Apple WebKit library ROWSPAN DoS

NULL pointer dereference on large rowspan number in HTTP parsing code...