Fix use-after-free race in TransliteratorAlias compoundFilter

See unicode-org#3913

Author: hirorogo

icu4c/source/i18n/transreg.cpp

@@ -86,7 +86,7 @@ TransliteratorAlias::TransliteratorAlias(const UnicodeString& theAliasID,
     ID(),
     aliasesOrRules(theAliasID),
     transes(nullptr),
-    compoundFilter(cpdFilter),
+    compoundFilter(cpdFilter ? cpdFilter->clone() : nullptr),
     direction(UTRANS_FORWARD),
     type(TransliteratorAlias::SIMPLE) {
 }
@@ -98,7 +98,7 @@ TransliteratorAlias::TransliteratorAlias(const UnicodeString& theID,
     ID(theID),
     aliasesOrRules(idBlocks),
     transes(adoptedTransliterators),
-    compoundFilter(cpdFilter),
+    compoundFilter(cpdFilter ? cpdFilter->clone() : nullptr),
     direction(UTRANS_FORWARD),
     type(TransliteratorAlias::COMPOUND) {
 }
@@ -116,6 +116,7 @@ TransliteratorAlias::TransliteratorAlias(const UnicodeString& theID,
 
 TransliteratorAlias::~TransliteratorAlias() {
     delete transes;
+    delete compoundFilter;
 }
 
 
@@ -132,7 +133,7 @@ Transliterator* TransliteratorAlias::create(UParseError& pe,
             return nullptr;
         }
         if (compoundFilter != nullptr)
-            t->adoptFilter(compoundFilter->clone());
+            t->adoptFilter(static_cast<UnicodeSet*>(compoundFilter->clone()));
         break;
     case COMPOUND:
         {

icu4c/source/i18n/transreg.h

@@ -105,14 +105,14 @@ class TransliteratorAlias : public UMemory {
     //    Here ID is the ID, aliasID is the idBlock, trans is the
     //    contained RBT, and idSplitPoint is the offset in aliasID
     //    where the contained RBT goes.  compoundFilter is the
-    //    compound filter, and it is _not_ owned.
+    //    compound filter, and it is owned (cloned from entry).
     // 3. Rules
     //    Here ID is the ID, aliasID is the rules string.
     //    idSplitPoint is the UTransDirection.
     UnicodeString ID;
     UnicodeString aliasesOrRules;
     UVector* transes; // owned
-    const UnicodeSet* compoundFilter; // alias
+    UnicodeSet* compoundFilter; // owned
     UTransDirection direction;
     enum { SIMPLE, COMPOUND, RULES } type;