diff --git a/.cvsignore b/.cvsignore
index 4d69cee..21c7cfc 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
 fastjar-0.97.tar.gz
-gcc-4.4.2-20091017.tar.bz2
+gcc-4.4.2-20091018.tar.bz2
diff --git a/gcc.spec b/gcc.spec
index dbaa00a..3cf011f 100644
--- a/gcc.spec
+++ b/gcc.spec
@@ -1,9 +1,9 @@
-%global DATE 20091017
-%global SVNREV 152957
+%global DATE 20091018
+%global SVNREV 152967
 %global gcc_version 4.4.2
 # Note, gcc_release must be integer, if you want to add suffixes to
 # %{release}, append them after %{gcc_release} on Release: line.
-%global gcc_release 3
+%global gcc_release 4
 %global _unpackaged_files_terminate_build 0
 %global multilib_64_archs sparc64 ppc64 s390x x86_64
 %global include_gappletviewer 1
@@ -165,6 +165,7 @@ Patch19: gcc44-ppc64-aixdesc.patch
 Patch20: gcc44-pr40521.patch
 Patch21: gcc44-unwind-leltgegt.patch
 Patch22: gcc44-pr40521-2.patch
+Patch23: gcc44-rh529512.patch
 
 Patch1000: fastjar-0.97-segfault.patch
 
@@ -474,6 +475,7 @@ which are required to compile with the GNAT.
 %patch20 -p0 -b .pr40521~
 %patch21 -p0 -b .unwind-leltgegt~
 %patch22 -p0 -b .pr40521-2~
+%patch23 -p0 -b .rh529512~
 
 # This testcase doesn't compile.
 rm libjava/testsuite/libjava.lang/PR35020*
@@ -1855,6 +1857,12 @@ fi
 %doc rpm.doc/changelogs/libmudflap/ChangeLog*
 
 %changelog
+* Sun Oct 18 2009 Jakub Jelinek <jakub@redhat.com> 4.4.2-4
+- update from gcc-4_4-branch
+  - PRs c++/37204, c++/37766, c++/37875, c++/38798, c++/40092,
+	libstdc++/40654, libstdc++/40826
+- fix VTA ICE on invalid pointer arithmetics (#529512)
+
 * Sat Oct 17 2009 Jakub Jelinek <jakub@redhat.com> 4.4.2-3
 - fix VTA handling in the scheduler (PR debug/41535)
 - fix up %%check section to be able to find ecj1
diff --git a/gcc44-rh529512.patch b/gcc44-rh529512.patch
new file mode 100644
index 0000000..5b1feb0
--- /dev/null
+++ b/gcc44-rh529512.patch
@@ -0,0 +1,39 @@
+2009-10-18  Jakub Jelinek  <jakub@redhat.com>
+
+	* cfgexpand.c (expand_debug_expr): Fail if bitpos < 0 for non-MEM
+	op0.
+
+	* gcc.dg/debug/vta-3.c: New test.
+
+--- gcc/cfgexpand.c.jj	2009-10-16 01:45:11.000000000 +0200
++++ gcc/cfgexpand.c	2009-10-18 14:02:25.000000000 +0200
+@@ -2593,6 +2593,9 @@ expand_debug_expr (tree exp)
+ 	if (bitpos == 0 && mode == GET_MODE (op0))
+ 	  return op0;
+ 
++        if (bitpos < 0)
++          return NULL;
++
+ 	if ((bitpos % BITS_PER_UNIT) == 0
+ 	    && bitsize == GET_MODE_BITSIZE (mode1))
+ 	  {
+--- gcc/testsuite/gcc.dg/debug/vta-3.c.jj	2009-10-18 14:44:12.000000000 +0200
++++ gcc/testsuite/gcc.dg/debug/vta-3.c	2009-10-18 14:44:32.000000000 +0200
+@@ -0,0 +1,17 @@
++/* { dg-do compile } */
++
++int
++foo (void)
++{
++  union { char e[8]; int i; } a, b;
++  char *c, *d;
++  unsigned int i;
++  c = a.e;
++  d = &b.e[sizeof (int) - 1];
++  for (i = 0; i < sizeof (int); i++)
++    {
++      *d = *c++;
++      --d;
++    }
++  return b.i;
++}
diff --git a/sources b/sources
index f38103d..e4818da 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 2659f09c2e43ef8b7d4406321753f1b2  fastjar-0.97.tar.gz
-b848bfbd9f0a7662dc812e10fb88376d  gcc-4.4.2-20091017.tar.bz2
+ec0efd8c06411b8416255df19f880444  gcc-4.4.2-20091018.tar.bz2