--- icu/icu-2.6.patch.old	2005-11-01 15:43:54.000000000 +0100
+++ icu/icu-2.6.patch	2005-12-23 17:44:59.000000000 +0100
@@ -2930,3 +2930,3864 @@
     }
   }
   
+*** build/icu/source/common/unicode/putil.h.old	2003-06-03 08:44:38.000000000 +0200
+--- misc/build/icu/source/common/unicode/putil.h	2005-12-21 20:09:16.000000000 +0100
+***************
+*** 415,421 ****
+   */
+  #    define U_MAX_PTR(base) ((void *)(((char *)base)-((int32_t)(base))+((int32_t)0xffefff)))
+  #  else
+! #    define U_MAX_PTR(base) ((void *)(((char *)(base)+0x7fffffff) > (char *)(base) ? ((char *)(base)+0x7fffffff) : (char *)-1))
+  #  endif
+  #endif
+  
+--- 415,421 ----
+   */
+  #    define U_MAX_PTR(base) ((void *)(((char *)base)-((int32_t)(base))+((int32_t)0xffefff)))
+  #  else
+! #    define U_MAX_PTR(base) ((void *)(((uintptr_t)(base)+0x7fffffff) >(uintptr_t)(base) ? ((uintptr_t)(base)+0x7fffffff) : (uintptr_t)-1))
+  #  endif
+  #endif
+  
+*** build/icu/source/common/ucnvbocu.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnvbocu.c	2005-12-23 13:35:03.000000000 +0100
+***************
+*** 393,404 ****
+  
+  U_ALIGN_CODE(16)
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      /* get the converter state from UConverter */
+--- 393,410 ----
+  
+  U_ALIGN_CODE(16)
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit)-(uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      /* get the converter state from UConverter */
+***************
+*** 469,475 ****
+          }
+      }
+      /* restore real values */
+!     targetCapacity=(const uint8_t *)pArgs->targetLimit-target;
+      sourceIndex=nextSourceIndex; /* wrong if offsets==NULL but does not matter */
+  
+      /* regular loop for all cases */
+--- 475,481 ----
+          }
+      }
+      /* restore real values */
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit)-(uintptr_t)target;
+      sourceIndex=nextSourceIndex; /* wrong if offsets==NULL but does not matter */
+  
+      /* regular loop for all cases */
+***************
+*** 703,714 ****
+  
+      int32_t prev, c, diff;
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+  
+      /* get the converter state from UConverter */
+      c=cnv->fromUSurrogateLead;
+--- 709,726 ----
+  
+      int32_t prev, c, diff;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit)-(uintptr_t)(pArgs->target);
+  
+      /* get the converter state from UConverter */
+      c=cnv->fromUSurrogateLead;
+***************
+*** 748,754 ****
+          --targetCapacity;
+      }
+      /* restore real values */
+!     targetCapacity=(const uint8_t *)pArgs->targetLimit-target;
+  
+      /* regular loop for all cases */
+      while(source<sourceLimit) {
+--- 760,766 ----
+          --targetCapacity;
+      }
+      /* restore real values */
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit)-(uintptr_t)target;
+  
+      /* regular loop for all cases */
+      while(source<sourceLimit) {
+***************
+*** 1014,1019 ****
+--- 1026,1037 ----
+  
+      int32_t sourceIndex, nextSourceIndex;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=(const uint8_t *)pArgs->source;
+***************
+*** 1040,1046 ****
+  
+      /* conversion "loop" similar to _SCSUToUnicodeWithOffsets() */
+  loop:
+!     if(count>0 && byteIndex>0 && target<targetLimit) {
+          goto getTrail;
+      }
+  
+--- 1058,1064 ----
+  
+      /* conversion "loop" similar to _SCSUToUnicodeWithOffsets() */
+  loop:
+!     if(count>0 && byteIndex>0 && (uintptr_t)target<(uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+  
+***************
+*** 1048,1054 ****
+      /* fast loop for single-byte differences */
+      /* use count as the only loop counter variable */
+      diff=sourceLimit-source;
+!     count=pArgs->targetLimit-target;
+      if(count>diff) {
+          count=diff;
+      }
+--- 1066,1072 ----
+      /* fast loop for single-byte differences */
+      /* use count as the only loop counter variable */
+      diff=sourceLimit-source;
+!     count=((uintptr_t)(pArgs->targetLimit)-(uintptr_t)target)/sizeof(UChar);
+      if(count>diff) {
+          count=diff;
+      }
+***************
+*** 1102,1108 ****
+  
+      /* decode a sequence of single and lead bytes */
+      while(source<sourceLimit) {
+!         if(target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+              break;
+--- 1120,1126 ----
+  
+      /* decode a sequence of single and lead bytes */
+      while(source<sourceLimit) {
+!         if((uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+              break;
+***************
+*** 1207,1213 ****
+          } else {
+              /* output surrogate pair */
+              *target++=UTF16_LEAD(c);
+!             if(target<targetLimit) {
+                  *target++=UTF16_TRAIL(c);
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex;
+--- 1225,1231 ----
+          } else {
+              /* output surrogate pair */
+              *target++=UTF16_LEAD(c);
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  *target++=UTF16_TRAIL(c);
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex;
+***************
+*** 1336,1341 ****
+--- 1354,1365 ----
+  
+  U_ALIGN_CODE(16)
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=(const uint8_t *)pArgs->source;
+***************
+*** 1357,1363 ****
+  
+      /* conversion "loop" similar to _SCSUToUnicodeWithOffsets() */
+  loop:
+!     if(count>0 && byteIndex>0 && target<targetLimit) {
+          goto getTrail;
+      }
+  
+--- 1381,1387 ----
+  
+      /* conversion "loop" similar to _SCSUToUnicodeWithOffsets() */
+  loop:
+!     if(count>0 && byteIndex>0 && (uintptr_t)target<(uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+  
+***************
+*** 1365,1371 ****
+      /* fast loop for single-byte differences */
+      /* use count as the only loop counter variable */
+      diff=sourceLimit-source;
+!     count=pArgs->targetLimit-target;
+      if(count>diff) {
+          count=diff;
+      }
+--- 1389,1395 ----
+      /* fast loop for single-byte differences */
+      /* use count as the only loop counter variable */
+      diff=sourceLimit-source;
+!     count=((uintptr_t)(pArgs->targetLimit)-(uintptr_t)target)/sizeof(UChar);
+      if(count>diff) {
+          count=diff;
+      }
+***************
+*** 1392,1398 ****
+  
+      /* decode a sequence of single and lead bytes */
+      while(source<sourceLimit) {
+!         if(target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+              break;
+--- 1416,1422 ----
+  
+      /* decode a sequence of single and lead bytes */
+      while(source<sourceLimit) {
+!         if((uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+              break;
+***************
+*** 1482,1488 ****
+          } else {
+              /* output surrogate pair */
+              *target++=UTF16_LEAD(c);
+!             if(target<targetLimit) {
+                  *target++=UTF16_TRAIL(c);
+              } else {
+                  /* target overflow */
+--- 1506,1512 ----
+          } else {
+              /* output surrogate pair */
+              *target++=UTF16_LEAD(c);
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  *target++=UTF16_TRAIL(c);
+              } else {
+                  /* target overflow */
+*** build/icu/source/common/ucnv.c	2003-05-13 23:05:04.000000000 +0200
+--- misc/build/icu/source/common/ucnv.c	2005-12-22 15:50:47.000000000 +0100
+***************
+*** 774,779 ****
+--- 774,785 ----
+      UConverterFromUnicodeArgs args;
+      const char *t;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /*
+      * Check parameters in for all conversions
+      */
+***************
+*** 787,793 ****
+      }
+  
+      t = *target;
+!     if (targetLimit < t || sourceLimit < *source)
+      {
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+--- 793,799 ----
+      }
+  
+      t = *target;
+!     if ((uintptr_t)targetLimit < (uintptr_t)t || sourceLimit < *source)
+      {
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+***************
+*** 796,806 ****
+      /*
+      * Make sure that the target buffer size does not exceed the number range for int32_t
+      * because some functions use the size rather than comparing pointers.
+-     * size_t is guaranteed to be unsigned.
+      */
+!     if((size_t)(targetLimit - t) > (size_t)0x7fffffff && targetLimit > t)
+      {
+!         targetLimit = t + 0x7fffffff;
+      }
+      
+      /*
+--- 802,811 ----
+      /*
+      * Make sure that the target buffer size does not exceed the number range for int32_t
+      * because some functions use the size rather than comparing pointers.
+      */
+!     if(((uintptr_t)targetLimit - (uintptr_t)t) > (uintptr_t)0x7fffffff && (uintptr_t)targetLimit > (uintptr_t)t)
+      {
+!         targetLimit = (char*)((uintptr_t)t + (uintptr_t)0x7fffffff);
+      }
+      
+      /*
+***************
+*** 810,820 ****
+      if (_this->charErrorBufferLength > 0)
+      {
+          int32_t myTargetIndex = 0;
+-         
+          ucnv_flushInternalCharBuffer (_this, 
+                  (char *)t,
+                  &myTargetIndex,
+!                 targetLimit - *target,
+                  offsets?&offsets:NULL,
+                  err);
+          *target += myTargetIndex;
+--- 815,824 ----
+      if (_this->charErrorBufferLength > 0)
+      {
+          int32_t myTargetIndex = 0;
+          ucnv_flushInternalCharBuffer (_this, 
+                  (char *)t,
+                  &myTargetIndex,
+!                 (uintptr_t)targetLimit - (uintptr_t)(*target),
+                  offsets?&offsets:NULL,
+                  err);
+          *target += myTargetIndex;
+***************
+*** 846,852 ****
+          }
+          else {
+              /* there is no implementation that sets offsets, set them all to -1 */
+!             int32_t i, targetSize = targetLimit - *target;
+              
+              for (i=0; i<targetSize; i++) {
+                  offsets[i] = -1;
+--- 850,856 ----
+          }
+          else {
+              /* there is no implementation that sets offsets, set them all to -1 */
+!             int32_t i, targetSize = (uintptr_t)targetLimit - (uintptr_t)(*target);
+              
+              for (i=0; i<targetSize; i++) {
+                  offsets[i] = -1;
+***************
+*** 875,880 ****
+--- 879,890 ----
+      UConverterToUnicodeArgs args;
+      const UChar *t;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /*
+      * Check parameters in for all conversions
+      */
+***************
+*** 888,894 ****
+      }
+  
+      t = *target;
+!     if (targetLimit < t || sourceLimit < *source) {
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 898,904 ----
+      }
+  
+      t = *target;
+!     if ((uintptr_t)targetLimit < (uintptr_t)t || sourceLimit < *source) {
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 898,905 ****
+      * because some functions use the size rather than comparing pointers.
+      * size_t is guaranteed to be unsigned.
+      */
+!     if((size_t)(targetLimit - t) > (size_t)0x3fffffff && targetLimit > t) {
+!         targetLimit = t + 0x3fffffff;
+      }
+  
+      /*
+--- 908,915 ----
+      * because some functions use the size rather than comparing pointers.
+      * size_t is guaranteed to be unsigned.
+      */
+!     if((((uintptr_t)targetLimit - (uintptr_t)t)/sizeof(UChar)) > (uintptr_t)0x3fffffff && (uintptr_t)targetLimit > (uintptr_t)t) {
+!         targetLimit = (char*)((uintptr_t)t + ((uintptr_t)0x3fffffff)*sizeof(UChar));
+      }
+  
+      /*
+***************
+*** 913,919 ****
+          ucnv_flushInternalUnicodeBuffer (_this, 
+                  (UChar *)t,
+                  &myTargetIndex,
+!                 targetLimit - *target,
+                  offsets?&offsets:NULL,
+                  err);
+          *target += myTargetIndex;
+--- 923,929 ----
+          ucnv_flushInternalUnicodeBuffer (_this, 
+                  (UChar *)t,
+                  &myTargetIndex,
+!                 ((uintptr_t)targetLimit - (uintptr_t)(*target))/sizeof(UChar),
+                  offsets?&offsets:NULL,
+                  err);
+          *target += myTargetIndex;
+***************
+*** 942,948 ****
+              return;
+          } else {
+              /* there is no implementation that sets offsets, set them all to -1 */
+!             int32_t i, targetSize = targetLimit - *target;
+              
+              for (i=0; i<targetSize; i++) {
+                  offsets[i] = -1;
+--- 952,958 ----
+              return;
+          } else {
+              /* there is no implementation that sets offsets, set them all to -1 */
+!             int32_t i, targetSize = ((uintptr_t)targetLimit - (uintptr_t)(*target))/sizeof(UChar);
+              
+              for (i=0; i<targetSize; i++) {
+                  offsets[i] = -1;
+*** build/icu/source/common/ucnvhz.c	2003-05-13 23:05:06.000000000 +0200
+--- misc/build/icu/source/common/ucnvhz.c	2005-12-23 15:22:31.000000000 +0100
+***************
+*** 151,165 ****
+      UChar32 targetUniChar = 0x0000;
+      UChar mySourceChar = 0x0000;
+      UConverterDataHZ* myData=(UConverterDataHZ*)(args->converter->extraInfo);
+         
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+      
+      while(mySource< args->sourceLimit){
+          
+!         if(myTarget < args->targetLimit){
+              
+              mySourceChar= (unsigned char) *mySource++;
+  
+--- 151,171 ----
+      UChar32 targetUniChar = 0x0000;
+      UChar mySourceChar = 0x0000;
+      UConverterDataHZ* myData=(UConverterDataHZ*)(args->converter->extraInfo);
++ 
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+         
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+      
+      while(mySource< args->sourceLimit){
+          
+!         if((uintptr_t)myTarget < (uintptr_t)(args->targetLimit)){
+              
+              mySourceChar= (unsigned char) *mySource++;
+  
+***************
+*** 351,357 ****
+      int32_t* offsets = args->offsets;
+      int32_t mySourceIndex = 0;
+      int32_t myTargetIndex = 0;
+!     int32_t targetLength = (int32_t)(args->targetLimit - args->target);
+      int32_t mySourceLength = (int32_t)(args->sourceLimit - args->source);
+      int32_t length=0;
+      uint32_t targetUniChar = 0x0000;
+--- 357,363 ----
+      int32_t* offsets = args->offsets;
+      int32_t mySourceIndex = 0;
+      int32_t myTargetIndex = 0;
+!     int32_t targetLength = (uintptr_t)(args->targetLimit) - (uintptr_t)(args->target);
+      int32_t mySourceLength = (int32_t)(args->sourceLimit - args->source);
+      int32_t length=0;
+      uint32_t targetUniChar = 0x0000;
+***************
+*** 364,370 ****
+      int len =0;
+      const char* escSeq=NULL;
+      
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 370,382 ----
+      int len =0;
+      const char* escSeq=NULL;
+      
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+*** build/icu/source/common/ucnvisci.c	2003-06-13 01:51:18.000000000 +0200
+--- misc/build/icu/source/common/ucnvisci.c	2005-12-23 13:36:49.000000000 +0100
+***************
+*** 759,767 ****
+      { 0xDC , 0x0963 }, 
+  };
+  
+  #define WRITE_TO_TARGET_FROM_U(args,offsets,source,target,targetLimit,targetByteUnit,err){       \
+        /* write the targetUniChar  to target */                                                  \
+!     if(target <targetLimit){                                                                    \
+          if(targetByteUnit <= 0xFF){                                                             \
+              *(target)++ = (uint8_t)(targetByteUnit);                                            \
+              if(offsets){                                                                        \
+--- 759,773 ----
+      { 0xDC , 0x0963 }, 
+  };
+  
++ /*    
++ * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++ * to the same memory object; such poiter oprations are not defined and must be
++ * done using the unsigned integer types
++ */
++ 
+  #define WRITE_TO_TARGET_FROM_U(args,offsets,source,target,targetLimit,targetByteUnit,err){       \
+        /* write the targetUniChar  to target */                                                  \
+!     if((uintptr_t)target < (uintptr_t)targetLimit){                                                                    \
+          if(targetByteUnit <= 0xFF){                                                             \
+              *(target)++ = (uint8_t)(targetByteUnit);                                            \
+              if(offsets){                                                                        \
+***************
+*** 772,778 ****
+              if(offsets){                                                                        \
+                  *(offsets++) = (int32_t)(source - args->source-1);                              \
+              }                                                                                   \
+!             if(target < targetLimit){                                                           \
+                  *(target)++ = (uint8_t)  targetByteUnit;                                        \
+                  if(offsets){                                                                    \
+                      *(offsets++) = (int32_t)(source - args->source-1);                          \
+--- 778,784 ----
+              if(offsets){                                                                        \
+                  *(offsets++) = (int32_t)(source - args->source-1);                              \
+              }                                                                                   \
+!             if((uintptr_t)target < (uintptr_t)targetLimit){                                                           \
+                  *(target)++ = (uint8_t)  targetByteUnit;                                        \
+                  if(offsets){                                                                    \
+                      *(offsets++) = (int32_t)(source - args->source-1);                          \
+***************
+*** 818,824 ****
+      uint16_t range = 0;
+      UBool deltaChanged = FALSE;
+  
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 824,836 ----
+      uint16_t range = 0;
+      UBool deltaChanged = FALSE;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 828,834 ****
+      newDelta=converterData->currentDeltaFromUnicode;
+      range = (uint16_t)(newDelta/DELTA);
+      
+!     if(args->converter->fromUSurrogateLead!=0 && target <targetLimit) {
+          goto getTrail;
+      }
+  
+--- 840,846 ----
+      newDelta=converterData->currentDeltaFromUnicode;
+      range = (uint16_t)(newDelta/DELTA);
+      
+!     if(args->converter->fromUSurrogateLead!=0 && (uintptr_t)target <(uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+  
+***************
+*** 1087,1092 ****
+--- 1099,1110 ----
+      { GURMUKHI,   PNJ_MASK },
+  };
+  
++ /*    
++ * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++ * to the same memory object; such poiter oprations are not defined and must be
++ * done using the unsigned integer types
++ */
++ 
+  #define WRITE_TO_TARGET_TO_U(args,source,target,offsets,offset,targetUniChar,delta, err){\
+      /* add offset to current Indic Block */                                              \
+      if(targetUniChar>ASCII_END &&                                                        \
+***************
+*** 1098,1104 ****
+             targetUniChar+=(uint16_t)(delta);                                             \
+      }                                                                                    \
+      /* now write the targetUniChar */                                                    \
+!     if(target<args->targetLimit){                                                        \
+          *(target)++ = (UChar)targetUniChar;                                              \
+          if(offsets){                                                                     \
+              *(offsets)++ = (int32_t)(offset);                                            \
+--- 1116,1122 ----
+             targetUniChar+=(uint16_t)(delta);                                             \
+      }                                                                                    \
+      /* now write the targetUniChar */                                                    \
+!     if((uintptr_t)target < (uintptr_t)(args->targetLimit)){                                                        \
+          *(target)++ = (UChar)targetUniChar;                                              \
+          if(offsets){                                                                     \
+              *(offsets)++ = (int32_t)(offset);                                            \
+***************
+*** 1158,1163 ****
+--- 1176,1187 ----
+      UChar32* toUnicodeStatus=NULL;
+      UChar* contextCharToUnicode = NULL;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if ((args->converter == NULL) || (target < args->target) || (source < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+***************
+*** 1171,1177 ****
+  
+          targetUniChar = missingCharMarker;
+          
+!         if(target < targetLimit){
+              sourceChar = (unsigned char)*(source)++;
+  
+              /* look at the post-context preform special processing */
+--- 1195,1201 ----
+  
+          targetUniChar = missingCharMarker;
+          
+!         if((uintptr_t)target < (uintptr_t)targetLimit){
+              sourceChar = (unsigned char)*(source)++;
+  
+              /* look at the post-context preform special processing */
+*** build/icu/source/common/ucnvlat1.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnvlat1.c	2005-12-23 13:37:30.000000000 +0100
+***************
+*** 37,46 ****
+  
+      int32_t sourceIndex;
+  
+      /* set up the local pointers */
+      source=(const uint8_t *)pArgs->source;
+      target=pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      sourceIndex=0;
+--- 37,52 ----
+  
+      int32_t sourceIndex;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      source=(const uint8_t *)pArgs->source;
+      target=pArgs->target;
+!     targetCapacity=((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target))/sizeof(UChar);
+      offsets=pArgs->offsets;
+  
+      sourceIndex=0;
+***************
+*** 158,169 ****
+      UConverterCallbackReason reason;
+      int32_t i;
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      if(cnv->sharedData==&_Latin1Data) {
+--- 164,181 ----
+      UConverterCallbackReason reason;
+      int32_t i;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      if(cnv->sharedData==&_Latin1Data) {
+***************
+*** 366,372 ****
+              /* update the source pointer and index */
+              sourceIndex+=length+(pArgs->source-source);
+              source=lastSource=pArgs->source;
+!             targetCapacity=(uint8_t *)pArgs->targetLimit-target;
+              length=sourceLimit-source;
+              if(length<targetCapacity) {
+                  targetCapacity=length;
+--- 378,384 ----
+              /* update the source pointer and index */
+              sourceIndex+=length+(pArgs->source-source);
+              source=lastSource=pArgs->source;
+!             targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)target;
+              length=sourceLimit-source;
+              if(length<targetCapacity) {
+                  targetCapacity=length;
+***************
+*** 394,400 ****
+          }
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && target>=(uint8_t *)pArgs->targetLimit) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 406,412 ----
+          }
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && (uintptr_t)target>=(uintptr_t)(pArgs->targetLimit)) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 486,496 ****
+  
+      int32_t sourceIndex;
+  
+      /* set up the local pointers */
+      source=(const uint8_t *)pArgs->source;
+      sourceLimit=(const uint8_t *)pArgs->sourceLimit;
+      target=pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      /* sourceIndex=-1 if the current character began in the previous buffer */
+--- 498,514 ----
+  
+      int32_t sourceIndex;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      source=(const uint8_t *)pArgs->source;
+      sourceLimit=(const uint8_t *)pArgs->sourceLimit;
+      target=pArgs->target;
+!     targetCapacity=((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target))/sizeof(UChar);
+      offsets=pArgs->offsets;
+  
+      /* sourceIndex=-1 if the current character began in the previous buffer */
+***************
+*** 614,620 ****
+              /* update the source pointer and index */
+              sourceIndex+=1+((const uint8_t *)pArgs->source-source);
+              source=lastSource=(const uint8_t *)pArgs->source;
+!             targetCapacity=pArgs->targetLimit-target;
+              length=sourceLimit-source;
+              if(length<targetCapacity) {
+                  targetCapacity=length;
+--- 632,638 ----
+              /* update the source pointer and index */
+              sourceIndex+=1+((const uint8_t *)pArgs->source-source);
+              source=lastSource=(const uint8_t *)pArgs->source;
+!             targetCapacity=((uintptr_t)(pArgs->targetLimit) - (uintptr_t)target)/sizeof(UChar);
+              length=sourceLimit-source;
+              if(length<targetCapacity) {
+                  targetCapacity=length;
+***************
+*** 641,647 ****
+          }
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && target>=pArgs->targetLimit) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 659,665 ----
+          }
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && (uintptr_t)target >= (uintptr_t)(pArgs->targetLimit)) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+*** build/icu/source/common/ucnv_cb.c	2002-07-09 14:34:36.000000000 +0200
+--- misc/build/icu/source/common/ucnv_cb.c	2005-12-23 17:37:56.000000000 +0100
+***************
+*** 39,45 ****
+      int8_t toerr;
+      int32_t i;
+  
+!     if((args->targetLimit - args->target) >= length) /* If the buffer fits.. */
+      {
+          uprv_memcpy(args->target, source, length);
+          args->target += length;
+--- 39,51 ----
+      int8_t toerr;
+      int32_t i;
+  
+!      /*    
+!      * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!      * to the same memory object; such poiter oprations are not defined and must be
+!      * done using the unsigned integer types
+!      */
+! 
+!     if(((uintptr_t)(args->targetLimit) - (uintptr_t)(args->target)) >= length) /* If the buffer fits.. */
+      {
+          uprv_memcpy(args->target, source, length);
+          args->target += length;
+***************
+*** 53,59 ****
+      }
+      else
+      {
+!         togo = (int32_t)(args->targetLimit - args->target);
+  
+          uprv_memcpy(args->target, source, togo);
+          args->target += togo;
+--- 59,65 ----
+      }
+      else
+      {
+!         togo = (uintptr_t)args->targetLimit - (uintptr_t)(args->target);
+  
+          uprv_memcpy(args->target, source, togo);
+          args->target += togo;
+***************
+*** 102,107 ****
+--- 108,119 ----
+  
+      char *oldTarget;
+  
++      /*    
++      * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++      * to the same memory object; such poiter oprations are not defined and must be
++      * done using the unsigned integer types
++      */
++ 
+      if(U_FAILURE(*err))
+      {
+          return;
+***************
+*** 236,248 ****
+      int8_t toerr;
+      int32_t i;
+  
+      if(U_FAILURE(*err))
+      {
+          return;
+      }
+  
+  
+!     if((args->targetLimit - args->target) >= length) /* If the buffer fits.. */
+      {
+          uprv_memcpy(args->target, source, length * sizeof(args->target[0]) );
+          args->target += length;
+--- 248,266 ----
+      int8_t toerr;
+      int32_t i;
+  
++      /*    
++      * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++      * to the same memory object; such poiter oprations are not defined and must be
++      * done using the unsigned integer types
++      */
++ 
+      if(U_FAILURE(*err))
+      {
+          return;
+      }
+  
+  
+!     if((((uintptr_t)(args->targetLimit) - (uintptr_t)(args->target))/sizeof(UChar)) >= length) /* If the buffer fits.. */
+      {
+          uprv_memcpy(args->target, source, length * sizeof(args->target[0]) );
+          args->target += length;
+***************
+*** 256,262 ****
+      }
+      else
+      {
+!         togo = (int32_t)(args->targetLimit - args->target);
+  
+          uprv_memcpy(args->target, source, togo * sizeof(args->target[0])  );
+          args->target += togo;
+--- 274,280 ----
+      }
+      else
+      {
+!         togo = (int32_t)((uintptr_t)(args->targetLimit) - (uintptr_t)(args->target))/sizeof(UChar);
+  
+          uprv_memcpy(args->target, source, togo * sizeof(args->target[0])  );
+          args->target += togo;
+*** build/icu/source/common/ucnv_lmb.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnv_lmb.c	2005-12-23 13:44:06.000000000 +0100
+***************
+*** 742,747 ****
+--- 742,752 ----
+     UConverterDataLMBCS * extraInfo = (UConverterDataLMBCS *) args->converter->extraInfo;
+     int sourceIndex = 0; 
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+  
+     /* Basic strategy: attempt to fill in local LMBCS 1-char buffer.(LMBCS)
+        If that succeeds, see if it will all fit into the target & copy it over 
+***************
+*** 768,774 ****
+  
+     while (args->source < args->sourceLimit && !U_FAILURE(*err))
+     {
+!       if (args->target >= args->targetLimit)
+        {
+           *err = U_BUFFER_OVERFLOW_ERROR;
+           break;
+--- 773,779 ----
+  
+     while (args->source < args->sourceLimit && !U_FAILURE(*err))
+     {
+!       if ((uintptr_t)(args->target) >= (uintptr_t)(args->targetLimit))
+        {
+           *err = U_BUFFER_OVERFLOW_ERROR;
+           break;
+***************
+*** 900,906 ****
+        /* we have a translation. increment source and write as much as posible to target */
+        args->source++;
+        pLMBCS = LMBCS;
+!       while (args->target < args->targetLimit && bytes_written--)
+        {
+           *(args->target)++ = *pLMBCS++;
+           if (args->offsets)
+--- 905,911 ----
+        /* we have a translation. increment source and write as much as posible to target */
+        args->source++;
+        pLMBCS = LMBCS;
+!       while ((uintptr_t)(args->target) < (uintptr_t)(args->targetLimit) && bytes_written--)
+        {
+           *(args->target)++ = *pLMBCS++;
+           if (args->offsets)
+***************
+*** 1200,1213 ****
+     const char * saveSource = args->source; /* beginning of current code point */
+     const char * pStartLMBCS = args->source;  /* beginning of whole string */
+  
+!    if (args->targetLimit == args->target)         /* error check may belong in common code */
+     {
+        *err = U_BUFFER_OVERFLOW_ERROR;
+        return;
+     }
+     
+     /* Process from source to limit, or until error */
+!    while (!*err && args->sourceLimit > args->source && args->targetLimit > args->target)
+     {
+        saveSource = args->source; /* beginning of current code point */
+  
+--- 1205,1224 ----
+     const char * saveSource = args->source; /* beginning of current code point */
+     const char * pStartLMBCS = args->source;  /* beginning of whole string */
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!    if ((uintptr_t)(args->targetLimit) == (uintptr_t)(args->target))         /* error check may belong in common code */
+     {
+        *err = U_BUFFER_OVERFLOW_ERROR;
+        return;
+     }
+     
+     /* Process from source to limit, or until error */
+!    while (!*err && args->sourceLimit > args->source && (uintptr_t)(args->targetLimit) > (uintptr_t)(args->target))
+     {
+        saveSource = args->source; /* beginning of current code point */
+  
+***************
+*** 1288,1294 ****
+              }
+              uniChar = *pUChar++;
+            }
+!           while(BufferLength-- && args->targetLimit > args->target);
+  
+            if (++BufferLength > 0)
+            {     /* fix up remaining UChars that can't fit in caller's buffer */
+--- 1299,1305 ----
+              }
+              uniChar = *pUChar++;
+            }
+!           while(BufferLength-- && (uintptr_t)(args->targetLimit) > (uintptr_t)(args->target));
+  
+            if (++BufferLength > 0)
+            {     /* fix up remaining UChars that can't fit in caller's buffer */
+***************
+*** 1304,1310 ****
+        }
+     }
+     /* if target ran out before source, return U_BUFFER_OVERFLOW_ERROR */
+!    if (U_SUCCESS(*err) && args->sourceLimit > args->source && args->targetLimit <= args->target)
+     {
+        *err = U_BUFFER_OVERFLOW_ERROR;
+     }
+--- 1315,1321 ----
+        }
+     }
+     /* if target ran out before source, return U_BUFFER_OVERFLOW_ERROR */
+!    if (U_SUCCESS(*err) && args->sourceLimit > args->source && (uintptr_t)(args->targetLimit) <= (uintptr_t)(args->target))
+     {
+        *err = U_BUFFER_OVERFLOW_ERROR;
+     }
+*** build/icu/source/common/ucnvmbcs.c	2003-05-10 00:52:04.000000000 +0200
+--- misc/build/icu/source/common/ucnvmbcs.c	2005-12-23 15:13:43.000000000 +0100
+***************
+*** 888,893 ****
+--- 888,899 ----
+      uint8_t action;
+      UConverterCallbackReason reason;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* use optimized function if possible */
+      cnv=pArgs->converter;
+      if(cnv->sharedData->table->mbcs.countStates==1) {
+***************
+*** 933,939 ****
+           * Therefore, those situations also test for overflows and will
+           * then break the loop, too.
+           */
+!         if(target<targetLimit) {
+              ++nextSourceIndex;
+              entry=stateTable[state][bytes[byteIndex++]=*source++];
+              if(MBCS_ENTRY_IS_TRANSITION(entry)) {
+--- 939,945 ----
+           * Therefore, those situations also test for overflows and will
+           * then break the loop, too.
+           */
+!         if((uintptr_t)target<(uintptr_t)targetLimit) {
+              ++nextSourceIndex;
+              entry=stateTable[state][bytes[byteIndex++]=*source++];
+              if(MBCS_ENTRY_IS_TRANSITION(entry)) {
+***************
+*** 993,999 ****
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex;
+                          }
+!                         if(target<targetLimit) {
+                              *target++=unicodeCodeUnits[offset];
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+--- 999,1005 ----
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex;
+                          }
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=unicodeCodeUnits[offset];
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+***************
+*** 1030,1036 ****
+                          *offsets++=sourceIndex;
+                      }
+                      c=(UChar)(0xdc00|(UChar)(entry&0x3ff));
+!                     if(target<targetLimit) {
+                          *target++=c;
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex;
+--- 1036,1042 ----
+                          *offsets++=sourceIndex;
+                      }
+                      c=(UChar)(0xdc00|(UChar)(entry&0x3ff));
+!                     if((uintptr_t)target<(uintptr_t)targetLimit) {
+                          *target++=c;
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex;
+***************
+*** 1192,1197 ****
+--- 1198,1209 ----
+      uint8_t action;
+      UConverterCallbackReason reason;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=(const uint8_t *)pArgs->source;
+***************
+*** 1220,1226 ****
+           * Therefore, those situations also test for overflows and will
+           * then break the loop, too.
+           */
+!         if(target<targetLimit) {
+              ++nextSourceIndex;
+              entry=stateTable[0][*source++];
+              /* MBCS_ENTRY_IS_FINAL(entry) */
+--- 1232,1238 ----
+           * Therefore, those situations also test for overflows and will
+           * then break the loop, too.
+           */
+!         if((uintptr_t)target<(uintptr_t)targetLimit) {
+              ++nextSourceIndex;
+              entry=stateTable[0][*source++];
+              /* MBCS_ENTRY_IS_FINAL(entry) */
+***************
+*** 1252,1258 ****
+                      *offsets++=sourceIndex;
+                  }
+                  c=(UChar)(0xdc00|(UChar)(entry&0x3ff));
+!                 if(target<targetLimit) {
+                      *target++=c;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+--- 1264,1270 ----
+                      *offsets++=sourceIndex;
+                  }
+                  c=(UChar)(0xdc00|(UChar)(entry&0x3ff));
+!                 if((uintptr_t)target<(uintptr_t)targetLimit) {
+                      *target++=c;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+***************
+*** 1373,1384 ****
+      uint8_t action;
+      UConverterCallbackReason reason;
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=(const uint8_t *)pArgs->source;
+      sourceLimit=(const uint8_t *)pArgs->sourceLimit;
+      target=pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      if((cnv->options&UCNV_OPTION_SWAP_LFNL)!=0) {
+--- 1385,1402 ----
+      uint8_t action;
+      UConverterCallbackReason reason;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=(const uint8_t *)pArgs->source;
+      sourceLimit=(const uint8_t *)pArgs->sourceLimit;
+      target=pArgs->target;
+!     targetCapacity=((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target))/sizeof(UChar);
+      offsets=pArgs->offsets;
+  
+      if((cnv->options&UCNV_OPTION_SWAP_LFNL)!=0) {
+***************
+*** 1546,1552 ****
+          /* update the source pointer and index */
+          sourceIndex+=1+((const uint8_t *)pArgs->source-source);
+          source=lastSource=(const uint8_t *)pArgs->source;
+!         targetCapacity=pArgs->targetLimit-target;
+          length=sourceLimit-source;
+          if(length<targetCapacity) {
+              targetCapacity=length;
+--- 1564,1570 ----
+          /* update the source pointer and index */
+          sourceIndex+=1+((const uint8_t *)pArgs->source-source);
+          source=lastSource=(const uint8_t *)pArgs->source;
+!         targetCapacity=((uintptr_t)(pArgs->targetLimit) - (uintptr_t)target)/sizeof(UChar);
+          length=sourceLimit-source;
+          if(length<targetCapacity) {
+              targetCapacity=length;
+***************
+*** 1573,1579 ****
+  #endif
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && target>=pArgs->targetLimit) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 1591,1597 ----
+  #endif
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && (uintptr_t)target >= (uintptr_t)(pArgs->targetLimit)) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 2179,2185 ****
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+--- 2197,2203 ----
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+***************
+*** 2581,2587 ****
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uint8_t *)pArgs->targetLimit-target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+--- 2599,2605 ----
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+***************
+*** 2680,2690 ****
+      cnv=pArgs->converter;
+      unicodeMask=cnv->sharedData->table->mbcs.unicodeMask;
+  
+      /* set up the local pointers */
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+--- 2698,2714 ----
+      cnv=pArgs->converter;
+      unicodeMask=cnv->sharedData->table->mbcs.unicodeMask;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+***************
+*** 2862,2868 ****
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uint8_t *)pArgs->targetLimit-target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+--- 2886,2892 ----
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+***************
+*** 2933,2944 ****
+      uint16_t value, minValue;
+      UBool hasSupplementary;
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+--- 2957,2974 ----
+      uint16_t value, minValue;
+      UBool hasSupplementary;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+***************
+*** 3076,3082 ****
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uint8_t *)pArgs->targetLimit-target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+--- 3106,3112 ----
+              /* update the source pointer and index */
+              sourceIndex=nextSourceIndex+(pArgs->source-source);
+              source=pArgs->source;
+!             targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)target;
+  
+              /*
+               * If the callback overflowed the target, then we need to
+***************
+*** 3149,3160 ****
+      UConverterCallbackReason reason;
+      uint16_t value, minValue;
+  
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=pArgs->targetLimit-pArgs->target;
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+--- 3179,3196 ----
+      UConverterCallbackReason reason;
+      uint16_t value, minValue;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      offsets=pArgs->offsets;
+  
+      table=cnv->sharedData->table->mbcs.fromUnicodeTable;
+***************
+*** 3347,3353 ****
+          /* update the source pointer and index */
+          sourceIndex+=length+(pArgs->source-source);
+          source=lastSource=pArgs->source;
+!         targetCapacity=(uint8_t *)pArgs->targetLimit-target;
+          length=sourceLimit-source;
+          if(length<targetCapacity) {
+              targetCapacity=length;
+--- 3383,3389 ----
+          /* update the source pointer and index */
+          sourceIndex+=length+(pArgs->source-source);
+          source=lastSource=pArgs->source;
+!         targetCapacity=(uintptr_t)(pArgs->targetLimit) - (uintptr_t)target;
+          length=sourceLimit-source;
+          if(length<targetCapacity) {
+              targetCapacity=length;
+***************
+*** 3375,3381 ****
+  #endif
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && target>=(uint8_t *)pArgs->targetLimit) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 3411,3417 ----
+  #endif
+      }
+  
+!     if(U_SUCCESS(*pErrorCode) && source<sourceLimit && (uintptr_t)target >= (uintptr_t)(pArgs->targetLimit)) {
+          /* target is full */
+          *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+      }
+*** build/icu/source/common/ucnvscsu.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnvscsu.c	2005-12-23 13:43:09.000000000 +0100
+***************
+*** 235,240 ****
+--- 235,246 ----
+  
+      uint8_t b;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      scsu=(SCSUData *)cnv->extraInfo;
+***************
+*** 281,287 ****
+          /* fast path for single-byte mode */
+          if(state==readCommand) {
+  fastSingle:
+!             while(source<sourceLimit && target<targetLimit && (b=*source)>=0x20) {
+                  ++source;
+                  ++nextSourceIndex;
+                  if(b<=0x7f) {
+--- 287,293 ----
+          /* fast path for single-byte mode */
+          if(state==readCommand) {
+  fastSingle:
+!             while(source<sourceLimit && (uintptr_t)target<(uintptr_t)targetLimit && (b=*source)>=0x20) {
+                  ++source;
+                  ++nextSourceIndex;
+                  if(b<=0x7f) {
+***************
+*** 301,307 ****
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if(target<targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+--- 307,313 ----
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+***************
+*** 326,332 ****
+          /* normal state machine for single-byte mode, minus handling for what fastSingle covers */
+  singleByteMode:
+          while(source<sourceLimit) {
+!             if(target>=targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+--- 332,338 ----
+          /* normal state machine for single-byte mode, minus handling for what fastSingle covers */
+  singleByteMode:
+          while(source<sourceLimit) {
+!             if((uintptr_t)target>=(uintptr_t)targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+***************
+*** 402,408 ****
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if(target<targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+--- 408,414 ----
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+***************
+*** 462,468 ****
+          /* fast path for Unicode mode */
+          if(state==readCommand) {
+  fastUnicode:
+!             while(source+1<sourceLimit && target<targetLimit && (uint8_t)((b=*source)-UC0)>(Urs-UC0)) {
+                  *target++=(UChar)((b<<8)|source[1]);
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex;
+--- 468,474 ----
+          /* fast path for Unicode mode */
+          if(state==readCommand) {
+  fastUnicode:
+!             while(source+1<sourceLimit && (uintptr_t)target<(uintptr_t)targetLimit && (uint8_t)((b=*source)-UC0)>(Urs-UC0)) {
+                  *target++=(UChar)((b<<8)|source[1]);
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex;
+***************
+*** 476,482 ****
+          /* normal state machine for Unicode mode */
+  /* unicodeByteMode: */
+          while(source<sourceLimit) {
+!             if(target>=targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+--- 482,488 ----
+          /* normal state machine for Unicode mode */
+  /* unicodeByteMode: */
+          while(source<sourceLimit) {
+!             if((uintptr_t)target>=(uintptr_t)targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+***************
+*** 626,631 ****
+--- 632,643 ----
+  
+      uint8_t b;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      scsu=(SCSUData *)cnv->extraInfo;
+***************
+*** 667,673 ****
+          /* fast path for single-byte mode */
+          if(state==readCommand) {
+  fastSingle:
+!             while(source<sourceLimit && target<targetLimit && (b=*source)>=0x20) {
+                  ++source;
+                  if(b<=0x7f) {
+                      /* write US-ASCII graphic character or DEL */
+--- 679,685 ----
+          /* fast path for single-byte mode */
+          if(state==readCommand) {
+  fastSingle:
+!             while(source<sourceLimit && (uintptr_t)target<(uintptr_t)targetLimit && (b=*source)>=0x20) {
+                  ++source;
+                  if(b<=0x7f) {
+                      /* write US-ASCII graphic character or DEL */
+***************
+*** 680,686 ****
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if(target<targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                          } else {
+                              /* target overflow */
+--- 692,698 ----
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                          } else {
+                              /* target overflow */
+***************
+*** 697,703 ****
+          /* normal state machine for single-byte mode, minus handling for what fastSingle covers */
+  singleByteMode:
+          while(source<sourceLimit) {
+!             if(target>=targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+--- 709,715 ----
+          /* normal state machine for single-byte mode, minus handling for what fastSingle covers */
+  singleByteMode:
+          while(source<sourceLimit) {
+!             if((uintptr_t)target>=(uintptr_t)targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+***************
+*** 756,762 ****
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if(target<targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                          } else {
+                              /* target overflow */
+--- 768,774 ----
+                      } else {
+                          /* output surrogate pair */
+                          *target++=(UChar)(0xd7c0+(c>>10));
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=(UChar)(0xdc00|(c&0x3ff));
+                          } else {
+                              /* target overflow */
+***************
+*** 806,812 ****
+          /* fast path for Unicode mode */
+          if(state==readCommand) {
+  fastUnicode:
+!             while(source+1<sourceLimit && target<targetLimit && (uint8_t)((b=*source)-UC0)>(Urs-UC0)) {
+                  *target++=(UChar)((b<<8)|source[1]);
+                  source+=2;
+              }
+--- 818,824 ----
+          /* fast path for Unicode mode */
+          if(state==readCommand) {
+  fastUnicode:
+!             while(source+1<sourceLimit && (uintptr_t)target<(uintptr_t)targetLimit && (uint8_t)((b=*source)-UC0)>(Urs-UC0)) {
+                  *target++=(UChar)((b<<8)|source[1]);
+                  source+=2;
+              }
+***************
+*** 815,821 ****
+          /* normal state machine for Unicode mode */
+  /* unicodeByteMode: */
+          while(source<sourceLimit) {
+!             if(target>=targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+--- 827,833 ----
+          /* normal state machine for Unicode mode */
+  /* unicodeByteMode: */
+          while(source<sourceLimit) {
+!             if((uintptr_t)target>=(uintptr_t)targetLimit) {
+                  /* target is full */
+                  *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+                  break;
+***************
+*** 1112,1118 ****
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(int32_t)(pArgs->targetLimit-pArgs->target);
+      offsets=pArgs->offsets;
+  
+      /* get the state machine state */
+--- 1124,1130 ----
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(int32_t)((uintptr_t)(pArgs->targetLimit)-(uintptr_t)(pArgs->target));
+      offsets=pArgs->offsets;
+  
+      /* get the state machine state */
+***************
+*** 1600,1606 ****
+      /* update the source pointer and index */
+      sourceIndex=(int32_t)(nextSourceIndex+(pArgs->source-source));
+      source=pArgs->source;
+!     targetCapacity=(int32_t)((uint8_t *)pArgs->targetLimit-target);
+  
+      /*
+       * If the callback overflowed the target, then we need to
+--- 1612,1618 ----
+      /* update the source pointer and index */
+      sourceIndex=(int32_t)(nextSourceIndex+(pArgs->source-source));
+      source=pArgs->source;
+!     targetCapacity=(int32_t)((uintptr_t)(pArgs->targetLimit) - (uintptr_t)target);
+  
+      /*
+       * If the callback overflowed the target, then we need to
+***************
+*** 1652,1657 ****
+--- 1664,1675 ----
+      int code;
+      int8_t window;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+      scsu=(SCSUData *)cnv->extraInfo;
+***************
+*** 1660,1666 ****
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(int32_t)(pArgs->targetLimit-pArgs->target);
+  
+      /* get the state machine state */
+      isSingleByteMode=scsu->fromUIsSingleByteMode;
+--- 1678,1684 ----
+      source=pArgs->source;
+      sourceLimit=pArgs->sourceLimit;
+      target=(uint8_t *)pArgs->target;
+!     targetCapacity=(int32_t)((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target));
+  
+      /* get the state machine state */
+      isSingleByteMode=scsu->fromUIsSingleByteMode;
+***************
+*** 2081,2087 ****
+      target=(uint8_t *)pArgs->target;
+  
+      source=pArgs->source;
+!     targetCapacity=(int32_t)((uint8_t *)pArgs->targetLimit-target);
+  
+      /*
+       * If the callback overflowed the target, then we need to
+--- 2099,2105 ----
+      target=(uint8_t *)pArgs->target;
+  
+      source=pArgs->source;
+!     targetCapacity=(int32_t)((uintptr_t)(pArgs->targetLimit) - (uintptr_t)target);
+  
+      /*
+       * If the callback overflowed the target, then we need to
+*** build/icu/source/common/ucnv_u16.c	2003-04-21 04:06:04.000000000 +0200
+--- misc/build/icu/source/common/ucnv_u16.c	2005-12-23 13:59:47.000000000 +0100
+***************
+*** 30,40 ****
+      const uint8_t *source   = (const uint8_t *)pArgs->source;
+      UChar *target           = pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = pArgs->targetLimit - pArgs->target;
+      int32_t length          = (const uint8_t *)pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
+      if(length <= 0 && cnv->toUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+--- 30,46 ----
+      const uint8_t *source   = (const uint8_t *)pArgs->source;
+      UChar *target           = pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = ((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target))/sizeof(UChar);
+      int32_t length          = (const uint8_t *)pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if(length <= 0 && cnv->toUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+***************
+*** 113,123 ****
+      const UChar *source     = pArgs->source;
+      uint8_t *target         = (uint8_t *)pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = pArgs->targetLimit - pArgs->target;
+      int32_t length          = pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
+      if(length <= 0 && cnv->fromUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+--- 119,135 ----
+      const UChar *source     = pArgs->source;
+      uint8_t *target         = (uint8_t *)pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = (uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      int32_t length          = pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if(length <= 0 && cnv->fromUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+***************
+*** 194,204 ****
+      UChar *target           = pArgs->target;
+      uint8_t *target8        = (uint8_t *)target; /* byte pointer to the target */
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = pArgs->targetLimit - pArgs->target;
+      int32_t length          = (const uint8_t *)pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
+      if(length <= 0 && cnv->toUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+--- 206,222 ----
+      UChar *target           = pArgs->target;
+      uint8_t *target8        = (uint8_t *)target; /* byte pointer to the target */
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = ((uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target))/sizeof(UChar);
+      int32_t length          = (const uint8_t *)pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex     = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if(length <= 0 && cnv->toUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+***************
+*** 286,296 ****
+      const uint8_t *source8  = (const uint8_t *)source; /* byte pointer to the source */
+      uint8_t *target         = (uint8_t *)pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = pArgs->targetLimit - pArgs->target;
+      int32_t length          = pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex = 0;
+  
+      if(length <= 0 && cnv->fromUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+--- 304,320 ----
+      const uint8_t *source8  = (const uint8_t *)source; /* byte pointer to the source */
+      uint8_t *target         = (uint8_t *)pArgs->target;
+      int32_t *offsets        = pArgs->offsets;
+!     int32_t targetCapacity  = (uintptr_t)(pArgs->targetLimit) - (uintptr_t)(pArgs->target);
+      int32_t length          = pArgs->sourceLimit - source;
+      int32_t count;
+      int32_t sourceIndex = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if(length <= 0 && cnv->fromUnicodeStatus == 0) {
+          /* no input, nothing to do */
+          return;
+*** build/icu/source/common/ucnv_u32.c	2003-04-21 04:06:04.000000000 +0200
+--- misc/build/icu/source/common/ucnv_u32.c	2005-12-23 13:48:01.000000000 +0100
+***************
+*** 104,111 ****
+      unsigned char *toUBytes = args->converter->toUBytes;
+      uint32_t ch, i;
+  
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+--- 104,117 ----
+      unsigned char *toUBytes = args->converter->toUBytes;
+      uint32_t ch, i;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+***************
+*** 114,120 ****
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          i = 0;
+          ch = 0;
+--- 120,126 ----
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = 0;
+          ch = 0;
+***************
+*** 160,166 ****
+                  ch -= HALF_BASE;
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                  }
+--- 166,172 ----
+                  ch -= HALF_BASE;
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                  }
+***************
+*** 191,197 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+--- 197,203 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+***************
+*** 214,220 ****
+      uint32_t ch, i;
+      int32_t offsetNum = 0;
+  
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+--- 220,232 ----
+      uint32_t ch, i;
+      int32_t offsetNum = 0;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+***************
+*** 223,229 ****
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          i = 0;
+          ch = 0;
+--- 235,241 ----
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = 0;
+          ch = 0;
+***************
+*** 271,277 ****
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  *myOffsets++ = offsetNum;
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                      *(myOffsets++) = offsetNum;
+--- 283,289 ----
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  *myOffsets++ = offsetNum;
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                      *(myOffsets++) = offsetNum;
+***************
+*** 306,312 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+--- 318,324 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+***************
+*** 331,336 ****
+--- 343,354 ----
+  
+      temp[0] = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if (args->converter->fromUnicodeStatus)
+      {
+          ch = args->converter->fromUnicodeStatus;
+***************
+*** 338,344 ****
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 356,362 ----
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 369,375 ****
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if (myTarget < targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+              }
+--- 387,393 ----
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+              }
+***************
+*** 381,387 ****
+          }
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 399,405 ----
+          }
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 406,411 ****
+--- 424,435 ----
+  
+      temp[0] = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if (args->converter->fromUnicodeStatus)
+      {
+          ch = args->converter->fromUnicodeStatus;
+***************
+*** 413,419 ****
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 437,443 ----
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 444,450 ****
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if (myTarget < targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+                  *(myOffsets++) = offsetNum;
+--- 468,474 ----
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+                  *(myOffsets++) = offsetNum;
+***************
+*** 458,464 ****
+          offsetNum++;
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 482,488 ----
+          offsetNum++;
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 478,483 ****
+--- 502,513 ----
+      UChar32 myUChar;
+      int32_t length;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      while (args->source < args->sourceLimit)
+      {
+          if (args->source + 4 > args->sourceLimit) 
+***************
+*** 588,595 ****
+      unsigned char *toUBytes = args->converter->toUBytes;
+      uint32_t ch, i;
+  
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+--- 618,631 ----
+      unsigned char *toUBytes = args->converter->toUBytes;
+      uint32_t ch, i;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+***************
+*** 599,605 ****
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          i = 0;
+          ch = 0;
+--- 635,641 ----
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = 0;
+          ch = 0;
+***************
+*** 645,651 ****
+                  ch -= HALF_BASE;
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                  }
+--- 681,687 ----
+                  ch -= HALF_BASE;
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                  }
+***************
+*** 676,682 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+--- 712,718 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+***************
+*** 699,706 ****
+      uint32_t ch, i;
+      int32_t offsetNum = 0;
+  
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+--- 735,748 ----
+      uint32_t ch, i;
+      int32_t offsetNum = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* UTF-8 returns here for only non-offset, this needs to change.*/
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = args->converter->toULength;       /* restore # of bytes consumed */
+  
+***************
+*** 710,716 ****
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          i = 0;
+          ch = 0;
+--- 752,758 ----
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          i = 0;
+          ch = 0;
+***************
+*** 758,764 ****
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  *(myOffsets++) = offsetNum;
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                      *(myOffsets++) = offsetNum;
+--- 800,806 ----
+                  *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                  *(myOffsets++) = offsetNum;
+                  ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myTarget++) = (UChar)ch;
+                      *(myOffsets++) = offsetNum;
+***************
+*** 793,799 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+--- 835,841 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+***************
+*** 818,823 ****
+--- 860,871 ----
+  
+      temp[3] = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if (args->converter->fromUnicodeStatus)
+      {
+          ch = args->converter->fromUnicodeStatus;
+***************
+*** 825,831 ****
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 873,879 ----
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 856,862 ****
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if (myTarget < targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+              }
+--- 904,910 ----
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+              }
+***************
+*** 868,874 ****
+          }
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 916,922 ----
+          }
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 893,898 ****
+--- 941,952 ----
+  
+      temp[3] = 0;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      if (args->converter->fromUnicodeStatus)
+      {
+          ch = args->converter->fromUnicodeStatus;
+***************
+*** 900,906 ****
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 954,960 ----
+          goto lowsurogate;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 931,937 ****
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if (myTarget < targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+                  *(myOffsets++) = offsetNum;
+--- 985,991 ----
+  
+          for (indexToWrite = 0; indexToWrite <= sizeof(uint32_t) - 1; indexToWrite++)
+          {
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myTarget++) = temp[indexToWrite];
+                  *(myOffsets++) = offsetNum;
+***************
+*** 945,951 ****
+          offsetNum++;
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 999,1005 ----
+          offsetNum++;
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 965,970 ****
+--- 1019,1030 ----
+      UChar32 myUChar;
+      int32_t length;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      while (args->source < args->sourceLimit)
+      {
+          if (args->source + 4 > args->sourceLimit) 
+*** build/icu/source/common/ucnv_u7.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnv_u7.c	2005-12-23 14:04:48.000000000 +0100
+***************
+*** 225,230 ****
+--- 225,237 ----
+      int32_t sourceIndex, nextSourceIndex;
+  
+      uint8_t b;
++ 
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+  
+***************
+*** 260,266 ****
+           */
+          byteIndex=0;
+          length=sourceLimit-source;
+!         targetCapacity=targetLimit-target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+--- 267,273 ----
+           */
+          byteIndex=0;
+          length=sourceLimit-source;
+!         targetCapacity=((uintptr_t)targetLimit-(uintptr_t)target)/sizeof(UChar);
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+***************
+*** 289,295 ****
+              }
+              --length;
+          }
+!         if(source<sourceLimit && target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+--- 296,302 ----
+              }
+              --length;
+          }
+!         if(source<sourceLimit && (uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+***************
+*** 306,312 ****
+           * Note that in 2 out of 3 cases, UChars overlap within a base64 byte.
+           */
+          while(source<sourceLimit) {
+!             if(target<targetLimit) {
+                  bytes[byteIndex++]=b=*source++;
+                  ++nextSourceIndex;
+                  if(b>=126) {
+--- 313,319 ----
+           * Note that in 2 out of 3 cases, UChars overlap within a base64 byte.
+           */
+          while(source<sourceLimit) {
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  bytes[byteIndex++]=b=*source++;
+                  ++nextSourceIndex;
+                  if(b>=126) {
+***************
+*** 518,523 ****
+--- 525,536 ----
+      int8_t base64Counter;
+      UBool inDirectMode;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+  
+***************
+*** 543,549 ****
+      if(inDirectMode) {
+  directMode:
+          length=sourceLimit-source;
+!         targetCapacity=targetLimit-target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+--- 556,562 ----
+      if(inDirectMode) {
+  directMode:
+          length=sourceLimit-source;
+!         targetCapacity=(uintptr_t)targetLimit-(uintptr_t)target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+***************
+*** 559,565 ****
+              } else if(c==PLUS) {
+                  /* output +- for + */
+                  *target++=PLUS;
+!                 if(target<targetLimit) {
+                      *target++=MINUS;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+--- 572,578 ----
+              } else if(c==PLUS) {
+                  /* output +- for + */
+                  *target++=PLUS;
+!                 if((uintptr_t)target<(uintptr_t)targetLimit) {
+                      *target++=MINUS;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+***************
+*** 589,602 ****
+              }
+              --length;
+          }
+!         if(source<sourceLimit && target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+      } else {
+  unicodeMode:
+          while(source<sourceLimit) {
+!             if(target<targetLimit) {
+                  c=*source++;
+                  if(c<=127 && encodeDirectly[c]) {
+                      /* encode directly */
+--- 602,615 ----
+              }
+              --length;
+          }
+!         if(source<sourceLimit && (uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+      } else {
+  unicodeMode:
+          while(source<sourceLimit) {
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  c=*source++;
+                  if(c<=127 && encodeDirectly[c]) {
+                      /* encode directly */
+***************
+*** 615,621 ****
+                      }
+                      if(fromBase64[c]!=-1) {
+                          /* need to terminate with a minus */
+!                         if(target<targetLimit) {
+                              *target++=MINUS;
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex-1;
+--- 628,634 ----
+                      }
+                      if(fromBase64[c]!=-1) {
+                          /* need to terminate with a minus */
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=MINUS;
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex-1;
+***************
+*** 641,647 ****
+                      switch(base64Counter) {
+                      case 0:
+                          *target++=toBase64[c>>10];
+!                         if(target<targetLimit) {
+                              *target++=toBase64[(c>>4)&0x3f];
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+--- 654,660 ----
+                      switch(base64Counter) {
+                      case 0:
+                          *target++=toBase64[c>>10];
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=toBase64[(c>>4)&0x3f];
+                              if(offsets!=NULL) {
+                                  *offsets++=sourceIndex;
+***************
+*** 660,668 ****
+                          break;
+                      case 1:
+                          *target++=toBase64[bits|(c>>14)];
+!                         if(target<targetLimit) {
+                              *target++=toBase64[(c>>8)&0x3f];
+!                             if(target<targetLimit) {
+                                  *target++=toBase64[(c>>2)&0x3f];
+                                  if(offsets!=NULL) {
+                                      *offsets++=sourceIndex;
+--- 673,681 ----
+                          break;
+                      case 1:
+                          *target++=toBase64[bits|(c>>14)];
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=toBase64[(c>>8)&0x3f];
+!                             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                                  *target++=toBase64[(c>>2)&0x3f];
+                                  if(offsets!=NULL) {
+                                      *offsets++=sourceIndex;
+***************
+*** 692,700 ****
+                          break;
+                      case 2:
+                          *target++=toBase64[bits|(c>>12)];
+!                         if(target<targetLimit) {
+                              *target++=toBase64[(c>>6)&0x3f];
+!                             if(target<targetLimit) {
+                                  *target++=toBase64[c&0x3f];
+                                  if(offsets!=NULL) {
+                                      *offsets++=sourceIndex;
+--- 705,713 ----
+                          break;
+                      case 2:
+                          *target++=toBase64[bits|(c>>12)];
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              *target++=toBase64[(c>>6)&0x3f];
+!                             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                                  *target++=toBase64[c&0x3f];
+                                  if(offsets!=NULL) {
+                                      *offsets++=sourceIndex;
+***************
+*** 738,744 ****
+      if(pArgs->flush && source>=sourceLimit) {
+          /* flush remaining bits to the target */
+          if(!inDirectMode && base64Counter!=0) {
+!             if(target<targetLimit) {
+                  *target++=toBase64[bits];
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex-1;
+--- 751,757 ----
+      if(pArgs->flush && source>=sourceLimit) {
+          /* flush remaining bits to the target */
+          if(!inDirectMode && base64Counter!=0) {
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  *target++=toBase64[bits];
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex-1;
+***************
+*** 945,950 ****
+--- 958,969 ----
+      UChar c;
+      uint8_t b;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+  
+***************
+*** 979,985 ****
+           */
+          byteIndex=0;
+          length=sourceLimit-source;
+!         targetCapacity=targetLimit-target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+--- 998,1004 ----
+           */
+          byteIndex=0;
+          length=sourceLimit-source;
+!         targetCapacity=((uintptr_t)targetLimit-(uintptr_t)target)/sizeof(UChar);
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+***************
+*** 1008,1014 ****
+              }
+              --length;
+          }
+!         if(source<sourceLimit && target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+--- 1027,1033 ----
+              }
+              --length;
+          }
+!         if(source<sourceLimit && (uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+***************
+*** 1026,1032 ****
+           * Note that in 2 out of 3 cases, UChars overlap within a base64 byte.
+           */
+          while(source<sourceLimit) {
+!             if(target<targetLimit) {
+                  bytes[byteIndex++]=b=*source++;
+                  ++nextSourceIndex;
+                  if(b>0x7e) {
+--- 1045,1051 ----
+           * Note that in 2 out of 3 cases, UChars overlap within a base64 byte.
+           */
+          while(source<sourceLimit) {
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  bytes[byteIndex++]=b=*source++;
+                  ++nextSourceIndex;
+                  if(b>0x7e) {
+***************
+*** 1241,1246 ****
+--- 1260,1271 ----
+      int8_t base64Counter;
+      UBool inDirectMode;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* set up the local pointers */
+      cnv=pArgs->converter;
+  
+***************
+*** 1265,1271 ****
+      if(inDirectMode) {
+  directMode:
+          length=sourceLimit-source;
+!         targetCapacity=targetLimit-target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+--- 1290,1296 ----
+      if(inDirectMode) {
+  directMode:
+          length=sourceLimit-source;
+!         targetCapacity=(uintptr_t)targetLimit-(uintptr_t)target;
+          if(length>targetCapacity) {
+              length=targetCapacity;
+          }
+***************
+*** 1281,1287 ****
+              } else if(c==AMPERSAND) {
+                  /* output &- for & */
+                  *target++=AMPERSAND;
+!                 if(target<targetLimit) {
+                      *target++=MINUS;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+--- 1306,1312 ----
+              } else if(c==AMPERSAND) {
+                  /* output &- for & */
+                  *target++=AMPERSAND;
+!                 if((uintptr_t)target<(uintptr_t)targetLimit) {
+                      *target++=MINUS;
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex;
+***************
+*** 1311,1324 ****
+              }
+              --length;
+          }
+!         if(source<sourceLimit && target>=targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+      } else {
+  unicodeMode:
+          while(source<sourceLimit) {
+!             if(target<targetLimit) {
+                  c=*source++;
+                  if(isLegalIMAP(c)) {
+                      /* encode directly */
+--- 1336,1349 ----
+              }
+              --length;
+          }
+!         if(source<sourceLimit && (uintptr_t)target>=(uintptr_t)targetLimit) {
+              /* target is full */
+              *pErrorCode=U_BUFFER_OVERFLOW_ERROR;
+          }
+      } else {
+  unicodeMode:
+          while(source<sourceLimit) {
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  c=*source++;
+                  if(isLegalIMAP(c)) {
+                      /* encode directly */
+***************
+*** 1336,1342 ****
+                          }
+                      }
+                      /* need to terminate with a minus */
+!                     if(target<targetLimit) {
+                          *target++=MINUS;
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex-1;
+--- 1361,1367 ----
+                          }
+                      }
+                      /* need to terminate with a minus */
+!                     if((uintptr_t)target<(uintptr_t)targetLimit) {
+                          *target++=MINUS;
+                          if(offsets!=NULL) {
+                              *offsets++=sourceIndex-1;
+***************
+*** 1362,1368 ****
+                      case 0:
+                          b=(uint8_t)(c>>10);
+                          *target++=TO_BASE64_IMAP(b);
+!                         if(target<targetLimit) {
+                              b=(uint8_t)((c>>4)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+                              if(offsets!=NULL) {
+--- 1387,1393 ----
+                      case 0:
+                          b=(uint8_t)(c>>10);
+                          *target++=TO_BASE64_IMAP(b);
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              b=(uint8_t)((c>>4)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+                              if(offsets!=NULL) {
+***************
+*** 1384,1393 ****
+                      case 1:
+                          b=(uint8_t)(bits|(c>>14));
+                          *target++=TO_BASE64_IMAP(b);
+!                         if(target<targetLimit) {
+                              b=(uint8_t)((c>>8)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+!                             if(target<targetLimit) {
+                                  b=(uint8_t)((c>>2)&0x3f);
+                                  *target++=TO_BASE64_IMAP(b);
+                                  if(offsets!=NULL) {
+--- 1409,1418 ----
+                      case 1:
+                          b=(uint8_t)(bits|(c>>14));
+                          *target++=TO_BASE64_IMAP(b);
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              b=(uint8_t)((c>>8)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+!                             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                                  b=(uint8_t)((c>>2)&0x3f);
+                                  *target++=TO_BASE64_IMAP(b);
+                                  if(offsets!=NULL) {
+***************
+*** 1422,1431 ****
+                      case 2:
+                          b=(uint8_t)(bits|(c>>12));
+                          *target++=TO_BASE64_IMAP(b);
+!                         if(target<targetLimit) {
+                              b=(uint8_t)((c>>6)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+!                             if(target<targetLimit) {
+                                  b=(uint8_t)(c&0x3f);
+                                  *target++=TO_BASE64_IMAP(b);
+                                  if(offsets!=NULL) {
+--- 1447,1456 ----
+                      case 2:
+                          b=(uint8_t)(bits|(c>>12));
+                          *target++=TO_BASE64_IMAP(b);
+!                         if((uintptr_t)target<(uintptr_t)targetLimit) {
+                              b=(uint8_t)((c>>6)&0x3f);
+                              *target++=TO_BASE64_IMAP(b);
+!                             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                                  b=(uint8_t)(c&0x3f);
+                                  *target++=TO_BASE64_IMAP(b);
+                                  if(offsets!=NULL) {
+***************
+*** 1474,1480 ****
+          /* flush remaining bits to the target */
+          if(!inDirectMode) {
+              if(base64Counter!=0) {
+!                 if(target<targetLimit) {
+                      *target++=TO_BASE64_IMAP(bits);
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex-1;
+--- 1499,1505 ----
+          /* flush remaining bits to the target */
+          if(!inDirectMode) {
+              if(base64Counter!=0) {
+!                 if((uintptr_t)target<(uintptr_t)targetLimit) {
+                      *target++=TO_BASE64_IMAP(bits);
+                      if(offsets!=NULL) {
+                          *offsets++=sourceIndex-1;
+***************
+*** 1485,1491 ****
+                  }
+              }
+              /* need to terminate with a minus */
+!             if(target<targetLimit) {
+                  *target++=MINUS;
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex-1;
+--- 1510,1516 ----
+                  }
+              }
+              /* need to terminate with a minus */
+!             if((uintptr_t)target<(uintptr_t)targetLimit) {
+                  *target++=MINUS;
+                  if(offsets!=NULL) {
+                      *offsets++=sourceIndex-1;
+*** build/icu/source/common/ucnv_u8.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnv_u8.c	2005-12-23 13:51:03.000000000 +0100
+***************
+*** 156,165 ****
+      UBool isCESU8 = (UBool)(args->converter->sharedData == &_CESU8Data);
+      uint32_t ch, ch2 = 0;
+      int32_t i, inBytes;
+    
+      /* Restore size of current sequence */
+  start:
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          inBytes = args->converter->mode;            /* restore # of bytes to consume */
+          i = args->converter->toULength;             /* restore # of bytes consumed */
+--- 156,171 ----
+      UBool isCESU8 = (UBool)(args->converter->sharedData == &_CESU8Data);
+      uint32_t ch, ch2 = 0;
+      int32_t i, inBytes;
++ 
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+    
+      /* Restore size of current sequence */
+  start:
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          inBytes = args->converter->mode;            /* restore # of bytes to consume */
+          i = args->converter->toULength;             /* restore # of bytes consumed */
+***************
+*** 170,176 ****
+      }
+  
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+          if (ch < 0x80)        /* Simple case */
+--- 176,182 ----
+      }
+  
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+          if (ch < 0x80)        /* Simple case */
+***************
+*** 247,253 ****
+                      ch -= HALF_BASE;
+                      *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                      ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                     if (myTarget < targetLimit)
+                      {
+                          *(myTarget++) = (UChar)ch;
+                      }
+--- 253,259 ----
+                      ch -= HALF_BASE;
+                      *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                      ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                     if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                      {
+                          *(myTarget++) = (UChar)ch;
+                      }
+***************
+*** 284,290 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+--- 290,296 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+***************
+*** 308,316 ****
+      uint32_t ch, ch2 = 0;
+      int32_t i, inBytes;
+  
+      /* Restore size of current sequence */
+  start:
+!     if (args->converter->toUnicodeStatus && myTarget < targetLimit)
+      {
+          inBytes = args->converter->mode;            /* restore # of bytes to consume */
+          i = args->converter->toULength;             /* restore # of bytes consumed */
+--- 314,328 ----
+      uint32_t ch, ch2 = 0;
+      int32_t i, inBytes;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* Restore size of current sequence */
+  start:
+!     if (args->converter->toUnicodeStatus && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          inBytes = args->converter->mode;            /* restore # of bytes to consume */
+          i = args->converter->toULength;             /* restore # of bytes consumed */
+***************
+*** 320,326 ****
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+          if (ch < 0x80)        /* Simple case */
+--- 332,338 ----
+          goto morebytes;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+          if (ch < 0x80)        /* Simple case */
+***************
+*** 400,406 ****
+                      *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                      *(myOffsets++) = offsetNum;
+                      ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                     if (myTarget < targetLimit)
+                      {
+                          *(myTarget++) = (UChar)ch;
+                          *(myOffsets++) = offsetNum;
+--- 412,418 ----
+                      *(myTarget++) = (UChar) ((ch >> HALF_SHIFT) + SURROGATE_HIGH_START);
+                      *(myOffsets++) = offsetNum;
+                      ch = (ch & HALF_MASK) + SURROGATE_LOW_START;
+!                     if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                      {
+                          *(myTarget++) = (UChar)ch;
+                          *(myOffsets++) = offsetNum;
+***************
+*** 441,447 ****
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {   /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 453,459 ----
+      }
+  
+  donefornow:
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {   /* End of target buffer */
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 464,477 ****
+      int16_t indexToWrite;
+      char temp[4];
+  
+!     if (cnv->fromUSurrogateLead && myTarget < targetLimit)
+      {
+          ch = cnv->fromUSurrogateLead;
+          cnv->fromUSurrogateLead = 0;
+          goto lowsurrogate;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 476,495 ----
+      int16_t indexToWrite;
+      char temp[4];
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if (cnv->fromUSurrogateLead && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = cnv->fromUSurrogateLead;
+          cnv->fromUSurrogateLead = 0;
+          goto lowsurrogate;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 482,488 ****
+          else if (ch < 0x800)  /* Double byte */
+          {
+              *(myTarget++) = (char) ((ch >> 6) | 0xc0);
+!             if (myTarget < targetLimit)
+              {
+                  *(myTarget++) = (char) ((ch & 0x3f) | 0x80);
+              }
+--- 500,506 ----
+          else if (ch < 0x800)  /* Double byte */
+          {
+              *(myTarget++) = (char) ((ch >> 6) | 0xc0);
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myTarget++) = (char) ((ch & 0x3f) | 0x80);
+              }
+***************
+*** 587,593 ****
+  
+              for (; indexToWrite >= 0; indexToWrite--)
+              {
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myTarget++) = temp[indexToWrite];
+                  }
+--- 605,611 ----
+  
+              for (; indexToWrite >= 0; indexToWrite--)
+              {
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myTarget++) = temp[indexToWrite];
+                  }
+***************
+*** 600,606 ****
+          }
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 618,624 ----
+          }
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+***************
+*** 629,635 ****
+      int16_t indexToWrite;
+      char temp[4];
+  
+!     if (cnv->fromUSurrogateLead && myTarget < targetLimit)
+      {
+          ch = cnv->fromUSurrogateLead;
+          cnv->fromUSurrogateLead = 0;
+--- 647,659 ----
+      int16_t indexToWrite;
+      char temp[4];
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if (cnv->fromUSurrogateLead && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = cnv->fromUSurrogateLead;
+          cnv->fromUSurrogateLead = 0;
+***************
+*** 640,646 ****
+          offsetNum = 0;
+      }
+  
+!     while (mySource < sourceLimit && myTarget < targetLimit)
+      {
+          ch = *(mySource++);
+  
+--- 664,670 ----
+          offsetNum = 0;
+      }
+  
+!     while (mySource < sourceLimit && (uintptr_t)myTarget < (uintptr_t)targetLimit)
+      {
+          ch = *(mySource++);
+  
+***************
+*** 653,659 ****
+          {
+              *(myOffsets++) = offsetNum;
+              *(myTarget++) = (char) ((ch >> 6) | 0xc0);
+!             if (myTarget < targetLimit)
+              {
+                  *(myOffsets++) = offsetNum++;
+                  *(myTarget++) = (char) ((ch & 0x3f) | 0x80);
+--- 677,683 ----
+          {
+              *(myOffsets++) = offsetNum;
+              *(myTarget++) = (char) ((ch >> 6) | 0xc0);
+!             if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+              {
+                  *(myOffsets++) = offsetNum++;
+                  *(myTarget++) = (char) ((ch & 0x3f) | 0x80);
+***************
+*** 768,774 ****
+  
+              for (; indexToWrite >= 0; indexToWrite--)
+              {
+!                 if (myTarget < targetLimit)
+                  {
+                      *(myOffsets++) = offsetNum;
+                      *(myTarget++) = temp[indexToWrite];
+--- 792,798 ----
+  
+              for (; indexToWrite >= 0; indexToWrite--)
+              {
+!                 if ((uintptr_t)myTarget < (uintptr_t)targetLimit)
+                  {
+                      *(myOffsets++) = offsetNum;
+                      *(myTarget++) = temp[indexToWrite];
+***************
+*** 783,789 ****
+          }
+      }
+  
+!     if (mySource < sourceLimit && myTarget >= targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+--- 807,813 ----
+          }
+      }
+  
+!     if (mySource < sourceLimit && (uintptr_t)myTarget >= (uintptr_t)targetLimit && U_SUCCESS(*err))
+      {
+          *err = U_BUFFER_OVERFLOW_ERROR;
+      }
+*** build/icu/source/common/ucnv2022.c	2003-06-03 00:19:24.000000000 +0200
+--- misc/build/icu/source/common/ucnv2022.c	2005-12-22 15:55:00.000000000 +0100
+***************
+*** 836,846 ****
+                                 int len, 
+                                 UErrorCode* err)
+  {
+  
+      unsigned char* myTarget = *target;
+      int32_t* myOffsets = *offsets;
+      while(len-->0){
+!         if(myTarget < targetLimit){
+              *(myTarget++) = (unsigned char) *(strToAppend++);
+              if(myOffsets){
+                  *(myOffsets++) = source -  args->source -1;
+--- 836,851 ----
+                                 int len, 
+                                 UErrorCode* err)
+  {
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+  
+      unsigned char* myTarget = *target;
+      int32_t* myOffsets = *offsets;
+      while(len-->0){
+!         if((uintptr_t)myTarget < (uintptr_t)targetLimit){
+              *(myTarget++) = (unsigned char) *(strToAppend++);
+              if(myOffsets){
+                  *(myOffsets++) = source -  args->source -1;
+***************
+*** 1005,1011 ****
+      int plane =0; /*dummy variable*/
+      UConverterDataISO2022* myData;
+  
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 1010,1022 ----
+      int plane =0; /*dummy variable*/
+      UConverterDataISO2022* myData;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 1097,1103 ****
+      int plane =0;/*dummy variable*/
+      UConverterDataISO2022* myData;
+  
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 1108,1120 ----
+      int plane =0;/*dummy variable*/
+      UConverterDataISO2022* myData;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 1539,1547 ****
+      UConverter** currentConverter; 
+      Cnv2022Type* currentType;      
+      UConverter** convArray;        
+      
+      /* arguments check*/
+!     if ((args->converter == NULL) || (targetLimit < target) || (sourceLimit < source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 1556,1570 ----
+      UConverter** currentConverter; 
+      Cnv2022Type* currentType;      
+      UConverter** convArray;        
++ 
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+      
+      /* arguments check*/
+!     if ((args->converter == NULL) || ((uintptr_t)targetLimit < (uintptr_t)target) || (sourceLimit < source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 1557,1563 ****
+      currentType         = &converterData->currentType;
+      
+      /* check if the last codepoint of previous buffer was a lead surrogate*/
+!     if(args->converter->fromUSurrogateLead!=0 && target< targetLimit) {
+          goto getTrail;
+      }
+      
+--- 1580,1586 ----
+      currentType         = &converterData->currentType;
+      
+      /* check if the last codepoint of previous buffer was a lead surrogate*/
+!     if(args->converter->fromUSurrogateLead!=0 && (uintptr_t)target< (uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+      
+***************
+*** 1568,1574 ****
+  
+          targetByteUnit = missingCharMarker;
+  
+!         if(target < targetLimit){
+              sourceChar  = *(source++);
+              if(sourceChar > SPACE) {
+                  do{
+--- 1591,1597 ----
+  
+          targetByteUnit = missingCharMarker;
+  
+!         if((uintptr_t)target < (uintptr_t)targetLimit){
+              sourceChar  = *(source++);
+              if(sourceChar > SPACE) {
+                  do{
+***************
+*** 1667,1673 ****
+                  offset = source - args->source -1;
+                  /* write the targetByteUnit  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( target <targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) = offset;
+--- 1690,1696 ----
+                  offset = source - args->source -1;
+                  /* write the targetByteUnit  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( (uintptr_t)target <(uintptr_t)targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) = offset;
+***************
+*** 1678,1689 ****
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if(target < targetLimit){
+                          *(target++) =(unsigned char) (targetByteUnit>>8);
+                          if(offsets){
+                                *(offsets++) = offset;
+                          }
+!                         if(target < targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit);
+                              if(offsets){
+                                  *(offsets++) = offset;
+--- 1701,1712 ----
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if((uintptr_t)target < (uintptr_t)targetLimit){
+                          *(target++) =(unsigned char) (targetByteUnit>>8);
+                          if(offsets){
+                                *(offsets++) = offset;
+                          }
+!                         if((uintptr_t)target < (uintptr_t)targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit);
+                              if(offsets){
+                                  *(offsets++) = offset;
+***************
+*** 1875,1881 ****
+  
+          targetUniChar = missingCharMarker;
+  
+!         if(myTarget < args->targetLimit){
+  
+              mySourceChar= (unsigned char) *mySource++;
+              
+--- 1898,1904 ----
+  
+          targetUniChar = missingCharMarker;
+  
+!         if((uintptr_t)myTarget < (uintptr_t)(args->targetLimit)){
+  
+              mySourceChar= (unsigned char) *mySource++;
+              
+***************
+*** 2078,2084 ****
+      UBool useFallback;
+      int32_t length =0;
+  
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 2101,2113 ----
+      UBool useFallback;
+      int32_t length =0;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 2098,2111 ****
+      }
+      
+      isTargetByteDBCS   = (UBool) args->converter->fromUnicodeStatus;
+!     if(args->converter->fromUSurrogateLead!=0 && target <targetLimit) {
+          goto getTrail;
+      }
+      while(source < sourceLimit){
+          
+          targetByteUnit = missingCharMarker;
+  
+!         if(target < (unsigned char*) args->targetLimit){
+              sourceChar = *source++;
+             /* length= _MBCSFromUChar32(converterData->fromUnicodeConverter->sharedData,
+                  sourceChar,&targetByteUnit,args->converter->useFallback);*/
+--- 2127,2140 ----
+      }
+      
+      isTargetByteDBCS   = (UBool) args->converter->fromUnicodeStatus;
+!     if(args->converter->fromUSurrogateLead!=0 && (uintptr_t)target <(uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+      while(source < sourceLimit){
+          
+          targetByteUnit = missingCharMarker;
+  
+!         if((uintptr_t)target < (uintptr_t)(args->targetLimit)){
+              sourceChar = *source++;
+             /* length= _MBCSFromUChar32(converterData->fromUnicodeConverter->sharedData,
+                  sourceChar,&targetByteUnit,args->converter->useFallback);*/
+***************
+*** 2131,2137 ****
+                  }
+                  /* write the targetUniChar  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( target < targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) = source - args->source-1;
+--- 2160,2166 ----
+                  }
+                  /* write the targetUniChar  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( (uintptr_t)target < (uintptr_t)targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) = source - args->source-1;
+***************
+*** 2142,2153 ****
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if(target < targetLimit){
+                          *(target++) =(unsigned char) ((targetByteUnit>>8) -0x80);
+                          if(offsets){
+                              *(offsets++) = source - args->source-1;
+                          }
+!                         if(target < targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit -0x80);
+                              if(offsets){
+                                  *(offsets++) = source - args->source-1;
+--- 2171,2182 ----
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if((uintptr_t)target < (uintptr_t)targetLimit){
+                          *(target++) =(unsigned char) ((targetByteUnit>>8) -0x80);
+                          if(offsets){
+                              *(offsets++) = source - args->source-1;
+                          }
+!                         if((uintptr_t)target < (uintptr_t)targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit -0x80);
+                              if(offsets){
+                                  *(offsets++) = source - args->source-1;
+***************
+*** 2307,2314 ****
+      UConverterSharedData* sharedData ;
+      UBool useFallback;
+  
+  
+!     if ((args->converter == NULL) || (args->targetLimit < args->target) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 2336,2348 ----
+      UConverterSharedData* sharedData ;
+      UBool useFallback;
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
+  
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)(args->target)) || (args->sourceLimit < args->source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 2325,2331 ****
+  
+          targetUniChar = missingCharMarker;
+  
+!         if(myTarget < args->targetLimit){
+  
+              mySourceChar= (unsigned char) *mySource++;
+  
+--- 2359,2365 ----
+  
+          targetUniChar = missingCharMarker;
+  
+!         if((uintptr_t)myTarget < (uintptr_t)(args->targetLimit)){
+  
+              mySourceChar= (unsigned char) *mySource++;
+  
+***************
+*** 2610,2617 ****
+      int*  plane;                   
+      int   lPlane=0;                  
+  
+      /* arguments check*/
+!     if ((args->converter == NULL) || (targetLimit < target) || (sourceLimit < source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 2644,2657 ----
+      int*  plane;                   
+      int   lPlane=0;                  
+  
++     /*    
++     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
++     * to the same memory object; such poiter oprations are not defined and must be
++     * done using the unsigned integer types
++     */
++ 
+      /* arguments check*/
+!     if ((args->converter == NULL) || ((uintptr_t)targetLimit < (uintptr_t)target) || (sourceLimit < source)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 2630,2636 ****
+      sharedData        = (*currentConverter)->sharedData;
+  
+      /* check if the last codepoint of previous buffer was a lead surrogate*/
+!     if(args->converter->fromUSurrogateLead!=0 && target< targetLimit) {
+          goto getTrail;
+      }
+  
+--- 2670,2676 ----
+      sharedData        = (*currentConverter)->sharedData;
+  
+      /* check if the last codepoint of previous buffer was a lead surrogate*/
+!     if(args->converter->fromUSurrogateLead!=0 && (uintptr_t)target< (uintptr_t)targetLimit) {
+          goto getTrail;
+      }
+  
+***************
+*** 2640,2646 ****
+          targetByteUnit =missingCharMarker;
+          lPlane =0;
+  
+!         if(target < targetLimit){
+  
+              sourceChar  = *(source++);
+              /*check if the char is a First surrogate*/
+--- 2680,2686 ----
+          targetByteUnit =missingCharMarker;
+          lPlane =0;
+  
+!         if((uintptr_t)target < (uintptr_t)targetLimit){
+  
+              sourceChar  = *(source++);
+              /*check if the char is a First surrogate*/
+***************
+*** 2776,2782 ****
+  
+                  /* write the targetByteUnit  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( target <targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) =source-args->source-1;
+--- 2816,2822 ----
+  
+                  /* write the targetByteUnit  to target */
+                  if(targetByteUnit <= 0x00FF){
+!                     if( (uintptr_t)target <(uintptr_t)targetLimit){
+                          *(target++) = (unsigned char) targetByteUnit;
+                          if(offsets){
+                              *(offsets++) =source-args->source-1;
+***************
+*** 2787,2798 ****
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if(target < targetLimit){
+                          *(target++) =(unsigned char) (targetByteUnit>>8);
+                          if(offsets){
+                              *(offsets++) = source-args->source-1;
+                          }
+!                         if(target < targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit);
+                              if(offsets){
+                                  *(offsets++) = source-args->source-1;
+--- 2827,2838 ----
+                          *err = U_BUFFER_OVERFLOW_ERROR;
+                      }
+                  }else{
+!                     if((uintptr_t)target < (uintptr_t)targetLimit){
+                          *(target++) =(unsigned char) (targetByteUnit>>8);
+                          if(offsets){
+                              *(offsets++) = source-args->source-1;
+                          }
+!                         if((uintptr_t)target < (uintptr_t)targetLimit){
+                              *(target++) =(unsigned char) (targetByteUnit);
+                              if(offsets){
+                                  *(offsets++) = source-args->source-1;
+***************
+*** 3087,3093 ****
+      uint32_t mySourceChar = 0x0000;
+      UConverterDataISO2022* myData;
+  
+!     if ((args->converter == NULL) || (args->targetLimit < myTarget) || (args->sourceLimit < mySource)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+--- 3127,3139 ----
+      uint32_t mySourceChar = 0x0000;
+      UConverterDataISO2022* myData;
+  
+!     /*    
+!     * IMPORTANT: targetLimit might be initialized to U_MAX_PTR, so it need not poit
+!     * to the same memory object; such poiter oprations are not defined and must be
+!     * done using the unsigned integer types
+!     */
+! 
+!     if ((args->converter == NULL) || ((uintptr_t)(args->targetLimit) < (uintptr_t)myTarget) || (args->sourceLimit < mySource)){
+          *err = U_ILLEGAL_ARGUMENT_ERROR;
+          return;
+      }
+***************
+*** 3098,3104 ****
+  
+          targetUniChar =missingCharMarker;
+  
+!         if(myTarget < args->targetLimit){
+  
+              mySourceChar= (unsigned char) *mySource++;
+  
+--- 3144,3150 ----
+  
+          targetUniChar =missingCharMarker;
+  
+!         if((uintptr_t)myTarget < (uintptr_t)(args->targetLimit)){
+  
+              mySourceChar= (unsigned char) *mySource++;
+  
+***************
+*** 3208,3214 ****
+                      args->offsets[myTarget - args->target]= mySource - args->source - 2 
+                                                              +(myData->currentType==ASCII);
+                  }
+!                 if(myTarget< args->targetLimit){ 
+                      *(myTarget)++ = (UChar)(0xdc00+(UChar)(targetUniChar&0x3ff));
+                      if(args->offsets){
+                          args->offsets[myTarget - args->target]= mySource - args->source - 2 
+--- 3254,3260 ----
+                      args->offsets[myTarget - args->target]= mySource - args->source - 2 
+                                                              +(myData->currentType==ASCII);
+                  }
+!                 if((uintptr_t)myTarget< (uintptr_t)(args->targetLimit)){ 
+                      *(myTarget)++ = (UChar)(0xdc00+(UChar)(targetUniChar&0x3ff));
+                      if(args->offsets){
+                          args->offsets[myTarget - args->target]= mySource - args->source - 2 
