From ec3743ae74a8aff3278c606a5cd21fe91336ed49 Mon Sep 17 00:00:00 2001
From: "brendan%mozilla.org"
 <brendan%mozilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 19 Apr 2005 21:06:26 +0000
Subject: [PATCH] Limit args passed via Function ctor (290575, r/a=me).

git-svn-id: svn://10.0.0.236/trunk@172449 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/js/src/jsfun.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mozilla/js/src/jsfun.c b/mozilla/js/src/jsfun.c
index 8e37487f341..6a84c60b336 100644
--- a/mozilla/js/src/jsfun.c
+++ b/mozilla/js/src/jsfun.c
@@ -1783,6 +1783,11 @@ Function(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
                                           fun->nargs)) {
                     goto bad_formal;
                 }
+                if (fun->nargs == JS_BITMASK(16)) {
+                    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+                                         JSMSG_TOO_MANY_FUN_ARGS);
+                    goto bad;
+                }
                 fun->nargs++;
 
                 /*
@@ -1838,6 +1843,7 @@ bad_formal:
     if (!(ts->flags & TSF_ERROR))
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_FORMAL);
 
+bad:
     /*
      * Clean up the arguments string and tokenstream if we failed to parse
      * the arguments.