diff --git a/content/html/content/src/HTMLInputElement.cpp b/content/html/content/src/HTMLInputElement.cpp
index 6e6d247769f..a4c4153e765 100644
--- a/content/html/content/src/HTMLInputElement.cpp
+++ b/content/html/content/src/HTMLInputElement.cpp
@@ -4671,10 +4671,18 @@ HTMLInputElement::GetValueAsDate(const nsAString& aValue,
return false;
}
- uint32_t endOfYearOffset = aValue.Length() - 6;
+ uint32_t endOfYearOffset = 0;
+ for (; NS_IsAsciiDigit(aValue[endOfYearOffset]); ++endOfYearOffset);
- if (aValue[endOfYearOffset] != '-' ||
- aValue[endOfYearOffset + 3] != '-') {
+ // The year must be at least 4 digits long.
+ if (aValue[endOfYearOffset] != '-' || endOfYearOffset < 4) {
+ return false;
+ }
+
+ // Now, we know where is the next '-' and what should be the size of the
+ // string.
+ if (aValue[endOfYearOffset + 3] != '-' ||
+ aValue.Length() != 10 + (endOfYearOffset - 4)) {
return false;
}