1 files changed, 11 insertions, 1 deletions
diff --git a/intl/uconv/ucvtw/nsBIG5ToUnicode.cpp b/intl/uconv/ucvtw/nsBIG5ToUnicode.cpp
index 8dbf84a14..b07df3d76 100644
--- a/intl/uconv/ucvtw/nsBIG5ToUnicode.cpp
+++ b/intl/uconv/ucvtw/nsBIG5ToUnicode.cpp
@@ -152,7 +152,17 @@ nsBIG5ToUnicode::GetMaxLength(const char* aSrc,
 {
   // The length of the output in UTF-16 code units never exceeds the length
   // of the input in bytes.
-  *aDestLength = aSrcLength + (mPendingTrail ? 1 : 0) + (mBig5Lead ? 1 : 0);
+  mozilla::CheckedInt32 length = aSrcLength;
+  if (mPendingTrail) {
+    length += 1;
+  }
+  if (mBig5Lead) {
+    length += 1;
+  }
+  if (!length.isValid()) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  *aDestLength = length.value();
   return NS_OK;
 }