1 files changed, 4 insertions, 1 deletions
diff --git a/JavaScriptCore/API/JSStringRefCF.cpp b/JavaScriptCore/API/JSStringRefCF.cpp
index 2b8fd9e..d1f6fe3 100644
--- a/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/JavaScriptCore/API/JSStringRefCF.cpp
@@ -37,7 +37,10 @@
 JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
     JSC::initializeThreading();
-    CFIndex length = CFStringGetLength(string);
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());