1 files changed, 1 insertions, 1 deletions
diff --git a/Source/WebCore/html/canvas/DataView.h b/Source/WebCore/html/canvas/DataView.h
index 5707aa3..a8aba5c 100755
--- a/Source/WebCore/html/canvas/DataView.h
+++ b/Source/WebCore/html/canvas/DataView.h
@@ -75,7 +75,7 @@ private:
     DataView(PassRefPtr<ArrayBuffer>, unsigned byteOffset, unsigned byteLength);
 
     template<typename T>
-    inline bool beyondRange(unsigned byteOffset) const { return byteOffset + sizeof(T) > m_byteLength; }
+    inline bool beyondRange(unsigned byteOffset) const { return byteOffset >= m_byteLength || byteOffset + sizeof(T) > m_byteLength; }
 
     template<typename T>
     T getData(unsigned byteOffset, bool littleEndian, ExceptionCode&) const;