From 3a288960d41d6bd7668e02166cf60e2fbf02feab Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu"
 <bzbarsky%mit.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 17 Nov 2008 16:06:48 +0000
Subject: [PATCH] Bug 460713. Sanity-check the length. r+sr=jst, a=dveditz

git-svn-id: svn://10.0.0.236/trunk@255070 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../html/content/src/nsHTMLSelectElement.cpp   | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/mozilla/content/html/content/src/nsHTMLSelectElement.cpp b/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
index 27ef772324c..fbf7bc84b47 100644
--- a/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLSelectElement.cpp
@@ -720,24 +720,30 @@ nsHTMLSelectElement::GetLength(PRUint32* aLength)
   return mOptions->GetLength(aLength);
 }
 
+#define MAX_DYNAMIC_SELECT_LENGTH 10000
+
 NS_IMETHODIMP
 nsHTMLSelectElement::SetLength(PRUint32 aLength)
 {
   nsresult rv=NS_OK;
 
   PRUint32 curlen;
-  PRInt32 i;
+  PRUint32 i;
 
   rv = GetLength(&curlen);
   if (NS_FAILED(rv)) {
     curlen = 0;
   }
 
-  if (curlen && (curlen > aLength)) { // Remove extra options
-    for (i = (curlen - 1); (i >= (PRInt32)aLength) && NS_SUCCEEDED(rv); i--) {
-      rv = Remove(i);
+  if (curlen > aLength) { // Remove extra options
+    for (i = curlen; i > aLength && NS_SUCCEEDED(rv); --i) {
+      rv = Remove(i-1);
     }
-  } else if (aLength) {
+  } else if (aLength > curlen) {
+    if (aLength > MAX_DYNAMIC_SELECT_LENGTH) {
+      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+    }
+    
     // This violates the W3C DOM but we do this for backwards compatibility
     nsCOMPtr<nsINodeInfo> nodeInfo;
 
@@ -758,7 +764,7 @@ nsHTMLSelectElement::SetLength(PRUint32 aLength)
 
     nsCOMPtr<nsIDOMNode> node(do_QueryInterface(element));
 
-    for (i = curlen; i < (PRInt32)aLength; i++) {
+    for (i = curlen; i < aLength; i++) {
       nsCOMPtr<nsIDOMNode> tmpNode;
 
       rv = AppendChild(node, getter_AddRefs(tmpNode));