Integer Overflow

thunderbird and firefox are vulnerable to integer overflow. The vulnerability exists in ReplaceElementsAt function because the number of elements to replace was too large for the container causing an integer overflow which then leads to an application crash...