diff --git a/mozilla/content/base/src/nsDocumentEncoder.cpp b/mozilla/content/base/src/nsDocumentEncoder.cpp
index e724e6b3834..b3fcfd1d663 100644
--- a/mozilla/content/base/src/nsDocumentEncoder.cpp
+++ b/mozilla/content/base/src/nsDocumentEncoder.cpp
@@ -408,7 +408,9 @@ ConvertAndWrite(const nsAString& aString,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCAutoString charXferString;
-  charXferString.SetCapacity(charLength);
+  if (!EnsureStringLength(charXferString, charLength))
+    return NS_ERROR_OUT_OF_MEMORY;
+
   char* charXferBuf = charXferString.BeginWriting();
   nsresult convert_rv = NS_OK;
 
diff --git a/mozilla/content/base/src/nsScriptLoader.cpp b/mozilla/content/base/src/nsScriptLoader.cpp
index 5286e599020..c88a9a74067 100644
--- a/mozilla/content/base/src/nsScriptLoader.cpp
+++ b/mozilla/content/base/src/nsScriptLoader.cpp
@@ -933,7 +933,9 @@ nsScriptLoader::ConvertToUTF16(nsIChannel* aChannel, const PRUint8* aData,
     rv = unicodeDecoder->GetMaxLength(NS_REINTERPRET_CAST(const char*, aData),
                                       aLength, &unicodeLength);
     if (NS_SUCCEEDED(rv)) {
-      aString.SetLength(unicodeLength);
+      if (!EnsureStringLength(aString, unicodeLength))
+        return NS_ERROR_OUT_OF_MEMORY;
+
       PRUnichar *ustr = aString.BeginWriting();
 
       PRInt32 consumedLength = 0;
diff --git a/mozilla/content/xslt/src/base/txDouble.cpp b/mozilla/content/xslt/src/base/txDouble.cpp
index b20cba5be73..d709e9a38d3 100644
--- a/mozilla/content/xslt/src/base/txDouble.cpp
+++ b/mozilla/content/xslt/src/base/txDouble.cpp
@@ -317,8 +317,10 @@ void Double::toString(double aValue, nsAString& aDest)
     }
     if (aValue < 0)
         ++length;
+    // grow the string
     PRUint32 oldlength = aDest.Length();
-    aDest.SetLength(oldlength + length); // grow the string
+    if (!EnsureStringLength(aDest, oldlength + length))
+        return; // out of memory
     nsAString::iterator dest;
     aDest.BeginWriting(dest).advance(PRInt32(oldlength));
     if (aValue < 0) {
diff --git a/mozilla/content/xslt/src/base/txStringUtils.cpp b/mozilla/content/xslt/src/base/txStringUtils.cpp
index 6a22b755f55..f2aa8f9887d 100644
--- a/mozilla/content/xslt/src/base/txStringUtils.cpp
+++ b/mozilla/content/xslt/src/base/txStringUtils.cpp
@@ -146,7 +146,8 @@ void TX_ToLowerCase(const nsAString& aSource, nsAString& aDest)
 {
   nsAString::const_iterator fromBegin, fromEnd;
   nsAString::iterator toBegin;
-  aDest.SetLength(aSource.Length());
+  if (!EnsureStringLength(aDest, aSource.Length()))
+    return; // XXX no way to signal out-of-memory
   CopyToLowerCase converter(aDest.BeginWriting(toBegin));
   copy_string(aSource.BeginReading(fromBegin), aSource.EndReading(fromEnd),
               converter);
diff --git a/mozilla/db/morkreader/nsMorkReader.cpp b/mozilla/db/morkreader/nsMorkReader.cpp
index 985033c06fb..f3663764854 100644
--- a/mozilla/db/morkreader/nsMorkReader.cpp
+++ b/mozilla/db/morkreader/nsMorkReader.cpp
@@ -85,7 +85,12 @@ MorkUnescape(const nsCSubstring &aString, nsCString &aResult)
   // We optimize for speed over space here -- size the result buffer to
   // the size of the source, which is an upper bound on the size of the
   // unescaped string.
-  aResult.SetLength(len);
+  // FIXME: Mork assume there will never be errors
+  if (!EnsureStringLength(aResult, len)) {
+    aResult.Truncate();
+    return; // out of memory.
+  }
+
   char *result = aResult.BeginWriting();
   const char *source = aString.BeginReading();
   const char *sourceEnd = source + len;
diff --git a/mozilla/gfx/src/nsColor.cpp b/mozilla/gfx/src/nsColor.cpp
index 0d78ebbe239..427066b70ec 100644
--- a/mozilla/gfx/src/nsColor.cpp
+++ b/mozilla/gfx/src/nsColor.cpp
@@ -170,6 +170,7 @@ NS_GFX_(void) NS_RGBToASCIIHex(nscolor aColor,
                                           nsAFlatCString& aResult)
 {
   aResult.SetLength(7);
+  NS_ASSERTION(aResult.Length() == 7, "small SetLength failed, use an autostring instead!");
   char *buf = aResult.BeginWriting();
   PR_snprintf(buf, 8, "#%02x%02x%02x",
               NS_GET_R(aColor), NS_GET_G(aColor), NS_GET_B(aColor));
diff --git a/mozilla/intl/unicharutil/src/nsHankakuToZenkaku.cpp b/mozilla/intl/unicharutil/src/nsHankakuToZenkaku.cpp
index 69275b61ae3..b0abe392eba 100644
--- a/mozilla/intl/unicharutil/src/nsHankakuToZenkaku.cpp
+++ b/mozilla/intl/unicharutil/src/nsHankakuToZenkaku.cpp
@@ -84,6 +84,8 @@ void HankakuToZenkaku (
     const PRUnichar* aSrc, PRInt32 aLen, 
     PRUnichar* aDest, PRInt32 aDestLen, PRInt32* oLen)
 {
+    // XXX aDestLen is never checked, assumed to be as long as aLen
+    NS_ASSERTION(aDestLen >= aLen, "aDest must be as long as aSrc");
 
     PRInt32 i,j;
     if ( aLen == 0) {
@@ -153,8 +155,9 @@ nsHankakuToZenkaku::~nsHankakuToZenkaku()
 NS_IMETHODIMP nsHankakuToZenkaku::Change( const PRUnichar* aText, PRInt32 aTextLength, nsString& aResult)
 {
   PRInt32 ol;
-  aResult.SetCapacity(aTextLength);
-   
+  if (!EnsureStringLength(aResult, aTextLength))
+    return NS_ERROR_OUT_OF_MEMORY;
+
   HankakuToZenkaku ( aText, aTextLength, aResult.BeginWriting(), aTextLength, &ol);
   aResult.SetLength(ol);
 
diff --git a/mozilla/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp b/mozilla/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp
index 6ae285b0285..37bb428db5d 100644
--- a/mozilla/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp
+++ b/mozilla/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp
@@ -376,6 +376,7 @@ DeserializeParam(ipcMessageReader &reader, const nsXPTType &t, nsXPTCVariant &v)
     case nsXPTType::T_IID:
       {
         nsID *buf = (nsID *) malloc(sizeof(nsID));
+        NS_ENSURE_TRUE(buf, NS_ERROR_OUT_OF_MEMORY);
         reader.GetBytes(buf, sizeof(nsID));
         v.val.p = v.ptr = buf;
         v.flags = nsXPTCVariant::PTR_IS_DATA | nsXPTCVariant::VAL_IS_ALLOCD;
@@ -386,6 +387,7 @@ DeserializeParam(ipcMessageReader &reader, const nsXPTType &t, nsXPTCVariant &v)
       {
         PRUint32 len = reader.GetInt32();
         char *buf = (char *) malloc(len + 1);
+        NS_ENSURE_TRUE(buf, NS_ERROR_OUT_OF_MEMORY);
         reader.GetBytes(buf, len);
         buf[len] = char(0);
 
@@ -398,6 +400,7 @@ DeserializeParam(ipcMessageReader &reader, const nsXPTType &t, nsXPTCVariant &v)
       {
         PRUint32 len = reader.GetInt32();
         PRUnichar *buf = (PRUnichar *) malloc(len + 2);
+        NS_ENSURE_TRUE(buf, NS_ERROR_OUT_OF_MEMORY);
         reader.GetBytes(buf, len);
         buf[len] = PRUnichar(0);
 
@@ -421,7 +424,8 @@ DeserializeParam(ipcMessageReader &reader, const nsXPTType &t, nsXPTCVariant &v)
         PRUint32 len = reader.GetInt32();
 
         nsString *str = new nsString();
-        str->SetLength(len / 2);
+        if (!str || !(EnsureStringLength(*str, len/2)))
+          return NS_ERROR_OUT_OF_MEMORY;
         PRUnichar *buf = str->BeginWriting();
         reader.GetBytes(buf, len);
 
@@ -436,7 +440,8 @@ DeserializeParam(ipcMessageReader &reader, const nsXPTType &t, nsXPTCVariant &v)
         PRUint32 len = reader.GetInt32();
 
         nsCString *str = new nsCString();
-        str->SetLength(len);
+        if (!str || !(EnsureStringLength(*str, len)))
+          return NS_ERROR_OUT_OF_MEMORY;
         char *buf = str->BeginWriting();
         reader.GetBytes(buf, len);
 
@@ -623,8 +628,9 @@ DeserializeResult(ipcMessageReader &reader, const nsXPTType &t, nsXPTCMiniVarian
 
         nsAString *str = (nsAString *) v.val.p;
 
+        if (!str || !(EnsureStringLength(*str, len/2)))
+          return NS_ERROR_OUT_OF_MEMORY;
         nsAString::iterator begin;
-        str->SetLength(len / 2);
         str->BeginWriting(begin);
 
         reader.GetBytes(begin.get(), len);
@@ -638,8 +644,9 @@ DeserializeResult(ipcMessageReader &reader, const nsXPTType &t, nsXPTCMiniVarian
 
         nsACString *str = (nsACString *) v.val.p;
 
+        if (!str || !(EnsureStringLength(*str, len)))
+          return NS_ERROR_OUT_OF_MEMORY;
         nsACString::iterator begin;
-        str->SetLength(len);
         str->BeginWriting(begin);
 
         reader.GetBytes(begin.get(), len);
@@ -718,6 +725,8 @@ public:
   void OnResponseAvailable(PRUint32 sender, const DConnectOp *op, PRUint32 opLen)
   {
     mReply = (DConnectInvokeReply *) malloc(opLen);
+    if (!mReply)
+      return; // out of memory
     memcpy(mReply, op, opLen);
 
     // the length in bytes of the parameter blob
@@ -1456,6 +1465,7 @@ ipcDConnectService::CreateInstanceByContractID(PRUint32 aPeerID,
 
   DConnectSetupContractID *msg =
       (DConnectSetupContractID *) malloc(size);
+  NS_ENSURE_TRUE(msg, NS_ERROR_OUT_OF_MEMORY);
 
   msg->opcode_minor = DCON_OP_SETUP_NEW_INST_CONTRACTID;
   msg->iid = aIID;
@@ -1492,6 +1502,7 @@ ipcDConnectService::GetServiceByContractID(PRUint32 aPeerID,
 
   DConnectSetupContractID *msg =
       (DConnectSetupContractID *) malloc(size);
+  NS_ENSURE_TRUE(msg, NS_ERROR_OUT_OF_MEMORY);
 
   msg->opcode_minor = DCON_OP_SETUP_GET_SERV_CONTRACTID;
   msg->iid = aIID;
diff --git a/mozilla/layout/base/nsBidiPresUtils.cpp b/mozilla/layout/base/nsBidiPresUtils.cpp
index e9b35579826..53ad158f939 100644
--- a/mozilla/layout/base/nsBidiPresUtils.cpp
+++ b/mozilla/layout/base/nsBidiPresUtils.cpp
@@ -1180,7 +1180,8 @@ nsBidiPresUtils::FormatUnicodeText(nsPresContext*  aPresContext,
     PRInt32    newLen;
 
     if (mBuffer.Length() < aTextLength) {
-      mBuffer.SetLength(aTextLength);
+      if (!EnsureStringLength(mBuffer, aTextLength))
+        return NS_ERROR_OUT_OF_MEMORY;
     }
     PRUnichar* buffer = mBuffer.BeginWriting();
 
@@ -1411,6 +1412,8 @@ nsresult nsBidiPresUtils::RenderText(const PRUnichar*     aText,
       
       nsAutoString runVisualText;
       runVisualText.Assign(aText + start, subRunLength);
+      if (runVisualText.Length() < subRunLength)
+        return NS_ERROR_OUT_OF_MEMORY;
       FormatUnicodeText(aPresContext, runVisualText.BeginWriting(), subRunLength,
                         (nsCharType)charType, level & 1,
                         isBidiSystem);
@@ -1529,7 +1532,8 @@ nsBidiPresUtils::ReorderUnicodeText(PRUnichar*       aText,
     PRInt32    newLen;
 
     if (mBuffer.Length() < aTextLength) {
-      mBuffer.SetLength(aTextLength);
+      if (!EnsureStringLength(mBuffer, aTextLength))
+        return NS_ERROR_OUT_OF_MEMORY;
     }
     PRUnichar* buffer = mBuffer.BeginWriting();
 
diff --git a/mozilla/layout/base/nsBidiUtils.cpp b/mozilla/layout/base/nsBidiUtils.cpp
index 6b4b6c552d1..3ae68bf8b1e 100644
--- a/mozilla/layout/base/nsBidiUtils.cpp
+++ b/mozilla/layout/base/nsBidiUtils.cpp
@@ -277,6 +277,8 @@ nsresult ArabicShaping(const PRUnichar* aString, PRUint32 aLen,
                        PRBool aInputLogical, PRBool aOutputLogical)
 {
   nsAutoString tempString(aString, aLen);
+  if (tempString.Length() != aLen)
+    return NS_ERROR_OUT_OF_MEMORY;
   PRUnichar *tempBuf = tempString.BeginWriting();
   if (aInputLogical) {
     ReverseString(tempBuf, aLen);
diff --git a/mozilla/layout/generic/nsTextTransformer.cpp b/mozilla/layout/generic/nsTextTransformer.cpp
index 9ffe76ce9a5..ebd68c9d637 100644
--- a/mozilla/layout/generic/nsTextTransformer.cpp
+++ b/mozilla/layout/generic/nsTextTransformer.cpp
@@ -1493,6 +1493,11 @@ nsTextTransformer::DoArabicShaping(PRUnichar* aText,
 
   nsAutoString buf;
   buf.SetLength(aTextLength);
+  if (!EnsureStringLength(buf, aTextLength)) {
+    // no way to signal OOM
+    aTextLength = 0;
+    return;
+  }
   PRUnichar* buffer = buf.BeginWriting();
   
   ArabicShaping(aText, buf.Length(), buffer, (PRUint32 *)&newLen, !isVisual, !isVisual);
diff --git a/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp b/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
index 4504cfccf88..9f40b68efb8 100644
--- a/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
+++ b/mozilla/modules/plugin/base/src/nsPluginHostImpl.cpp
@@ -4095,7 +4095,8 @@ static nsresult DoCharsetConversion(nsIUnicodeDecoder *aUnicodeDecoder,
   nsAutoString buffer;
   rv = aUnicodeDecoder->GetMaxLength(aANSIString, numberOfBytes, &outUnicodeLen);
   NS_ENSURE_SUCCESS(rv, rv);
-  buffer.SetCapacity(outUnicodeLen);
+  if (!EnsureStringLength(buffer, outUnicodeLen))
+    return NS_ERROR_OUT_OF_MEMORY;
   rv = aUnicodeDecoder->Convert(aANSIString, &numberOfBytes, buffer.BeginWriting(), &outUnicodeLen);
   NS_ENSURE_SUCCESS(rv, rv);
   buffer.SetLength(outUnicodeLen);
diff --git a/mozilla/netwerk/base/src/nsStandardURL.cpp b/mozilla/netwerk/base/src/nsStandardURL.cpp
index 16a3ba90384..802c7ce8c7b 100644
--- a/mozilla/netwerk/base/src/nsStandardURL.cpp
+++ b/mozilla/netwerk/base/src/nsStandardURL.cpp
@@ -487,7 +487,7 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
     // escape each URL segment, if necessary, and calculate approximate normalized
     // spec length.
     //
-    PRInt32 approxLen = 3; // includes room for "://"
+    PRUint32 approxLen = 3; // includes room for "://"
 
     // the scheme is already ASCII
     if (mScheme.mLen > 0)
@@ -525,7 +525,8 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
     //
     // generate the normalized URL string
     //
-    mSpec.SetLength(approxLen + 32);
+    if (!EnsureStringLength(mSpec, approxLen + 32))
+        return NS_ERROR_OUT_OF_MEMORY;
     char *buf;
     mSpec.BeginWriting(buf);
     PRUint32 i = 0;
@@ -637,6 +638,7 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
         CoalescePath(coalesceFlag, buf + mDirectory.mPos);
     }
     mSpec.SetLength(strlen(buf));
+    NS_ASSERTION(mSpec.Length() <= approxLen+32, "We've overflowed the mSpec buffer!");
     return NS_OK;
 }
 
diff --git a/mozilla/netwerk/cache/src/nsDiskCacheDeviceSQL.cpp b/mozilla/netwerk/cache/src/nsDiskCacheDeviceSQL.cpp
index 45f0ab9eeae..5267a625fc7 100644
--- a/mozilla/netwerk/cache/src/nsDiskCacheDeviceSQL.cpp
+++ b/mozilla/netwerk/cache/src/nsDiskCacheDeviceSQL.cpp
@@ -564,7 +564,8 @@ nsDiskCacheDevice::UpdateEntry(nsCacheEntry *entry)
 
   nsCString metaDataBuf;
   PRUint32 mdSize = entry->MetaDataSize();
-  metaDataBuf.SetLength(mdSize);
+  if (!EnsureStringLength(metaDataBuf, mdSize))
+    return NS_ERROR_OUT_OF_MEMORY;
   char *md = metaDataBuf.BeginWriting();
   entry->FlattenMetaData(md, mdSize);
 
diff --git a/mozilla/netwerk/streamconv/converters/nsDirIndexParser.cpp b/mozilla/netwerk/streamconv/converters/nsDirIndexParser.cpp
index 87459d7e005..6eb8fc07e5b 100644
--- a/mozilla/netwerk/streamconv/converters/nsDirIndexParser.cpp
+++ b/mozilla/netwerk/streamconv/converters/nsDirIndexParser.cpp
@@ -380,8 +380,7 @@ nsDirIndexParser::OnDataAvailable(nsIRequest *aRequest, nsISupports *aCtxt,
   
   // Ensure that our mBuf has capacity to hold the data we're about to
   // read.
-  mBuf.SetCapacity(len + aCount + 1);
-  if (! mBuf.get())
+  if (!EnsureStringLength(mBuf, len + aCount))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // Now read the data into our buffer.
diff --git a/mozilla/parser/htmlparser/src/nsScannerString.cpp b/mozilla/parser/htmlparser/src/nsScannerString.cpp
index 1e18732ef31..29164f9ce37 100644
--- a/mozilla/parser/htmlparser/src/nsScannerString.cpp
+++ b/mozilla/parser/htmlparser/src/nsScannerString.cpp
@@ -489,7 +489,10 @@ CopyUnicodeTo( const nsScannerIterator& aSrcStart,
                nsAString& aDest )
   {
     nsAString::iterator writer;
-    aDest.SetLength(Distance(aSrcStart, aSrcEnd));
+    if (!EnsureStringLength(aDest, Distance(aSrcStart, aSrcEnd))) {
+      aDest.Truncate();
+      return; // out of memory
+    }
     aDest.BeginWriting(writer);
     nsScannerIterator fromBegin(aSrcStart);
     
@@ -519,7 +522,8 @@ AppendUnicodeTo( const nsScannerIterator& aSrcStart,
   {
     nsAString::iterator writer;
     PRUint32 oldLength = aDest.Length();
-    aDest.SetLength(oldLength + Distance(aSrcStart, aSrcEnd));
+    if (!EnsureStringLength(aDest, oldLength + Distance(aSrcStart, aSrcEnd)))
+      return; // out of memory
     aDest.BeginWriting(writer).advance(oldLength);
     nsScannerIterator fromBegin(aSrcStart);
     
diff --git a/mozilla/widget/src/mac/nsMacTSMMessagePump.cpp b/mozilla/widget/src/mac/nsMacTSMMessagePump.cpp
index 14b46208fd7..51e1632041e 100644
--- a/mozilla/widget/src/mac/nsMacTSMMessagePump.cpp
+++ b/mozilla/widget/src/mac/nsMacTSMMessagePump.cpp
@@ -282,7 +282,8 @@ static OSErr AETextToString(AEDesc &aAEDesc, nsString& aOutString, Size& text_si
 
 
   text_size = ::AEGetDescDataSize(&aAEDesc) / 2;
-  aOutString.SetLength(text_size + 1);
+  if (!EnsureStringLength(aOutString, text_size + 1))
+    return memFullErr;
   unicodeTextPtr = aOutString.BeginWriting();
   err = AEGetDescData(&aAEDesc, (void *) unicodeTextPtr, text_size * 2);
   if (err!=noErr) 
diff --git a/mozilla/widget/src/windows/nsWindow.cpp b/mozilla/widget/src/windows/nsWindow.cpp
index b39ff7fce17..6c293d93cac 100644
--- a/mozilla/widget/src/windows/nsWindow.cpp
+++ b/mozilla/widget/src/windows/nsWindow.cpp
@@ -6624,7 +6624,8 @@ void nsWindow::GetCompositionString(HIMC aHIMC, DWORD aIndex, nsString* aStrUnic
 {
   long lRtn;
   lRtn = ::ImmGetCompositionStringW(aHIMC, aIndex, NULL, 0);
-  aStrUnicode->SetCapacity((lRtn / sizeof(WCHAR)) + 1);
+  if (!EnsureStringLength(*aStrUnicode, (lRtn / sizeof(WCHAR)) + 1))
+    return; // out of memory
 
   long buflen = lRtn + sizeof(WCHAR);
   lRtn = ::ImmGetCompositionStringW(aHIMC, aIndex, (LPVOID)aStrUnicode->BeginWriting(), buflen);
diff --git a/mozilla/xpcom/io/nsBinaryStream.cpp b/mozilla/xpcom/io/nsBinaryStream.cpp
index a4b7d117ad6..bb7b99136f1 100644
--- a/mozilla/xpcom/io/nsBinaryStream.cpp
+++ b/mozilla/xpcom/io/nsBinaryStream.cpp
@@ -602,7 +602,9 @@ nsBinaryInputStream::ReadString(nsAString& aString)
     if (NS_FAILED(rv)) return rv;
 
     // pre-allocate output buffer, and get direct access to buffer...
-    aString.SetLength(length);
+    if (!EnsureStringLength(aString, length))
+        return NS_ERROR_OUT_OF_MEMORY;
+
     nsAString::iterator start;
     aString.BeginWriting(start);
     
diff --git a/mozilla/xpcom/io/nsLocalFileWin.cpp b/mozilla/xpcom/io/nsLocalFileWin.cpp
index 1af1423a985..26dc6ee1385 100644
--- a/mozilla/xpcom/io/nsLocalFileWin.cpp
+++ b/mozilla/xpcom/io/nsLocalFileWin.cpp
@@ -2983,7 +2983,8 @@ nsresult nsDriveEnumerator::Init()
      * the length required for the string. */
     DWORD length = GetLogicalDriveStrings(0, 0);
     /* The string is null terminated */
-    mDrives.SetLength(length+1);
+    if (!EnsureStringLength(mDrives, length+1))
+        return NS_ERROR_OUT_OF_MEMORY;
     if (!GetLogicalDriveStrings(length, mDrives.BeginWriting()))
         return NS_ERROR_FAILURE;
     mLetter = mDrives.get();
diff --git a/mozilla/xpcom/io/nsNativeCharsetUtils.cpp b/mozilla/xpcom/io/nsNativeCharsetUtils.cpp
index a3c97e56e6e..9e5a1155ecf 100644
--- a/mozilla/xpcom/io/nsNativeCharsetUtils.cpp
+++ b/mozilla/xpcom/io/nsNativeCharsetUtils.cpp
@@ -818,7 +818,8 @@ NS_CopyNativeToUnicode(const nsACString &input, nsAString &output)
     // this will generally result in a larger allocation, but that seems
     // better than an extra buffer copy.
     //
-    output.SetLength(inputLen);
+    if (!EnsureStringLength(output, inputLen))
+        return NS_ERROR_OUT_OF_MEMORY;
     nsAString::iterator out_iter;
     output.BeginWriting(out_iter);
 
@@ -901,6 +902,7 @@ NS_ShutdownNativeCharsetUtils()
 
 #include <windows.h>
 #include "nsAString.h"
+#include "nsReadableUtils.h"
 
 NS_COM nsresult
 NS_CopyNativeToUnicode(const nsACString &input, nsAString &output)
@@ -919,7 +921,8 @@ NS_CopyNativeToUnicode(const nsACString &input, nsAString &output)
         resultLen += n;
 
     // allocate sufficient space
-    output.SetLength(resultLen);
+    if (!EnsureStringLength(output, resultLen))
+        return NS_ERROR_OUT_OF_MEMORY;
     if (resultLen > 0) {
         nsAString::iterator out_iter;
         output.BeginWriting(out_iter);
@@ -949,7 +952,8 @@ NS_CopyUnicodeToNative(const nsAString  &input, nsACString &output)
         resultLen += n;
 
     // allocate sufficient space
-    output.SetLength(resultLen);
+    if (!EnsureStringLength(output, resultLen))
+        return NS_ERROR_OUT_OF_MEMORY;
     if (resultLen > 0) {
         nsACString::iterator out_iter;
         output.BeginWriting(out_iter);
@@ -1011,6 +1015,7 @@ NS_ConvertWtoA(const PRUnichar *aStrInW, int aBufferSizeOut,
 #include <os2.h>
 #include <uconv.h>
 #include "nsAString.h"
+#include "nsReadableUtils.h"
 #include <ulserrno.h>
 #include "nsNativeCharsetUtils.h"
 
@@ -1027,7 +1032,8 @@ NS_CopyNativeToUnicode(const nsACString &input, nsAString  &output)
 
     // determine length of result
     PRUint32 resultLen = inputLen;
-    output.SetLength(resultLen);
+    if (!EnsureStringLength(output, resultLen))
+        return NS_ERROR_OUT_OF_MEMORY;
 
     nsAString::iterator out_iter;
     output.BeginWriting(out_iter);
@@ -1067,7 +1073,8 @@ NS_CopyUnicodeToNative(const nsAString &input, nsACString &output)
     // maximum length of unicode string of length x converted to native
     // codepage is x*2
     size_t resultLen = inputLen * 2;
-    output.SetLength(resultLen);
+    if (!EnsureStringLength(output, resultLen))
+        return NS_ERROR_OUT_OF_MEMORY;
 
     nsACString::iterator out_iter;
     output.BeginWriting(out_iter);
@@ -1134,6 +1141,7 @@ NS_ShutdownNativeCharsetUtils()
 #include <Script.h>
 #include <MacErrors.h>
 #include "nsAString.h"
+#include "nsReadableUtils.h"
 
 class nsFSStringConversionMac {
 public:
diff --git a/mozilla/xpcom/string/public/nsReadableUtils.h b/mozilla/xpcom/string/public/nsReadableUtils.h
index 6de8205e225..fee6741d6a5 100755
--- a/mozilla/xpcom/string/public/nsReadableUtils.h
+++ b/mozilla/xpcom/string/public/nsReadableUtils.h
@@ -371,4 +371,16 @@ CompareUTF8toUTF16(const nsASingleFragmentCString& aUTF8String,
 NS_COM void
 AppendUCS4ToUTF16(const PRUint32 aSource, nsAString& aDest);
 
+inline PRBool EnsureStringLength(nsAString &aStr, PRUint32 aLen)
+{
+    aStr.SetLength(aLen);
+    return (aStr.Length() == aLen);
+}
+
+inline PRBool EnsureStringLength(nsACString &aStr, PRUint32 aLen)
+{
+    aStr.SetLength(aLen);
+    return (aStr.Length() == aLen);
+}
+
 #endif // !defined(nsReadableUtils_h___)