Bug 303213 integer overflow in js

patch by mrbkap r=brendan a=brendan


git-svn-id: svn://10.0.0.236/trunk@177088 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/js/src/jsstr.c

@@ -361,6 +361,12 @@ js_str_escape(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval
         } else {
             newlength += 5; /* The character will be encoded as %uXXXX */
         }
+
+        /* NB: this works because newlength can be incremented by at most 5. */ 
+        if (newlength < length) {
+            JS_ReportOutOfMemory(cx);
+            return JS_FALSE;
+        }
     }
 
     if (newlength >= ~(size_t)0 / sizeof(jschar)) {