Merge 107999

Source/WebCore/css/CSSParser.cpp

Index: Source/WebCore/css/CSSParser.cpp
===================================================================
--- Source/WebCore/css/CSSParser.cpp	(revision 109988)
+++ Source/WebCore/css/CSSParser.cpp	(working copy)
@@ -9276,6 +9276,11 @@
 // We use single quotes for now because markup.cpp uses double quotes.
 String quoteCSSString(const String& string)
 {
+    // This function expands each character to at most 3 characters ('\u0010' -> '\' '1' '0') as well as adds
+    // 2 quote characters (before and after). Make sure the resulting size (3 * length + 2) will not overflow unsigned.
+    if (string.length() >= (std::numeric_limits<unsigned>::max() / 3) - 2)
+        return "";
+
     // For efficiency, we first pre-calculate the length of the quoted string, then we build the actual one.
     // Please see below for the actual logic.
     unsigned quotedStringSize = 2; // Two quotes surrounding the entire string.