Bug 630056 (CVE-2010-2765)

Security researcher Chris Rohlf of Matasano Security reported that the
implementation of the HTML frameset element contained an integer overflow
vulnerability. The code responsible for parsing the frameset columns used
an 8-byte counter for the column numbers, so when a very large number of
columns was passed in the counter would overflow. When this counter was
subsequently used to allocate memory for the frameset, the memory buffer
would be too small, potentially resulting in a heap buffer overflow and
execution of attacker-controlled memory.