Bug 463038 - Cap the number of watchPostion callbacks and the number of pending callbacks. r/sr = jst

dom/src/geolocation/nsGeolocation.cpp

@@ -58,6 +58,10 @@
 #include "nsIDOMDocument.h"
 #include "nsIDocument.h"
 
+// Some limit to the number of get or watch geolocation requests
+// that a window can make.
+#define MAX_GEO_REQUESTS_PER_WINDOW  1500
+
 ////////////////////////////////////////////////////
 // nsDOMGeoPositionError
 ////////////////////////////////////////////////////
@@ -724,11 +728,13 @@ nsGeolocation::GetCurrentPosition(nsIDOMGeoPositionCallback *callback,
                                   nsIDOMGeoPositionErrorCallback *errorCallback,
                                   nsIDOMGeoPositionOptions *options)
 {
-
   nsCOMPtr<nsIGeolocationPrompt> prompt = do_GetService(NS_GEOLOCATION_PROMPT_CONTRACTID);
   if (prompt == nsnull)
     return NS_ERROR_NOT_AVAILABLE;
 
+  if (mPendingCallbacks.Length() > MAX_GEO_REQUESTS_PER_WINDOW)
+    return NS_ERROR_NOT_AVAILABLE;
+
   nsRefPtr<nsGeolocationRequest> request = new nsGeolocationRequest(this, callback, errorCallback, options);
   if (!request)
     return NS_ERROR_OUT_OF_MEMORY;
@@ -753,6 +759,9 @@ nsGeolocation::WatchPosition(nsIDOMGeoPositionCallback *aCallback,
   if (prompt == nsnull)
     return NS_ERROR_NOT_AVAILABLE;
 
+  if (mWatchingCallbacks.Length() > MAX_GEO_REQUESTS_PER_WINDOW)
+    return NS_ERROR_NOT_AVAILABLE;
+
   nsRefPtr<nsGeolocationRequest> request = new nsGeolocationRequest(this, aCallback, aErrorCallback, aOptions);
   if (!request)
     return NS_ERROR_OUT_OF_MEMORY;

dom/src/geolocation/nsGeolocation.h

@@ -97,7 +97,6 @@ class nsGeolocationRequest : public nsIGeolocationRequest, public nsITimerCallba
   nsCOMPtr<nsIDOMGeoPositionOptions> mOptions;
 
   nsGeolocation* mLocator; // The locator exists longer than this object.
-
 };
 
 /**