Fix ucal_getCanonicalTimeZoneID crash to access invalid buffer

Summary:
    If Android system locale string length is less than 32,
    in this case `bufferLength` is 32 that will cause
    `ucal_getCanonicalTimeZoneID` to access invalid buffer.

Author: Kudo

patches/jsc_intl_timezone.patch

@@ -1,16 +1,14 @@
-diff -aur target-org/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp target/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
---- target-org/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp	2019-01-28 09:56:29.000000000 +0800
-+++ target/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp	2019-09-06 02:00:12.000000000 +0800
-@@ -40,6 +40,8 @@
+--- download/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp	2019-08-28 06:14:52.000000000 +0800
++++ target/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp	2019-12-19 11:44:16.000000000 +0800
+@@ -40,6 +40,7 @@
  #include <unicode/udatpg.h>
  #include <unicode/uenum.h>
  #include <wtf/text/StringBuilder.h>
 +#include <sys/system_properties.h>
-+#include <wtf/unicode/UTF8Conversion.h>
 
  #if JSC_ICU_HAS_UFIELDPOSITER
  #include <unicode/ufieldpositer.h>
-@@ -121,14 +123,34 @@
+@@ -121,14 +123,35 @@
      // 6.4.3 DefaultTimeZone () (ECMA-402 2.0)
      // The DefaultTimeZone abstract operation returns a String value representing the valid (6.4.1) and canonicalized (6.4.2) time zone name for the host environment’s current time zone.
 
@@ -28,11 +26,12 @@ diff -aur target-org/webkit/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
 +    char systemPropBuffer[2 * (PROP_VALUE_MAX + 1)] = {0};
 +    if (__system_property_get("persist.sys.timezone", systemPropBuffer) != 0) {
 +        size_t systemPropLength = strlen(systemPropBuffer);
-+        if (systemPropLength > buffer.capacity()) {
-+            buffer.grow(strlen(systemPropBuffer));
++        bufferLength = systemPropLength;
++        if (bufferLength > buffer.capacity()) {
++            buffer.grow(bufferLength);
 +        }
-+        UChar* bufferStart = buffer.data();
-+        if (WTF::Unicode::convertUTF8ToUTF16(systemPropBuffer, systemPropBuffer + systemPropLength, &bufferStart, bufferStart + buffer.capacity())) {
++
++        if (u_uastrncpy(buffer.data(), systemPropBuffer, buffer.capacity())) {
 +            status = U_ZERO_ERROR;
 +        }
      }