commit 68c221808cf7a4776ba8feae02611d3c78e9f857
author Bart Sears <bsears@google.com> Fri Mar 11 16:17:22 2011 -0800
committer Bart Sears <bsears@google.com> Fri Mar 11 16:17:22 2011 -0800
tree bc695d0622452e8ba0c52b961c5d1daeeec4499c
parent 591ab58df1b16eb937b3438f3af26c1b97c658fd

Apply webit security patch

bug: 4089100
Change-Id: Ibaa52a6bcbbe47f33ec4131051309ed05b05748b

WebCore/dom/StyleElement.cpp

diff --git a/WebCore/dom/StyleElement.cpp b/WebCore/dom/StyleElement.cpp
index f881179..7bec24a 100644
--- a/WebCore/dom/StyleElement.cpp
+++ b/WebCore/dom/StyleElement.cpp
@@ -64,8 +64,12 @@
     unsigned resultLength = 0;
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
         Node::NodeType nodeType = c->nodeType();
-        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE)
-            resultLength += c->nodeValue().length();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE) {
+            unsigned length = c->nodeValue().length();
+            if (length > std::numeric_limits<unsigned>::max() - resultLength)
+                CRASH();
+            resultLength += length;
+        }
     }
     UChar* text;
     String sheetText = String::createUninitialized(resultLength, text);