Added checks for integer overflow conditions to deleteData and replaceData.

Source/core/dom/CharacterData.cpp

Index: Source/core/dom/CharacterData.cpp
diff --git a/Source/core/dom/CharacterData.cpp b/Source/core/dom/CharacterData.cpp
index 4b2a386d810f14a7bf786591d64de0a3c7439cbf..36b28b75c841b0c3d0464c57e2a821ee4ac587af 100644
--- a/Source/core/dom/CharacterData.cpp
+++ b/Source/core/dom/CharacterData.cpp
@@ -108,14 +108,21 @@ void CharacterData::insertData(unsigned offset, const String& data, ExceptionSta
 
 void CharacterData::deleteData(unsigned offset, unsigned count, ExceptionState& exceptionState, RecalcStyleBehavior recalcStyleBehavior)
 {
-    if (offset > length()) {
+    const unsigned dataLength = length();
+
+    if (offset > dataLength) {
         exceptionState.throwDOMException(IndexSizeError, "The offset " + String::number(offset) + " is greater than the node's length (" + String::number(length()) + ").");
         return;
     }
 
+    if (count > (dataLength - offset)) {

[sof, 2014/03/19 11:40:18]

If not already, you may want to consider handling overflow checking using
Checked<unsigned, OverflowHandler> instead.

+        exceptionState.throwDOMException(IndexSizeError, "Cannot delete " + String::number(count) + " characters, this is greater than the node's length with the given offset.");
+        return;
+    }
+
     unsigned realCount;
-    if (offset + count > length())
-        realCount = length() - offset;
+    if (offset + count > dataLength)
+        realCount = dataLength - offset;
     else
         realCount = count;
 
@@ -129,14 +136,21 @@ void CharacterData::deleteData(unsigned offset, unsigned count, ExceptionState&
 
 void CharacterData::replaceData(unsigned offset, unsigned count, const String& data, ExceptionState& exceptionState)
 {
-    if (offset > length()) {
+    const unsigned dataLength = length();
+
+    if (offset > dataLength) {
         exceptionState.throwDOMException(IndexSizeError, "The offset " + String::number(offset) + " is greater than the node's length (" + String::number(length()) + ").");
         return;
     }
 
+    if (count > (dataLength - offset)) {
+        exceptionState.throwDOMException(IndexSizeError, "Cannot replace " + String::number(count) + " characters, this is greater than the node's length with the given offset.");
+        return;
+    }
+
     unsigned realCount;
-    if (offset + count > length())
-        realCount = length() - offset;
+    if (offset + count > dataLength)
+        realCount = dataLength - offset;
     else
         realCount = count;