diff --git a/mozilla/content/xslt/src/xslt/txNodeSorter.cpp b/mozilla/content/xslt/src/xslt/txNodeSorter.cpp
index 8f52a2d8a02..75ad2b7b861 100644
--- a/mozilla/content/xslt/src/xslt/txNodeSorter.cpp
+++ b/mozilla/content/xslt/src/xslt/txNodeSorter.cpp
@@ -178,7 +178,15 @@ txNodeSorter::sortNodeSet(txNodeSet* aNodes, txExecutionState* aEs,
 
     // Create and set up memoryblock for sort-values and indexarray
     PRUint32 len = static_cast<PRUint32>(aNodes->size());
-    void* mem = PR_Malloc(len * (sizeof(PRUint32) + mNKeys * sizeof(TxObject*)));
+
+    // Don't overflow when calculating the length of the sort buffer.
+    PRUint32 itemSize = sizeof(PRUint32) + mNKeys * sizeof(TxObject*);
+    if (mNKeys > (PR_UINT32_MAX - sizeof(PRUint32)) / sizeof(TxObject*) ||
+        len >= PR_UINT32_MAX / itemSize) {
+        return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    void* mem = PR_Malloc(len * itemSize);
     NS_ENSURE_TRUE(mem, NS_ERROR_OUT_OF_MEMORY);
 
     PRUint32* indexes = static_cast<PRUint32*>(mem);