced by a save-state if there
         //             is an '|' alternation within the parens.
         {
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
-            int32_t  varLoc    = fRXPat->fDataSize;    // Reserve a data location for saving the
-            fRXPat->fDataSize += 1;                    //  state stack ptr.
-            int32_t  stoOp     = URX_BUILD(URX_STO_SP, varLoc);
-            fRXPat->fCompiledPat->addElement(stoOp, *fStatus);
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
+            appendOp(URX_NOP, 0);
+            int32_t  varLoc = allocateData(1);    // Reserve a data location for saving the state stack ptr.
+            appendOp(URX_STO_SP, varLoc);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the two NOPs.  Depending on what follows in the pattern, the
@@ -535,26 +530,15 @@ UBool RegexCompile::doParseActions(int32_t action)
         //
         //  Two data slots are reserved, for saving the stack ptr and the input position.
         {
-            int32_t dataLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize += 2;
-            int32_t op = URX_BUILD(URX_LA_START, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-
-            op = URX_BUILD(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+ 2);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-
-            op = URX_BUILD(URX_JMP, fRXPat->fCompiledPat->size()+ 3);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            
-            op = URX_BUILD(URX_LA_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-
-            op = URX_BUILD(URX_BACKTRACK, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            
-            op = URX_BUILD(URX_NOP, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            fixLiterals();
+            int32_t dataLoc = allocateData(2);
+            appendOp(URX_LA_START, dataLoc);
+            appendOp(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+ 2);
+            appendOp(URX_JMP, fRXPat->fCompiledPat->size()+ 3);
+            appendOp(URX_LA_END, dataLoc);
+            appendOp(URX_BACKTRACK, 0);
+            appendOp(URX_NOP, 0);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the NOPs.
@@ -578,16 +562,10 @@ UBool RegexCompile::doParseActions(int32_t action)
         //    7.    END_LA                // Restore match region, in case look-ahead was using
         //                                        an alternate (transparent) region.
         {
-            int32_t dataLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize += 2;
-            int32_t op = URX_BUILD(URX_LA_START, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-
-            op = URX_BUILD(URX_STATE_SAVE, 0);    // dest address will be patched later.
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-
-            op = URX_BUILD(URX_NOP, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            int32_t dataLoc = allocateData(2);
+            appendOp(URX_LA_START, dataLoc);
+            appendOp(URX_STATE_SAVE, 0);    // dest address will be patched later.
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the StateSave and NOP.
@@ -622,23 +600,19 @@ UBool RegexCompile::doParseActions(int32_t action)
             //              3:    Original Input String len.
 
             // Allocate data space
-            int32_t dataLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize += 4;
+            int32_t dataLoc = allocateData(4);
 
             // Emit URX_LB_START
-            int32_t op = URX_BUILD(URX_LB_START, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LB_START, dataLoc);
 
             // Emit URX_LB_CONT
-            op = URX_BUILD(URX_LB_CONT, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            fRXPat->fCompiledPat->addElement(0,  *fStatus);    // MinMatchLength.  To be filled later.
-            fRXPat->fCompiledPat->addElement(0,  *fStatus);    // MaxMatchLength.  To be filled later.
+            appendOp(URX_LB_CONT, dataLoc);
+            appendOp(URX_RESERVED_OP, 0);    // MinMatchLength.  To be filled later.
+            appendOp(URX_RESERVED_OP, 0);    // MaxMatchLength.  To be filled later.
 
-            // Emit the NOP
-            op = URX_BUILD(URX_NOP, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            // Emit the NOPs
+            appendOp(URX_NOP, 0);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the URX_LB_CONT and the NOP.
@@ -675,24 +649,20 @@ UBool RegexCompile::doParseActions(int32_t action)
             //              3:    Original Input String len.
 
             // Allocate data space
-            int32_t dataLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize += 4;
+            int32_t dataLoc = allocateData(4);
 
             // Emit URX_LB_START
-            int32_t op = URX_BUILD(URX_LB_START, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LB_START, dataLoc);
 
             // Emit URX_LBN_CONT
-            op = URX_BUILD(URX_LBN_CONT, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            fRXPat->fCompiledPat->addElement(0,  *fStatus);    // MinMatchLength.  To be filled later.
-            fRXPat->fCompiledPat->addElement(0,  *fStatus);    // MaxMatchLength.  To be filled later.
-            fRXPat->fCompiledPat->addElement(0,  *fStatus);    // Continue Loc.    To be filled later.
+            appendOp(URX_LBN_CONT, dataLoc);
+            appendOp(URX_RESERVED_OP, 0);    // MinMatchLength.  To be filled later.
+            appendOp(URX_RESERVED_OP, 0);    // MaxMatchLength.  To be filled later.
+            appendOp(URX_RESERVED_OP, 0);    // Continue Loc.    To be filled later.
 
-            // Emit the NOP
-            op = URX_BUILD(URX_NOP, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            // Emit the NOPs
+            appendOp(URX_NOP, 0);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the URX_LB_CONT and the NOP.
@@ -762,12 +732,9 @@ UBool RegexCompile::doParseActions(int32_t action)
 
                 if (URX_TYPE(repeatedOp) == URX_SETREF) {
                     // Emit optimized code for [char set]+
-                    int32_t loopOpI = URX_BUILD(URX_LOOP_SR_I, URX_VAL(repeatedOp));
-                    fRXPat->fCompiledPat->addElement(loopOpI, *fStatus);
-                    frameLoc = fRXPat->fFrameSize;
-                    fRXPat->fFrameSize++;
-                    int32_t loopOpC = URX_BUILD(URX_LOOP_C, frameLoc);
-                    fRXPat->fCompiledPat->addElement(loopOpC, *fStatus);
+                    appendOp(URX_LOOP_SR_I, URX_VAL(repeatedOp));
+                    frameLoc = allocateStackData(1);
+                    appendOp(URX_LOOP_C, frameLoc);
                     break;
                 }
 
@@ -775,7 +742,7 @@ UBool RegexCompile::doParseActions(int32_t action)
                     URX_TYPE(repeatedOp) == URX_DOTANY_ALL ||
                     URX_TYPE(repeatedOp) == URX_DOTANY_UNIX) {
                     // Emit Optimized code for .+ operations.
-                    int32_t loopOpI = URX_BUILD(URX_LOOP_DOT_I, 0);
+                    int32_t loopOpI = buildOp(URX_LOOP_DOT_I, 0);
                     if (URX_TYPE(repeatedOp) == URX_DOTANY_ALL) {
                         // URX_LOOP_DOT_I operand is a flag indicating ". matches any" mode.
                         loopOpI |= 1;
@@ -783,11 +750,9 @@ UBool RegexCompile::doParseActions(int32_t action)
                     if (fModeFlags & UREGEX_UNIX_LINES) {
                         loopOpI |= 2;
                     }
-                    fRXPat->fCompiledPat->addElement(loopOpI, *fStatus);
-                    frameLoc = fRXPat->fFrameSize;
-                    fRXPat->fFrameSize++;
-                    int32_t loopOpC = URX_BUILD(URX_LOOP_C, frameLoc);
-                    fRXPat->fCompiledPat->addElement(loopOpC, *fStatus);
+                    appendOp(loopOpI);
+                    frameLoc = allocateStackData(1);
+                    appendOp(URX_LOOP_C, frameLoc);
                     break;
                 }
 
@@ -801,18 +766,15 @@ UBool RegexCompile::doParseActions(int32_t action)
                 // Zero length match is possible.
                 // Emit the code sequence that can handle it.
                 insertOp(topLoc);
-                frameLoc =  fRXPat->fFrameSize;
-                fRXPat->fFrameSize++;
+                frameLoc = allocateStackData(1);
 
-                int32_t op = URX_BUILD(URX_STO_INP_LOC, frameLoc);
+                int32_t op = buildOp(URX_STO_INP_LOC, frameLoc);
                 fRXPat->fCompiledPat->setElementAt(op, topLoc);
 
-                op = URX_BUILD(URX_JMP_SAV_X, topLoc+1);
-                fRXPat->fCompiledPat->addElement(op, *fStatus);
+                appendOp(URX_JMP_SAV_X, topLoc+1);
             } else {
                 // Simpler code when the repeated body must match something non-empty
-                int32_t  jmpOp  = URX_BUILD(URX_JMP_SAV, topLoc);
-                fRXPat->fCompiledPat->addElement(jmpOp, *fStatus);
+                appendOp(URX_JMP_SAV, topLoc);
             }
         }
         break;
@@ -824,8 +786,7 @@ UBool RegexCompile::doParseActions(int32_t action)
         //     3.   ...
         {
             int32_t topLoc      = blockTopLoc(FALSE);
-            int32_t saveStateOp = URX_BUILD(URX_STATE_SAVE, topLoc);
-            fRXPat->fCompiledPat->addElement(saveStateOp, *fStatus);
+            appendOp(URX_STATE_SAVE, topLoc);
         }
         break;
 
@@ -839,7 +800,7 @@ UBool RegexCompile::doParseActions(int32_t action)
         // Insert the state save into the compiled pattern, and we're done.
         {
             int32_t   saveStateLoc = blockTopLoc(TRUE);
-            int32_t   saveStateOp  = URX_BUILD(URX_STATE_SAVE, fRXPat->fCompiledPat->size());
+            int32_t   saveStateOp  = buildOp(URX_STATE_SAVE, fRXPat->fCompiledPat->size());
             fRXPat->fCompiledPat->setElementAt(saveStateOp, saveStateLoc);
         }
         break;
@@ -858,14 +819,12 @@ UBool RegexCompile::doParseActions(int32_t action)
             int32_t  jmp1_loc = blockTopLoc(TRUE);
             int32_t  jmp2_loc = fRXPat->fCompiledPat->size();
 
-            int32_t  jmp1_op  = URX_BUILD(URX_JMP, jmp2_loc+1);
+            int32_t  jmp1_op  = buildOp(URX_JMP, jmp2_loc+1);
             fRXPat->fCompiledPat->setElementAt(jmp1_op, jmp1_loc);
 
-            int32_t  jmp2_op  = URX_BUILD(URX_JMP, jmp2_loc+2);
-            fRXPat->fCompiledPat->addElement(jmp2_op, *fStatus);
+            appendOp(URX_JMP, jmp2_loc+2);
 
-            int32_t  save_op  = URX_BUILD(URX_STATE_SAVE, jmp1_loc+1);
-            fRXPat->fCompiledPat->addElement(save_op, *fStatus);
+            appendOp(URX_STATE_SAVE, jmp1_loc+1);
         }
         break;
 
@@ -905,12 +864,10 @@ UBool RegexCompile::doParseActions(int32_t action)
 
                 if (URX_TYPE(repeatedOp) == URX_SETREF) {
                     // Emit optimized code for a [char set]*
-                    int32_t loopOpI = URX_BUILD(URX_LOOP_SR_I, URX_VAL(repeatedOp));
+                    int32_t loopOpI = buildOp(URX_LOOP_SR_I, URX_VAL(repeatedOp));
                     fRXPat->fCompiledPat->setElementAt(loopOpI, topLoc);
-                    dataLoc = fRXPat->fFrameSize;
-                    fRXPat->fFrameSize++;
-                    int32_t loopOpC = URX_BUILD(URX_LOOP_C, dataLoc);
-                    fRXPat->fCompiledPat->addElement(loopOpC, *fStatus);
+                    dataLoc = allocateStackData(1);
+                    appendOp(URX_LOOP_C, dataLoc);
                     break;
                 }
 
@@ -918,7 +875,7 @@ UBool RegexCompile::doParseActions(int32_t action)
                     URX_TYPE(repeatedOp) == URX_DOTANY_ALL ||
                     URX_TYPE(repeatedOp) == URX_DOTANY_UNIX) {
                     // Emit Optimized code for .* operations.
-                    int32_t loopOpI = URX_BUILD(URX_LOOP_DOT_I, 0);
+                    int32_t loopOpI = buildOp(URX_LOOP_DOT_I, 0);
                     if (URX_TYPE(repeatedOp) == URX_DOTANY_ALL) {
                         // URX_LOOP_DOT_I operand is a flag indicating . matches any mode.
                         loopOpI |= 1;
@@ -927,10 +884,8 @@ UBool RegexCompile::doParseActions(int32_t action)
                         loopOpI |= 2;
                     }
                     fRXPat->fCompiledPat->setElementAt(loopOpI, topLoc);
-                    dataLoc = fRXPat->fFrameSize;
-                    fRXPat->fFrameSize++;
-                    int32_t loopOpC = URX_BUILD(URX_LOOP_C, dataLoc);
-                    fRXPat->fCompiledPat->addElement(loopOpC, *fStatus);
+                    dataLoc = allocateStackData(1);
+                    appendOp(URX_LOOP_C, dataLoc);
                     break;
                 }
             }
@@ -939,30 +894,29 @@ UBool RegexCompile::doParseActions(int32_t action)
             // The optimizations did not apply.
 
             int32_t   saveStateLoc = blockTopLoc(TRUE);
-            int32_t   jmpOp        = URX_BUILD(URX_JMP_SAV, saveStateLoc+1);
+            int32_t   jmpOp        = buildOp(URX_JMP_SAV, saveStateLoc+1);
 
             // Check for minimum match length of zero, which requires
             //    extra loop-breaking code.
             if (minMatchLength(saveStateLoc, fRXPat->fCompiledPat->size()-1) == 0) {
                 insertOp(saveStateLoc);
-                dataLoc =  fRXPat->fFrameSize;
-                fRXPat->fFrameSize++;
+                dataLoc = allocateStackData(1);
 
-                int32_t op = URX_BUILD(URX_STO_INP_LOC, dataLoc);
+                int32_t op = buildOp(URX_STO_INP_LOC, dataLoc);
                 fRXPat->fCompiledPat->setElementAt(op, saveStateLoc+1);
-                jmpOp      = URX_BUILD(URX_JMP_SAV_X, saveStateLoc+2);
+                jmpOp      = buildOp(URX_JMP_SAV_X, saveStateLoc+2);
             }
 
             // Locate the position in the compiled pattern where the match will continue
             //   after completing the *.   (4 or 5 in the comment above)
             int32_t continueLoc = fRXPat->fCompiledPat->size()+1;
 
-            // Put together the save state op store it into the compiled code.
-            int32_t saveStateOp = URX_BUILD(URX_STATE_SAVE, continueLoc);
+            // Put together the save state op and store it into the compiled code.
+            int32_t saveStateOp = buildOp(URX_STATE_SAVE, continueLoc);
             fRXPat->fCompiledPat->setElementAt(saveStateOp, saveStateLoc);
 
             // Append the URX_JMP_SAV or URX_JMPX operation to the compiled pattern.
-            fRXPat->fCompiledPat->addElement(jmpOp, *fStatus);
+            appendOp(jmpOp);
         }
         break;
 
@@ -976,10 +930,9 @@ UBool RegexCompile::doParseActions(int32_t action)
         {
             int32_t     jmpLoc  = blockTopLoc(TRUE);                   // loc  1.
             int32_t     saveLoc = fRXPat->fCompiledPat->size();        // loc  3.
-            int32_t     jmpOp   = URX_BUILD(URX_JMP, saveLoc);
-            int32_t     stateSaveOp = URX_BUILD(URX_STATE_SAVE, jmpLoc+1);
+            int32_t     jmpOp   = buildOp(URX_JMP, saveLoc);
             fRXPat->fCompiledPat->setElementAt(jmpOp, jmpLoc);
-            fRXPat->fCompiledPat->addElement(stateSaveOp, *fStatus);
+            appendOp(URX_STATE_SAVE, jmpLoc+1);
         }
         break;
 
@@ -1048,9 +1001,9 @@ UBool RegexCompile::doParseActions(int32_t action)
 
             // First the STO_SP before the start of the loop
             insertOp(topLoc);
-            int32_t  varLoc    = fRXPat->fDataSize;    // Reserve a data location for saving the
-            fRXPat->fDataSize += 1;                    //  state stack ptr.
-            int32_t  op        = URX_BUILD(URX_STO_SP, varLoc);
+
+            int32_t  varLoc = allocateData(1);   // Reserve a data location for saving the
+            int32_t  op     = buildOp(URX_STO_SP, varLoc);
             fRXPat->fCompiledPat->setElementAt(op, topLoc);
 
             int32_t loopOp = fRXPat->fCompiledPat->popi();
@@ -1059,8 +1012,7 @@ UBool RegexCompile::doParseActions(int32_t action)
             fRXPat->fCompiledPat->push(loopOp, *fStatus);
 
             // Then the LD_SP after the end of the loop
-            op = URX_BUILD(URX_LD_SP, varLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LD_SP, varLoc);
         }
 
         break;
@@ -1095,52 +1047,47 @@ UBool RegexCompile::doParseActions(int32_t action)
     case doDotAny:
         // scanned a ".",  match any single character.
         {
-            int32_t   op;
             if (fModeFlags & UREGEX_DOTALL) {
-                op = URX_BUILD(URX_DOTANY_ALL, 0);
+                appendOp(URX_DOTANY_ALL, 0);
             } else if (fModeFlags & UREGEX_UNIX_LINES) {
-                op = URX_BUILD(URX_DOTANY_UNIX, 0);
+                appendOp(URX_DOTANY_UNIX, 0);
             } else {
-                op = URX_BUILD(URX_DOTANY, 0);
+                appendOp(URX_DOTANY, 0);
             }
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
         }
         break;
 
     case doCaret:
         {
-            int32_t op = 0;
+            fixLiterals(FALSE);
             if (       (fModeFlags & UREGEX_MULTILINE) == 0 && (fModeFlags & UREGEX_UNIX_LINES) == 0) {
-                op = URX_CARET;
+                appendOp(URX_CARET, 0);
             } else if ((fModeFlags & UREGEX_MULTILINE) != 0 && (fModeFlags & UREGEX_UNIX_LINES) == 0) {
-                op = URX_CARET_M;
+                appendOp(URX_CARET_M, 0);
             } else if ((fModeFlags & UREGEX_MULTILINE) == 0 && (fModeFlags & UREGEX_UNIX_LINES) != 0) {
-                op = URX_CARET;   // Only testing true start of input. 
+                appendOp(URX_CARET, 0);   // Only testing true start of input.
             } else if ((fModeFlags & UREGEX_MULTILINE) != 0 && (fModeFlags & UREGEX_UNIX_LINES) != 0) {
-                op = URX_CARET_M_UNIX;
+                appendOp(URX_CARET_M_UNIX, 0);
             }
-            fRXPat->fCompiledPat->addElement(URX_BUILD(op, 0), *fStatus);
         }
         break;
 
     case doDollar:
         {
-            int32_t op = 0;
             if (       (fModeFlags & UREGEX_MULTILINE) == 0 && (fModeFlags & UREGEX_UNIX_LINES) == 0) {
-                op = URX_DOLLAR;
+                appendOp(URX_DOLLAR, 0);
             } else if ((fModeFlags & UREGEX_MULTILINE) != 0 && (fModeFlags & UREGEX_UNIX_LINES) == 0) {
-                op = URX_DOLLAR_M;
+                appendOp(URX_DOLLAR_M, 0);
             } else if ((fModeFlags & UREGEX_MULTILINE) == 0 && (fModeFlags & UREGEX_UNIX_LINES) != 0) {
-                op = URX_DOLLAR_D;
+                appendOp(URX_DOLLAR_D, 0);
             } else if ((fModeFlags & UREGEX_MULTILINE) != 0 && (fModeFlags & UREGEX_UNIX_LINES) != 0) {
-                op = URX_DOLLAR_MD;
+                appendOp(URX_DOLLAR_MD, 0);
             }
-            fRXPat->fCompiledPat->addElement(URX_BUILD(op, 0), *fStatus);
         }
         break;
 
     case doBackslashA:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_CARET, 0), *fStatus);
+        appendOp(URX_CARET, 0);
         break;
 
     case doBackslashB:
@@ -1151,7 +1098,7 @@ UBool RegexCompile::doParseActions(int32_t action)
             }
             #endif
             int32_t op = (fModeFlags & UREGEX_UWORD)? URX_BACKSLASH_BU : URX_BACKSLASH_B;
-            fRXPat->fCompiledPat->addElement(URX_BUILD(op, 1), *fStatus);
+            appendOp(op, 1);
         }
         break;
 
@@ -1163,53 +1110,59 @@ UBool RegexCompile::doParseActions(int32_t action)
             }
             #endif
             int32_t op = (fModeFlags & UREGEX_UWORD)? URX_BACKSLASH_BU : URX_BACKSLASH_B;
-            fRXPat->fCompiledPat->addElement(URX_BUILD(op, 0), *fStatus);
+            appendOp(op, 0);
         }
         break;
 
     case doBackslashD:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKSLASH_D, 1), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_BACKSLASH_D, 1);
         break;
 
     case doBackslashd:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKSLASH_D, 0), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_BACKSLASH_D, 0);
         break;
 
     case doBackslashG:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKSLASH_G, 0), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_BACKSLASH_G, 0);
         break;
 
     case doBackslashS:
-        fRXPat->fCompiledPat->addElement(
-            URX_BUILD(URX_STAT_SETREF_N, URX_ISSPACE_SET), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_STAT_SETREF_N, URX_ISSPACE_SET);
         break;
 
     case doBackslashs:
-        fRXPat->fCompiledPat->addElement(
-            URX_BUILD(URX_STATIC_SETREF, URX_ISSPACE_SET), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_STATIC_SETREF, URX_ISSPACE_SET);
         break;
 
     case doBackslashW:
-        fRXPat->fCompiledPat->addElement(
-            URX_BUILD(URX_STAT_SETREF_N, URX_ISWORD_SET), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_STAT_SETREF_N, URX_ISWORD_SET);
         break;
 
     case doBackslashw:
-        fRXPat->fCompiledPat->addElement(
-            URX_BUILD(URX_STATIC_SETREF, URX_ISWORD_SET), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_STATIC_SETREF, URX_ISWORD_SET);
         break;
 
     case doBackslashX:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKSLASH_X, 0), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_BACKSLASH_X, 0);
         break;
 
 
     case doBackslashZ:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_DOLLAR, 0), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_DOLLAR, 0);
         break;
 
     case doBackslashz:
-        fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKSLASH_Z, 0), *fStatus);
+        fixLiterals(FALSE);
+        appendOp(URX_BACKSLASH_Z, 0);
         break;
 
     case doEscapeError:
@@ -1265,13 +1218,11 @@ UBool RegexCompile::doParseActions(int32_t action)
             //  we fill the operand with the capture group number.  At the end
             //  of compilation, it will be changed to the variable's location.
             U_ASSERT(groupNum > 0);
-            int32_t  op;
             if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
-                op = URX_BUILD(URX_BACKREF_I, groupNum);
+                appendOp(URX_BACKREF_I, groupNum);
             } else {
-                op = URX_BUILD(URX_BACKREF, groupNum);
+                appendOp(URX_BACKREF, groupNum);
             }
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
         }
         break;
 
@@ -1292,22 +1243,18 @@ UBool RegexCompile::doParseActions(int32_t action)
         {
             // Emit the STO_SP
             int32_t   topLoc = blockTopLoc(TRUE);
-            int32_t   stoLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize++;       // Reserve the data location for storing save stack ptr.
-            int32_t   op     = URX_BUILD(URX_STO_SP, stoLoc);
+            int32_t   stoLoc = allocateData(1);  // Reserve the data location for storing save stack ptr.
+            int32_t   op     = buildOp(URX_STO_SP, stoLoc);
             fRXPat->fCompiledPat->setElementAt(op, topLoc);
 
             // Emit the STATE_SAVE
-            op = URX_BUILD(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+2);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_STATE_SAVE, fRXPat->fCompiledPat->size()+2);
 
             // Emit the JMP
-            op = URX_BUILD(URX_JMP, topLoc+1);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_JMP, topLoc+1);
 
             // Emit the LD_SP
-            op = URX_BUILD(URX_LD_SP, stoLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LD_SP, stoLoc);
         }
         break;
 
@@ -1327,23 +1274,20 @@ UBool RegexCompile::doParseActions(int32_t action)
             insertOp(topLoc);
 
             // emit   STO_SP     loc
-            int32_t   stoLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize++;       // Reserve the data location for storing save stack ptr.
-            int32_t   op     = URX_BUILD(URX_STO_SP, stoLoc);
+            int32_t   stoLoc = allocateData(1);    // Reserve the data location for storing save stack ptr.
+            int32_t   op     = buildOp(URX_STO_SP, stoLoc);
             fRXPat->fCompiledPat->setElementAt(op, topLoc);
 
             // Emit the SAVE_STATE   5
             int32_t L7 = fRXPat->fCompiledPat->size()+1;
-            op = URX_BUILD(URX_STATE_SAVE, L7);
+            op = buildOp(URX_STATE_SAVE, L7);
             fRXPat->fCompiledPat->setElementAt(op, topLoc+1);
 
             // Append the JMP operation.
-            op = URX_BUILD(URX_JMP, topLoc+1);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_JMP, topLoc+1);
 
             // Emit the LD_SP       loc
-            op = URX_BUILD(URX_LD_SP, stoLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LD_SP, stoLoc);
         }
         break;
 
@@ -1362,19 +1306,17 @@ UBool RegexCompile::doParseActions(int32_t action)
             insertOp(topLoc);
 
             // Emit the STO_SP
-            int32_t   stoLoc = fRXPat->fDataSize;
-            fRXPat->fDataSize++;       // Reserve the data location for storing save stack ptr.
-            int32_t   op     = URX_BUILD(URX_STO_SP, stoLoc);
+            int32_t   stoLoc = allocateData(1);   // Reserve the data location for storing save stack ptr.
+            int32_t   op     = buildOp(URX_STO_SP, stoLoc);
             fRXPat->fCompiledPat->setElementAt(op, topLoc);
 
             // Emit the SAVE_STATE
             int32_t   continueLoc = fRXPat->fCompiledPat->size()+1;
-            op = URX_BUILD(URX_STATE_SAVE, continueLoc);
+            op = buildOp(URX_STATE_SAVE, continueLoc);
             fRXPat->fCompiledPat->setElementAt(op, topLoc+1);
 
             // Emit the LD_SP
-            op = URX_BUILD(URX_LD_SP, stoLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LD_SP, stoLoc);
         }
         break;
 
@@ -1430,8 +1372,8 @@ UBool RegexCompile::doParseActions(int32_t action)
         //      - NOP, which may later be replaced by a save-state if there
         //             is an '|' alternation within the parens.
         {
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_NOP, 0), *fStatus);
+            appendOp(URX_NOP, 0);
+            appendOp(URX_NOP, 0);
 
             // On the Parentheses stack, start a new frame and add the postions
             //   of the two NOPs (a normal non-capturing () frame, except for the
@@ -1755,176 +1697,139 @@ UBool RegexCompile::doParseActions(int32_t action)
 //
 //------------------------------------------------------------------------------
 void RegexCompile::literalChar(UChar32 c)  {
-    int32_t           op;            // An operation in the compiled pattern.
-    int32_t           opType;
-    int32_t           patternLoc;   // A position in the compiled pattern.
-    int32_t           stringLen;
+    fLiteralChars.append(c);
+}
 
 
-    // If the last thing compiled into the pattern was not a literal char,
-    //   force this new literal char to begin a new string, and not append to the previous.
-    op     = fRXPat->fCompiledPat->lastElementi();
-    opType = URX_TYPE(op);
-    if (!(opType == URX_STRING_LEN || opType == URX_ONECHAR || opType == URX_ONECHAR_I)) {
-        fixLiterals();
+//------------------------------------------------------------------------------
+//
+//    fixLiterals           When compiling something that can follow a literal
+//                          string in a pattern, emit the code to match the
+//                          accumulated literal string.
+//
+//                          Optionally, split the last char of the string off into
+//                          a single "ONE_CHAR" operation, so that quantifiers can
+//                          apply to that char alone.  Example:   abc*
+//                          The * must apply to the 'c' only.
+//
+//------------------------------------------------------------------------------
+void    RegexCompile::fixLiterals(UBool split) {
+
+    // If no literal characters have been scanned but not yet had code generated
+    //   for them, nothing needs to be done.
+    if (fLiteralChars.length() == 0) {
+        return;
     }
 
-    if (fStringOpStart == -1) {
-        // First char of a string in the pattern.
-        // Emit a OneChar op into the compiled pattern.
-        emitONE_CHAR(c);
+    int32_t indexOfLastCodePoint = fLiteralChars.moveIndex32(fLiteralChars.length(), -1);
+    UChar32 lastCodePoint = fLiteralChars.char32At(indexOfLastCodePoint);
+
+    // Split:  We need to  ensure that the last item in the compiled pattern
+    //     refers only to the last literal scanned in the pattern, so that
+    //     quantifiers (*, +, etc.) affect only it, and not a longer string.
+    //     Split before case folding for case insensitive matches.
 
-        // Also add it to the string pool, in case we get a second adjacent literal
-        //   and want to change form ONE_CHAR to STRING
-        fStringOpStart = fRXPat->fLiteralText.length();
-        fRXPat->fLiteralText.append(c);
+    if (split) {
+        fLiteralChars.truncate(indexOfLastCodePoint);
+        fixLiterals(FALSE);   // Recursive call, emit code to match the first part of the string.
+                              //  Note that the truncated literal string may be empty, in which case
+                              //  nothing will be emitted.
+
+        literalChar(lastCodePoint);  // Re-add the last code point as if it were a new literal.
+        fixLiterals(FALSE);          // Second recursive call, code for the final code point.
         return;
     }
 
-    // We are adding onto an existing string
-    fRXPat->fLiteralText.append(c);
-
-    op     = fRXPat->fCompiledPat->lastElementi();
-    opType = URX_TYPE(op);
-    U_ASSERT(opType == URX_ONECHAR || opType == URX_ONECHAR_I || opType == URX_STRING_LEN);
-
-    // If the most recently emitted op is a URX_ONECHAR,
-    if (opType == URX_ONECHAR || opType == URX_ONECHAR_I) {
-        if (U16_IS_TRAIL(c) && U16_IS_LEAD(URX_VAL(op))) {
-            // The most recently emitted op is a ONECHAR that was the first half
-            //   of a surrogate pair.  Update the ONECHAR's operand to be the
-            //   supplementary code point resulting from both halves of the pair.
-            c = U16_GET_SUPPLEMENTARY(URX_VAL(op), c);
-            op = URX_BUILD(opType, c);
-            patternLoc = fRXPat->fCompiledPat->size() - 1;
-            fRXPat->fCompiledPat->setElementAt(op, patternLoc);
-            return;
-        }
+    // If we are doing case-insensitive matching, case fold the string.  This may expand
+    //   the string, e.g. the German sharp-s turns into "ss"
+    if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
+        fLiteralChars.foldCase();
+        indexOfLastCodePoint = fLiteralChars.moveIndex32(fLiteralChars.length(), -1);
+        lastCodePoint = fLiteralChars.char32At(indexOfLastCodePoint);
+    }
 
-        // The most recently emitted op is a ONECHAR.
-        //  We've now received another adjacent char.  Change the ONECHAR op
-        //   to a string op.
+    if (indexOfLastCodePoint == 0) {
+        // Single character, emit a URX_ONECHAR op to match it.
+        if ((fModeFlags & UREGEX_CASE_INSENSITIVE) &&
+                 u_hasBinaryProperty(lastCodePoint, UCHAR_CASE_SENSITIVE)) {
+            appendOp(URX_ONECHAR_I, lastCodePoint);
+        } else {
+            appendOp(URX_ONECHAR, lastCodePoint);
+        }
+    } else {
+        // Two or more chars, emit a URX_STRING to match them.
+        if (fLiteralChars.length() > 0x00ffffff || fRXPat->fLiteralText.length() > 0x00ffffff) {
+            error(U_REGEX_PATTERN_TOO_BIG);
+        }
         if (fModeFlags & UREGEX_CASE_INSENSITIVE) {
-            op     = URX_BUILD(URX_STRING_I, fStringOpStart);
+            appendOp(URX_STRING_I, fRXPat->fLiteralText.length());
         } else {
-            op     = URX_BUILD(URX_STRING, fStringOpStart);
+            // TODO here:  add optimization to split case sensitive strings of length two
+            //             into two single char ops, for efficiency.
+            appendOp(URX_STRING, fRXPat->fLiteralText.length());
         }
-        patternLoc = fRXPat->fCompiledPat->size() - 1;
-        fRXPat->fCompiledPat->setElementAt(op, patternLoc);
-        op         = URX_BUILD(URX_STRING_LEN, 0);
-        fRXPat->fCompiledPat->addElement(op, *fStatus);
+        appendOp(URX_STRING_LEN, fLiteralChars.length());
+
+        // Add this string into the accumulated strings of the compiled pattern.
+        fRXPat->fLiteralText.append(fLiteralChars);
     }
 
-    // The pattern contains a URX_SRING / URX_STRING_LEN.  Update the
-    //  string length to reflect the new char we just added to the string.
-    stringLen  = fRXPat->fLiteralText.length() - fStringOpStart;
-    op         = URX_BUILD(URX_STRING_LEN, stringLen);
-    patternLoc = fRXPat->fCompiledPat->size() - 1;
-    fRXPat->fCompiledPat->setElementAt(op, patternLoc);
+    fLiteralChars.remove();
 }
 
 
-
-//------------------------------------------------------------------------------
-//
-//    emitONE_CHAR         emit a ONE_CHAR op into the generated code.
-//                         Choose cased or uncased version, depending on the
-//                         match mode and whether the character itself is cased.
-//
-//------------------------------------------------------------------------------
-void RegexCompile::emitONE_CHAR(UChar32  c) {
-    int32_t op;
-    if ((fModeFlags & UREGEX_CASE_INSENSITIVE) &&
-        u_hasBinaryProperty(c, UCHAR_CASE_SENSITIVE)) {
-        // We have a cased character, and are in case insensitive matching mode.
-        c  = u_foldCase(c, U_FOLD_CASE_DEFAULT);
-        op = URX_BUILD(URX_ONECHAR_I, c);
-    } else {
-        // Uncased char, or case sensitive match mode.
-        //  Either way, just generate a literal compare of the char.
-        op = URX_BUILD(URX_ONECHAR, c);
+int32_t RegexCompile::buildOp(int32_t type, int32_t val) {
+    if (U_FAILURE(*fStatus)) {
+        return 0;
     }
-    fRXPat->fCompiledPat->addElement(op, *fStatus);
+    if (type < 0 || type > 255) {
+        U_ASSERT(FALSE);
+        error(U_REGEX_INTERNAL_ERROR);
+        type = URX_RESERVED_OP;
+    }
+    if (val > 0x00ffffff) {
+        U_ASSERT(FALSE);
+        error(U_REGEX_INTERNAL_ERROR);
+        val = 0;
+    }
+    if (val < 0) {
+        if (!(type == URX_RESERVED_OP_N || type == URX_RESERVED_OP)) {
+            U_ASSERT(FALSE);
+            error(U_REGEX_INTERNAL_ERROR);
+            return -1;
+        }
+        if (URX_TYPE(val) != 0xff) {
+            U_ASSERT(FALSE);
+            error(U_REGEX_INTERNAL_ERROR);
+            return -1;
+        }
+        type = URX_RESERVED_OP_N;
+    }
+    return (type << 24) | val;
 }
 
 
 //------------------------------------------------------------------------------
 //
-//    fixLiterals           When compiling something that can follow a literal
-//                          string in a pattern, we need to "fix" any preceding
-//                          string, which will cause any subsequent literals to
-//                          begin a new string, rather than appending to the
-//                          old one.
-//
-//                          Optionally, split the last char of the string off into
-//                          a single "ONE_CHAR" operation, so that quantifiers can
-//                          apply to that char alone.  Example:   abc*
-//                          The * must apply to the 'c' only.
+//   appendOp()             Append a new instruction onto the compiled pattern
+//                          Includes error checking, limiting the size of the
+//                          pattern to lengths that can be represented in the
+//                          24 bit operand field of an instruction.
 //
 //------------------------------------------------------------------------------
-void    RegexCompile::fixLiterals(UBool split) {
-    int32_t  stringStart = fStringOpStart;    // start index of the current literal string
-    int32_t  op;                              // An op from/for the compiled pattern.
-    int32_t  opType;                          // An opcode type from the compiled pattern.
-    int32_t  stringLastCharIdx;
-    UChar32  lastChar;
-    int32_t  stringNextToLastCharIdx;
-    UChar32  nextToLastChar;
-    int32_t  stringLen;
-
-    fStringOpStart = -1;
-    if (!split) {
-        return;
-    }
-
-    // Split:  We need to  ensure that the last item in the compiled pattern does
-    //   not refer to a literal string of more than one char.  If it does,
-    //   separate the last char from the rest of the string.
-
-    // If the last operation from the compiled pattern is not a string,
-    //   nothing needs to be done
-    op     = fRXPat->fCompiledPat->lastElementi();
-    opType = URX_TYPE(op);
-    if (opType != URX_STRING_LEN) {
+void RegexCompile::appendOp(int32_t op) {
+    if (U_FAILURE(*fStatus)) {
         return;
     }
-    stringLen = URX_VAL(op);
-
-    //
-    // Find the position of the last code point in the string  (might be a surrogate pair)
-    //
-    stringLastCharIdx = fRXPat->fLiteralText.length();
-    stringLastCharIdx = fRXPat->fLiteralText.moveIndex32(stringLastCharIdx, -1);
-    lastChar          = fRXPat->fLiteralText.char32At(stringLastCharIdx);
-
-    // The string should always be at least two code points long, meaning that there
-    //   should be something before the last char position that we just found.
-    U_ASSERT(stringLastCharIdx > stringStart);
-    stringNextToLastCharIdx = fRXPat->fLiteralText.moveIndex32(stringLastCharIdx, -1);
-    U_ASSERT(stringNextToLastCharIdx >= stringStart);
-    nextToLastChar          = fRXPat->fLiteralText.char32At(stringNextToLastCharIdx);
-
-    if (stringNextToLastCharIdx > stringStart) {
-        // The length of string remaining after removing one char is two or more.
-        // Leave the string in the compiled pattern, shorten it by one char,
-        //   and append a URX_ONECHAR op for the last char.
-        stringLen -= (fRXPat->fLiteralText.length() - stringLastCharIdx);
-        op = URX_BUILD(URX_STRING_LEN, stringLen);
-        fRXPat->fCompiledPat->setElementAt(op, fRXPat->fCompiledPat->size() -1);
-        emitONE_CHAR(lastChar);
-    } else {
-        // The original string consisted of exactly two characters.  Replace
-        // the existing compiled URX_STRING/URX_STRING_LEN ops with a pair
-        // of URX_ONECHARs.
-        fRXPat->fCompiledPat->setSize(fRXPat->fCompiledPat->size() -2);
-        emitONE_CHAR(nextToLastChar);
-        emitONE_CHAR(lastChar);
+    fRXPat->fCompiledPat->addElement(op, *fStatus);
+    if ((fRXPat->fCompiledPat->size() > 0x00fffff0) && U_SUCCESS(*fStatus)) {
+        error(U_REGEX_PATTERN_TOO_BIG);
     }
 }
 
-
-
-
+void RegexCompile::appendOp(int32_t type, int32_t val) {
+    appendOp(buildOp(type, val));
+}
 
 
 //------------------------------------------------------------------------------
@@ -1940,7 +1845,7 @@ void   RegexCompile::insertOp(int32_t where) {
     UVector32 *code = fRXPat->fCompiledPat;
     U_ASSERT(where>0 && where < code->size());
 
-    int32_t  nop = URX_BUILD(URX_NOP, 0);
+    int32_t  nop = buildOp(URX_NOP, 0);
     code->insertElementAt(nop, where, *fStatus);
 
     // Walk through the pattern, looking for any ops with targets that
@@ -1960,7 +1865,7 @@ void   RegexCompile::insertOp(int32_t where) {
             // Target location for this opcode is after the insertion point and
             //   needs to be incremented to adjust for the insertion.
             opValue++;
-            op = URX_BUILD(opType, opValue);
+            op = buildOp(opType, opValue);
             code->setElementAt(op, loc);
         }
     }
@@ -1985,6 +1890,58 @@ void   RegexCompile::insertOp(int32_t where) {
 }
 
 
+//------------------------------------------------------------------------------
+//
+//   allocateData()        Allocate storage in the matcher's static data area.
+//                         Return the index for the newly allocated data.
+//                         The storage won't actually exist until we are running a match
+//                         operation, but the storage indexes are inserted into various
+//                         opcodes while compiling the pattern.
+//
+//------------------------------------------------------------------------------
+int32_t RegexCompile::allocateData(int32_t size) {
+    if (U_FAILURE(*fStatus)) {
+        return 0;
+    }
+    if (size <= 0 || size > 0x100 || fRXPat->fDataSize < 0) {
+        error(U_REGEX_INTERNAL_ERROR);
+        return 0;
+    }
+    int32_t dataIndex = fRXPat->fDataSize;
+    fRXPat->fDataSize += size;
+    if (fRXPat->fDataSize >= 0x00fffff0) {
+        error(U_REGEX_INTERNAL_ERROR);
+    }
+    return dataIndex;
+}
+
+
+//------------------------------------------------------------------------------
+//
+//   allocateStackData()   Allocate space in the back-tracking stack frame.
+//                         Return the index for the newly allocated data.
+//                         The frame indexes are inserted into various
+//                         opcodes while compiling the pattern, meaning that frame
+//                         size must be restricted to the size that will fit
+//                         as an operand (24 bits).
+//
+//------------------------------------------------------------------------------
+int32_t RegexCompile::allocateStackData(int32_t size) {
+    if (U_FAILURE(*fStatus)) {
+        return 0;
+    }
+    if (size <= 0 || size > 0x100 || fRXPat->fFrameSize < 0) {
+        error(U_REGEX_INTERNAL_ERROR);
+        return 0;
+    }
+    int32_t dataIndex = fRXPat->fFrameSize;
+    fRXPat->fFrameSize += size;
+    if (fRXPat->fFrameSize >= 0x00fffff0) {
+        error(U_REGEX_PATTERN_TOO_BIG);
+    }
+    return dataIndex;
+}
+
 
 //------------------------------------------------------------------------------
 //
@@ -2021,7 +1978,7 @@ int32_t   RegexCompile::blockTopLoc(UBool reserveLoc) {
         theLoc = fRXPat->fCompiledPat->size()-1;
         if (reserveLoc) {
             /*int32_t opAtTheLoc = fRXPat->fCompiledPat->elementAti(theLoc);*/
-            int32_t  nop = URX_BUILD(URX_NOP, 0);
+            int32_t  nop = buildOp(URX_NOP, 0);
             fRXPat->fCompiledPat->insertElementAt(nop, theLoc, *fStatus);
         }
     }
@@ -2097,8 +2054,7 @@ void  RegexCompile::handleCloseParen() {
             U_ASSERT(URX_TYPE(captureOp) == URX_START_CAPTURE);
 
             int32_t   frameVarLocation = URX_VAL(captureOp);
-            int32_t   endCaptureOp = URX_BUILD(URX_END_CAPTURE, frameVarLocation);
-            fRXPat->fCompiledPat->addElement(endCaptureOp, *fStatus);
+            appendOp(URX_END_CAPTURE, frameVarLocation);
         }
         break;
     case atomic:
@@ -2109,8 +2065,7 @@ void  RegexCompile::handleCloseParen() {
             int32_t   stoOp = fRXPat->fCompiledPat->elementAti(fMatchOpenParen+1);
             U_ASSERT(URX_TYPE(stoOp) == URX_STO_SP);
             int32_t   stoLoc = URX_VAL(stoOp);
-            int32_t   ldOp   = URX_BUILD(URX_LD_SP, stoLoc);
-            fRXPat->fCompiledPat->addElement(ldOp, *fStatus);
+            appendOp(URX_LD_SP, stoLoc);
         }
         break;
 
@@ -2119,33 +2074,29 @@ void  RegexCompile::handleCloseParen() {
             int32_t  startOp = fRXPat->fCompiledPat->elementAti(fMatchOpenParen-5);
             U_ASSERT(URX_TYPE(startOp) == URX_LA_START);
             int32_t dataLoc  = URX_VAL(startOp);
-            int32_t op       = URX_BUILD(URX_LA_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LA_END, dataLoc);
         }
         break;
 
     case negLookAhead:
         {
             // See comment at doOpenLookAheadNeg
-            int32_t  startOp = fRXPat->fCompiledPat->elementAti(fMatchOpenParen-1);
+            int32_t  startOp = (int32_t)fRXPat->fCompiledPat->elementAti(fMatchOpenParen-1);
             U_ASSERT(URX_TYPE(startOp) == URX_LA_START);
             int32_t dataLoc  = URX_VAL(startOp);
-            int32_t op       = URX_BUILD(URX_LA_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            op               = URX_BUILD(URX_BACKTRACK, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-            op               = URX_BUILD(URX_LA_END, 0);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LA_END, dataLoc);
+            appendOp(URX_BACKTRACK, 0);
+            appendOp(URX_LA_END, dataLoc);
 
             // Patch the URX_SAVE near the top of the block.
             // The destination of the SAVE is the final LA_END that was just added.
-            int32_t saveOp   = fRXPat->fCompiledPat->elementAti(fMatchOpenParen);
+            int32_t saveOp   = (int32_t)fRXPat->fCompiledPat->elementAti(fMatchOpenParen);
             U_ASSERT(URX_TYPE(saveOp) == URX_STATE_SAVE);
             int32_t dest     = fRXPat->fCompiledPat->size()-1;
-            saveOp           = URX_BUILD(URX_STATE_SAVE, dest);
+            saveOp           = buildOp(URX_STATE_SAVE, dest);
             fRXPat->fCompiledPat->setElementAt(saveOp, fMatchOpenParen);
         }
-        break;
+	break;
 
     case lookBehind:
         {
@@ -2155,10 +2106,8 @@ void  RegexCompile::handleCloseParen() {
             int32_t  startOp = fRXPat->fCompiledPat->elementAti(fMatchOpenParen-4);
             U_ASSERT(URX_TYPE(startOp) == URX_LB_START);
             int32_t dataLoc  = URX_VAL(startOp);
-            int32_t op       = URX_BUILD(URX_LB_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
-                    op       = URX_BUILD(URX_LA_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LB_END, dataLoc);
+            appendOp(URX_LA_END, dataLoc);
 
             // Determine the min and max bounds for the length of the
             //  string that the pattern can match.
@@ -2190,8 +2139,7 @@ void  RegexCompile::handleCloseParen() {
             int32_t  startOp = fRXPat->fCompiledPat->elementAti(fMatchOpenParen-5);
             U_ASSERT(URX_TYPE(startOp) == URX_LB_START);
             int32_t dataLoc  = URX_VAL(startOp);
-            int32_t op       = URX_BUILD(URX_LBN_END, dataLoc);
-            fRXPat->fCompiledPat->addElement(op, *fStatus);
+            appendOp(URX_LBN_END, dataLoc);
 
             // Determine the min and max bounds for the length of the
             //  string that the pattern can match.
@@ -2212,7 +2160,7 @@ void  RegexCompile::handleCloseParen() {
 
             // Insert the pattern location to continue at after a successful match
             //  as the last operand of the URX_LBN_CONT
-            op = URX_BUILD(URX_RELOC_OPRND, fRXPat->fCompiledPat->size());
+            int32_t op = buildOp(URX_RELOC_OPRND, fRXPat->fCompiledPat->size());
             fRXPat->fCompiledPat->setElementAt(op,  fMatchOpenParen-1);
         }
         break;
@@ -2254,7 +2202,7 @@ void        RegexCompile::compileSet(UnicodeSet *theSet)
     case 0:
         {
             // Set of no elements.   Always fails to match.
-            fRXPat->fCompiledPat->addElement(URX_BUILD(URX_BACKTRACK, 0), *fStatus);
+            appendOp(URX_BACKTRACK, 0);
             delete theSet;
         }
         break;
@@ -2275,8 +2223,7 @@ void        RegexCompile::compileSet(UnicodeSet *theSet)
             //  Put it into the compiled pattern as a set.
             int32_t setNumber = fRXPat->fSets->size();
             fRXPat->fSets->addElement(theSet, *fStatus);
-            int32_t setOp = URX_BUILD(URX_SETREF, setNumber);
-            fRXPat->fCompiledPat->addElement(setOp, *fStatus);
+            appendOp(URX_SETREF, setNumber);
         }
     }
 }
@@ -2309,11 +2256,14 @@ void        RegexCompile::compileInterval(int32_t InitOp,  int32_t LoopOp)
     insertOp(topOfBlock);
 
     // The operands for the CTR_INIT opcode include the index in the matcher data
-    //   of the counter.  Allocate it now.
-    int32_t   counterLoc = fRXPat->fFrameSize;
-    fRXPat->fFrameSize++;
-
-    int32_t   op = URX_BUILD(InitOp, counterLoc);
+    //   of the counter.  Allocate it now. There are two data items
+    //        counterLoc   -->  Loop counter
+    //               +1    -->  Input index (for breaking non-progressing loops)
+    //                          (Only present if unbounded upper limit on loop)
+    int32_t   dataSize = fIntervalUpper < 0 ? 2 : 1;
+    int32_t   counterLoc = allocateStackData(dataSize);
+
+    int32_t   op = buildOp(InitOp, counterLoc);
     fRXPat->fCompiledPat->setElementAt(op, topOfBlock);
 
     // The second operand of CTR_INIT is the location following the end of the loop.
@@ -2321,7 +2271,7 @@ void        RegexCompile::compileInterval(int32_t InitOp,  int32_t LoopOp)
     //   compilation of something later on causes the code to grow and the target
     //   position to move.
     int32_t loopEnd = fRXPat->fCompiledPat->size();
-    op = URX_BUILD(URX_RELOC_OPRND, loopEnd);
+    op = buildOp(URX_RELOC_OPRND, loopEnd);
     fRXPat->fCompiledPat->setElementAt(op, topOfBlock+1);
 
     // Followed by the min and max counts.
@@ -2330,8 +2280,7 @@ void        RegexCompile::compileInterval(int32_t InitOp,  int32_t LoopOp)
 
     // Apend the CTR_LOOP op.  The operand is the location of the CTR_INIT op.
     //   Goes at end of the block being looped over, so just append to the code so far.
-    op = URX_BUILD(LoopOp, topOfBlock);
-    fRXPat->fCompiledPat->addElement(op, *fStatus);
+    appendOp(LoopOp, topOfBlock);
 
     if ((fIntervalLow & 0xff000000) != 0 ||
         fIntervalUpper > 0 && (fIntervalUpper & 0xff000000) != 0) {
@@ -2376,7 +2325,7 @@ UBool RegexCompile::compileInlineInterval() {
     //
     int32_t endOfSequenceLoc = fRXPat->fCompiledPat->size()-1
                                 + fIntervalUpper + (fIntervalUpper-fIntervalLow);
-    int32_t saveOp = URX_BUILD(URX_STATE_SAVE, endOfSequenceLoc);
+    int32_t saveOp = buildOp(URX_STATE_SAVE, endOfSequenceLoc);
     if (fIntervalLow == 0) {
         insertOp(topOfBlock);
         fRXPat->fCompiledPat->setElementAt(saveOp, topOfBlock);
@@ -2389,13 +2338,10 @@ UBool RegexCompile::compileInlineInterval() {
     //    it was put there when it was originally encountered.
     int32_t i;
     for (i=1; i<fIntervalUpper; i++ ) {
-        if (i == fIntervalLow) {
-            fRXPat->fCompiledPat->addElement(saveOp, *fStatus);
+        if (i >= fIntervalLow) {
+            appendOp(saveOp);
         }
-        if (i > fIntervalLow) {
-            fRXPat->fCompiledPat->addElement(saveOp, *fStatus);
-        }
-        fRXPat->fCompiledPat->addElement(op, *fStatus);
+        appendOp(op);
     }
     return TRUE;
 }
@@ -3410,7 +3356,7 @@ void RegexCompile::stripNOPs() {
     int32_t src;
     int32_t dst = 0;
     for (src=0; src<end; src++) {
-        int32_t op = fRXPat->fCompiledPat->elementAti(src);
+        int32_t op = (int32_t)fRXPat->fCompiledPat->elementAti(src);
         int32_t opType = URX_TYPE(op);
         switch (opType) {
         case URX_NOP:
@@ -3429,12 +3375,26 @@ void RegexCompile::stripNOPs() {
                 int32_t  operandAddress = URX_VAL(op);
                 U_ASSERT(operandAddress>=0 && operandAddress<deltas.size());
                 int32_t fixedOperandAddress = operandAddress - deltas.elementAti(operandAddress);
-                op = URX_BUILD(opType, fixedOperandAddress);
+                op = buildOp(opType, fixedOperandAddress);
                 fRXPat->fCompiledPat->setElementAt(op, dst);
                 dst++;
                 break;
             }
 
+        case URX_BACKREF:
+        case URX_BACKREF_I:
+            {
+                int32_t where = URX_VAL(op);
+                if (where > fRXPat->fGroupMap->size()) {
+                    error(U_REGEX_INVALID_BACK_REF);
+                    break;
+                }
+                where = fRXPat->fGroupMap->elementAti(where-1);
+                op    = buildOp(opType, where);
+                fRXPat->fCompiledPat->setElementAt(op, dst);
+                dst++;
+                break;
+            }
         case URX_RESERVED_OP:
         case URX_RESERVED_OP_N:
         case URX_BACKTRACK:
@@ -3463,13 +3423,11 @@ void RegexCompile::stripNOPs() {
         case URX_DOTANY_UNIX:
         case URX_STO_SP:
         case URX_LD_SP:
-        case URX_BACKREF:
         case URX_STO_INP_LOC:
         case URX_LA_START:
         case URX_LA_END:
         case URX_ONECHAR_I:
         case URX_STRING_I:
-        case URX_BACKREF_I:
         case URX_DOLLAR_M:
         case URX_CARET_M:
         case URX_CARET_M_UNIX:
@@ -3750,7 +3708,7 @@ void RegexCompile::nextChar(RegexPatternChar &c) {
 //------------------------------------------------------------------------------
 //
 //  scanNamedChar
- //            Get a UChar32 from a \N{UNICODE CHARACTER NAME} in the pattern.
+//            Get a UChar32 from a \N{UNICODE CHARACTER NAME} in the pattern.
 //
 //             The scan position will be at the 'N'.  On return
 //             the scan position should be just after the '}'
diff --git a/source/i18n/regexcmp.h b/source/i18n/regexcmp.h
index 94c83b6..cc9e6eb 100644
--- a/source/i18n/regexcmp.h
+++ b/source/i18n/regexcmp.h
@@ -104,6 +104,13 @@ private:
                                                      //   generated code at the specified location.
     void        emitONE_CHAR(UChar32 c);             // EMit a ONE_CHAR op into the compiled code,
                                                      //   taking case mode into account.
+    void        appendOp(int32_t op);                // Append a new op to the compiled pattern.
+    void        appendOp(int32_t type, int32_t val); // Build & append a new op to the compiled pattern.
+    int32_t     buildOp(int32_t type, int32_t val);  // Construct a new pcode instruction.
+    int32_t     allocateData(int32_t size);          // Allocate space in the matcher data area.
+                                                     //   Return index of the newly allocated data.
+    int32_t     allocateStackData(int32_t size);     // Allocate space in the match back-track stack frame.
+                                                     //   Return offset index in the frame.
     int32_t     minMatchLength(int32_t start,
                                int32_t end);
     int32_t     maxMatchLength(int32_t start,
@@ -163,6 +170,11 @@ private:
                                                      //   until last flag is scanned.
     UBool                         fSetModeFlag;      // true for (?ismx, false for (?-ismx
 
+    UnicodeString                 fLiteralChars;     // Literal chars or strings from the pattern are accumulated here.
+                                                     //   Once completed, meaning that some non-literal pattern
+                                                     //   construct is encountered, the appropriate opcodes
+                                                     //   to match the literal will be generated, and this
+                                                     //   string will be cleared.
 
     int32_t                       fStringOpStart;    // While a literal string is being scanned
                                                      //   holds the start index within RegexPattern.
diff --git a/source/i18n/regeximp.h b/source/i18n/regeximp.h
index 07206e6..b2057d5 100644
--- a/source/i18n/regeximp.h
+++ b/source/i18n/regeximp.h
@@ -244,7 +244,6 @@ enum {
 //
 //  Convenience macros for assembling and disassembling a compiled operation.
 //
-#define URX_BUILD(type, val) (int32_t)((type << 24) | (val))
 #define URX_TYPE(x)          ((uint32_t)(x) >> 24)
 #define URX_VAL(x)           ((x) & 0xffffff)
 
diff --git a/source/test/intltest/regextst.cpp b/source/test/intltest/regextst.cpp
index cdc9e78..936f2f2 100644
--- a/source/test/intltest/regextst.cpp
+++ b/source/test/intltest/regextst.cpp
@@ -144,6 +144,9 @@ UBool RegexTest::doRegexLMTest(const char *pat, const char *text, UBool looking,
     UBool actualmatch;
     actualmatch = REMatcher->lookingAt(status);
     if (U_FAILURE(status)) {
+        case 25: name = "TestBug11371";
+            if (exec) TestBug11371();
+            break;
         errln("RegexTest failure in lookingAt() at line %d.  Status = %s\n",
             line, u_errorName(status));
         retVal =  FALSE;
@@ -2384,6 +2387,49 @@ void RegexTest::PerlTests() {
 
 }
 
+void RegexTest::TestBug11371() {
+    if (quick) {
+        logln("Skipping test. Runs in exhuastive mode only.");
+        return;
+    }
+    UErrorCode status = U_ZERO_ERROR;
+    UnicodeString patternString;
+
+    for (int i=0; i<8000000; i++) {
+        patternString.append(UnicodeString("()"));
+    }
+    LocalPointer<RegexPattern> compiledPat(RegexPattern::compile(patternString, 0, status));
+    if (status != U_REGEX_PATTERN_TOO_BIG) {
+        errln("File %s, line %d expected status=U_REGEX_PATTERN_TOO_BIG; got %s.",
+              __FILE__, __LINE__, u_errorName(status));
+    }
+
+    status = U_ZERO_ERROR;
+    patternString = "(";
+    for (int i=0; i<20000000; i++) {
+        patternString.append(UnicodeString("A++"));
+    }
+    patternString.append(UnicodeString("){0}B++"));
+    LocalPointer<RegexPattern> compiledPat2(RegexPattern::compile(patternString, 0, status));
+    if (status != U_REGEX_PATTERN_TOO_BIG) {
+        errln("File %s, line %d expected status=U_REGEX_PATTERN_TOO_BIG; got %s.",
+              __FILE__, __LINE__, u_errorName(status));
+    }
+
+    // Pattern with too much string data, such that string indexes overflow operand data field size
+    // in compiled instruction.
+    status = U_ZERO_ERROR;
+    patternString = "";
+    while (patternString.length() < 0x00ffffff) {
+        patternString.append(UnicodeString("stuff and things dont you know, these are a few of my favorite strings\n"));
+    }
+    patternString.append(UnicodeString("X? trailing string"));
+    LocalPointer<RegexPattern> compiledPat3(RegexPattern::compile(patternString, 0, status));
+    if (status != U_REGEX_PATTERN_TOO_BIG) {
+        errln("File %s, line %d expected status=U_REGEX_PATTERN_TOO_BIG; got %s.",
+              __FILE__, __LINE__, u_errorName(status));
+    }
+}
 
 //
 //   Callbacks()    Test the callback function.
diff --git a/source/test/intltest/regextst.h b/source/test/intltest/regextst.h
index 12b7e63..0b78b4d 100644
--- a/source/test/intltest/regextst.h
+++ b/source/test/intltest/regextst.h
@@ -45,3 +45,4 @@ public:
 
 #endif   // !UCONFIG_NO_REGULAR_EXPRESSIONS
 #endif
+    virtual void TestBug11371();
-- 
2.1.4

