Range and Selection: Do not accept offsets larger than 2^31-1.

third_party/WebKit/Source/core/dom/Range.cpp

Index: third_party/WebKit/Source/core/dom/Range.cpp
diff --git a/third_party/WebKit/Source/core/dom/Range.cpp b/third_party/WebKit/Source/core/dom/Range.cpp
index bd212e130a6c5012425fc1ffdfc58068edf1e7ce..c439b5d09738d80a6cdfa155b9812035f31d8134 100644
--- a/third_party/WebKit/Source/core/dom/Range.cpp
+++ b/third_party/WebKit/Source/core/dom/Range.cpp
@@ -1043,6 +1043,11 @@ Node* Range::checkNodeWOffset(Node* n,
                                 " is larger than the node's length (" +
                                 String::number(toCharacterData(n)->length()) +
                                 ").");
+      } else if (offset >
+                 static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
       }
       return nullptr;
     case Node::kProcessingInstructionNode:
@@ -1053,6 +1058,11 @@ Node* Range::checkNodeWOffset(Node* n,
                 " is larger than the node's length (" +
                 String::number(toProcessingInstruction(n)->data().length()) +
                 ").");
+      } else if (offset >
+                 static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
       }
       return nullptr;
     case Node::kAttributeNode:
@@ -1061,6 +1071,12 @@ Node* Range::checkNodeWOffset(Node* n,
     case Node::kElementNode: {
       if (!offset)
         return nullptr;
+      if (offset > static_cast<unsigned>(std::numeric_limits<int>::max())) {
+        exceptionState.throwDOMException(
+            IndexSizeError,
+            "The offset " + String::number(offset) + " is invalid.");
+        return nullptr;
+      }
       Node* childBefore = NodeTraversal::childAt(*n, offset - 1);
       if (!childBefore) {
         exceptionState.throwDOMException(