Range and Selection: Do not accept offsets larger than 2^31-1.

third_party/WebKit/Source/core/dom/Range.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1025 matching lines @@
       return nullptr;
     case Node::kCdataSectionNode:
     case Node::kCommentNode:
     case Node::kTextNode:
       if (offset > toCharacterData(n)->length()) {
         exceptionState.throwDOMException(
             IndexSizeError, "The offset " + String::number(offset) +
                                 " is larger than the node's length (" +
                                 String::number(toCharacterData(n)->length()) +
                                 ").");
+      } else if (offset >
+                 static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
       }
       return nullptr;
     case Node::kProcessingInstructionNode:
       if (offset > toProcessingInstruction(n)->data().length()) {
         exceptionState.throwDOMException(
             IndexSizeError,
             "The offset " + String::number(offset) +
                 " is larger than the node's length (" +
                 String::number(toProcessingInstruction(n)->data().length()) +
                 ").");
+      } else if (offset >
+                 static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
       }
       return nullptr;
     case Node::kAttributeNode:
     case Node::kDocumentFragmentNode:
     case Node::kDocumentNode:
     case Node::kElementNode: {
       if (!offset)
         return nullptr;
+      if (offset > static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
+        return nullptr;
+      }
       Node* childBefore = NodeTraversal::childAt(*n, offset - 1);
       if (!childBefore) {
         exceptionState.throwDOMException(
             IndexSizeError,
             "There is no child at offset " + String::number(offset) + ".");
       }
       return childBefore;
     }
   }
   NOTREACHED();
@@ skipping 693 matching lines @@
                      .data()
               << "start offset: " << range->startOffset()
               << ", end offset: " << range->endOffset();
   } else {
     LOG(INFO) << "Cannot show tree if range is null, or if boundary points are "
                  "invalid.";
   }
 }
 
 #endif