Merge 80787

Source/WebCore/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 83 matching lines @@
     m_createdByParser = false;
 }
 
 void StyleElement::process(Element* e)
 {
     if (!e || !e->inDocument())
         return;
 
     unsigned resultLength = 0;
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
-        if (isValidStyleChild(c))
-            resultLength += c->nodeValue().length();
+        if (isValidStyleChild(c)) {
+            unsigned length = c->nodeValue().length();
+            if (length > std::numeric_limits<unsigned>::max() - resultLength)
+                CRASH();
+            resultLength += length;
+        }
     }
     UChar* text;
     String sheetText = String::createUninitialized(resultLength, text);
 
     UChar* p = text;
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
         if (isValidStyleChild(c)) {
             String nodeValue = c->nodeValue();
             unsigned nodeLength = nodeValue.length();
             memcpy(p, nodeValue.characters(), nodeLength * sizeof(UChar));
@@ skipping 48 matching lines @@
 {
     ASSERT(document);
     if (isLoading())
         return false;
 
     document->removePendingSheet();
     return true;
 }
 
 }