diff --git a/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp b/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp
index 23c89f4fbd8..5fcf6d15b1a 100644
--- a/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp
+++ b/mozilla/content/html/content/src/nsHTMLTableCellElement.cpp
@@ -327,6 +327,8 @@ static nsGenericHTMLElement::EnumTable kCellScopeTable[] = {
   { 0 }
 };
 
+#define MAX_COLSPAN 1000
+
 NS_IMETHODIMP
 nsHTMLTableCellElement::StringToAttribute(nsIAtom* aAttribute,
                                    const nsString& aValue,
@@ -346,6 +348,11 @@ nsHTMLTableCellElement::StringToAttribute(nsIAtom* aAttribute,
   else if ((aAttribute == nsHTMLAtoms::colspan) ||
       (aAttribute == nsHTMLAtoms::rowspan)) {
     if (nsGenericHTMLElement::ParseValue(aValue, 1, aResult, eHTMLUnit_Integer)) {
+      PRInt32 val = aResult.GetIntValue();
+      if (val > MAX_COLSPAN) {
+        nsHTMLUnit unit = aResult.GetUnit();
+        aResult.SetIntValue(MAX_COLSPAN, unit);
+      }
       return NS_CONTENT_ATTR_HAS_VALUE;
     }
   }
diff --git a/mozilla/layout/html/content/src/nsHTMLTableCellElement.cpp b/mozilla/layout/html/content/src/nsHTMLTableCellElement.cpp
index 23c89f4fbd8..5fcf6d15b1a 100644
--- a/mozilla/layout/html/content/src/nsHTMLTableCellElement.cpp
+++ b/mozilla/layout/html/content/src/nsHTMLTableCellElement.cpp
@@ -327,6 +327,8 @@ static nsGenericHTMLElement::EnumTable kCellScopeTable[] = {
   { 0 }
 };
 
+#define MAX_COLSPAN 1000
+
 NS_IMETHODIMP
 nsHTMLTableCellElement::StringToAttribute(nsIAtom* aAttribute,
                                    const nsString& aValue,
@@ -346,6 +348,11 @@ nsHTMLTableCellElement::StringToAttribute(nsIAtom* aAttribute,
   else if ((aAttribute == nsHTMLAtoms::colspan) ||
       (aAttribute == nsHTMLAtoms::rowspan)) {
     if (nsGenericHTMLElement::ParseValue(aValue, 1, aResult, eHTMLUnit_Integer)) {
+      PRInt32 val = aResult.GetIntValue();
+      if (val > MAX_COLSPAN) {
+        nsHTMLUnit unit = aResult.GetUnit();
+        aResult.SetIntValue(MAX_COLSPAN, unit);
+      }
       return NS_CONTENT_ATTR_HAS_VALUE;
     }
   }