diff -up kdelibs-4.2.4/khtml/ecma/kjs_html.cpp.cve-2009-2537-select-length kdelibs-4.2.4/khtml/ecma/kjs_html.cpp
--- kdelibs-4.2.4/khtml/ecma/kjs_html.cpp.cve-2009-2537-select-length	2009-03-26 15:44:13.000000000 +0100
+++ kdelibs-4.2.4/khtml/ecma/kjs_html.cpp	2009-07-23 10:35:55.908865609 +0200
@@ -69,6 +69,9 @@
 #include <QtCore/QList>
 #include <QtCore/QHash>
 
+// CVE-2009-2537 (vendors agreed on max 10000 elements)
+#define MAX_SELECT_LENGTH 10000
+
 using namespace DOM;
 
 namespace KJS {
@@ -2428,8 +2431,12 @@ void KJS::HTMLElement::putValueProperty(
       case SelectValue:           { select.setValue(str.implementation()); return; }
       case SelectLength:          { // read-only according to the NS spec, but webpages need it writeable
                                          JSObject *coll = getSelectHTMLCollection(exec, select.options(), &select)->getObject();
+
                                          if ( coll )
-                                           coll->put(exec,"length",value);
+                                           if (value->toInteger(exec) >= MAX_SELECT_LENGTH)
+                                             setDOMException(exec, DOMException::INDEX_SIZE_ERR);
+                                           else
+                                             coll->put(exec, "length", value);
                                          return;
                                        }
       // read-only: form