fix: port v9.0.36 upstream java changes

csharp/PhoneNumbers/PhoneNumberUtil.cs

@@ -50,6 +50,10 @@ public partial class PhoneNumberUtil
         // The ITU says the maximum length should be 15, but we have found longer numbers in Germany.
         internal const int MAX_LENGTH_FOR_NSN = 17;
 
+        // We don't allow input strings for parsing to be longer than this. This prevents malicious
+        // input from overflowing the regular-expression engine.
+        private const int MAX_INPUT_STRING_LENGTH = 250;
+
         // Region-code for the unknown region.
         private const string UNKNOWN_REGION = "ZZ";
         private const int NANPA_COUNTRY_CODE = 1;
@@ -1448,7 +1452,8 @@ private NumberFormat ChooseFormattingPatternForNumber(PhoneNumber number)
 
         internal static int GetNationalSignificantNumberLength(PhoneNumber number)
         {
-            var len = number.NumberOfLeadingZeros;
+            // Kept in step with the cap applied by GetNationalSignificantNumberImpl.
+            var len = Math.Min(number.NumberOfLeadingZeros, 10);
             var n = number.NationalNumber;
             do len++; while ((n /= 10) != 0);
             return len;
@@ -1976,6 +1981,10 @@ public bool IsNANPACountry(string regionCode)
         /// <returns>True if the number is a valid vanity number.</returns>
         public bool IsAlphaNumber(string number)
         {
+            if (number.Length > MAX_INPUT_STRING_LENGTH)
+            {
+                return false;
+            }
             if (!IsViablePhoneNumber(number))
             {
                 // Number is too short, or doesn't match the basic phone number pattern.
@@ -2695,9 +2704,7 @@ private void ParseHelper(string numberToParse, string defaultRegion, bool keepRa
             if (numberToParse == null)
                 throw new NumberParseException(ErrorType.NOT_A_NUMBER, "The phone number supplied was null.");
 
-            // We don't allow input strings for parsing to be longer than 250 chars. This prevents malicious
-            // input from overflowing the regular-expression engine.
-            if (numberToParse.Length > 250)
+            if (numberToParse.Length > MAX_INPUT_STRING_LENGTH)
                 throw new NumberParseException(ErrorType.TOO_LONG, "The string supplied was too long to parse.");
 
             var nationalNumber = new StringBuilder();

csharp/PhoneNumbers/PhoneNumberUtil.net.cs

@@ -665,8 +665,10 @@ private static void SetNationalSignificantNumberToSpan(ref Span<char> nationalNu
             PhoneNumber number,
             out int nationalSignificantNumberLength)
         {
+            // Defensively cap the number of leading zeros to avoid OOM from malicious input.
+            var numberOfLeadingZeros = Math.Min(number.NumberOfLeadingZeros, 10);
             nationalSignificantNumberLength = 0;
-            for (var i = 0; i < number.NumberOfLeadingZeros; i++)
+            for (var i = 0; i < numberOfLeadingZeros; i++)
                 nationalNumber[nationalSignificantNumberLength++] = '0';
 
             number.NationalNumber.TryFormat(nationalNumber[nationalSignificantNumberLength..], out var charsWritten);

csharp/PhoneNumbers/PhoneNumberUtil.netstandard.cs

@@ -104,11 +104,12 @@ public string Format(PhoneNumber number, PhoneNumberFormat numberFormat)
         internal static string GetNationalSignificantNumberImpl(PhoneNumber number)
         {
             // If a leading zero(s) has been set, we prefix this now. Note this is not a national prefix.
+            // Defensively cap the number of leading zeros to avoid OOM from malicious input.
             if (!number.HasNumberOfLeadingZeros)
                 return number.NationalNumber.ToString();
 
             var nationalNumber = new StringBuilder();
-            nationalNumber.Append('0', number.NumberOfLeadingZeros);
+            nationalNumber.Append('0', Math.Min(number.NumberOfLeadingZeros, 10));
             nationalNumber.Append(number.NationalNumber);
             return nationalNumber.ToString();
         }