From 4980cab4b03582c46f46fcefe51c71a799ededf5 Mon Sep 17 00:00:00 2001
From: Karl Tomlinson <karlt+@karlt.net>
Date: Fri, 16 May 2014 09:23:38 +1200
Subject: [PATCH] b=991533 limit AudioBuffer channel count r=padenot

--HG--
extra : transplant_source : %28%F0%2Cc%FE%60%B3%EE%A0O%3F%E6%C4%C4%F9%88%1C%E3%89%09
---
 content/media/webaudio/AudioBuffer.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/media/webaudio/AudioBuffer.cpp b/content/media/webaudio/AudioBuffer.cpp
index 65991779f3a..eb968107372 100644
--- a/content/media/webaudio/AudioBuffer.cpp
+++ b/content/media/webaudio/AudioBuffer.cpp
@@ -74,6 +74,7 @@ AudioBuffer::Create(AudioContext* aContext, uint32_t aNumberOfChannels,
   // to createScriptProcessor(), one of which may be zero.
   if (aSampleRate < WebAudioUtils::MinSampleRate ||
       aSampleRate > WebAudioUtils::MaxSampleRate ||
+      aNumberOfChannels > WebAudioUtils::MaxChannelCount ||
       !aLength || aLength > INT32_MAX) {
     aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
     return nullptr;