Fix use-after-free race in TransliteratorAlias compoundFilter

[hirorogo]

Summary

TransliteratorAlias stored a raw non-owning pointer to the TransliteratorEntry's compoundFilter. When the registry mutex is released between registry->get() and alias->create(), a concurrent Transliterator::unregister() call can delete the entry (and its compoundFilter) while the alias still holds a dangling pointer, causing a use-after-free.

The source comment at transreg.cpp lines 30-36 notes that BoundsChecker has reported dangling pointer errors with these entry objects, corroborating this race condition.

Changes

• Clone compoundFilter in both TransliteratorAlias constructors instead of storing a raw alias pointer
• Delete owned compoundFilter in ~TransliteratorAlias()
• Update header comment and type from const UnicodeSet* (alias) to UnicodeSet* (owned)

Test plan

• Existing ICU transliterator tests pass
• Concurrent createInstance + unregister on the same ID no longer triggers UAF

[CLAassistant]

All committers have signed the CLA.

[markusicu]

@hirorogo Could you please sign the CLA -- otherwise we can't look at your changes -- and create a Jira ticket with the problem description?

[jira-pull-request-webhook]

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

[jira-pull-request-webhook]

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot

[jira-pull-request-webhook]

Hooray! The files in the branch are the same across the force-push. 😃

~ Your Friendly Jira-GitHub PR Checker Bot