diff --git a/netwerk/streamconv/converters/nsDirIndexParser.cpp b/netwerk/streamconv/converters/nsDirIndexParser.cpp
index 295fe7e0bdb6..6501cfac1fc2 100644
--- a/netwerk/streamconv/converters/nsDirIndexParser.cpp
+++ b/netwerk/streamconv/converters/nsDirIndexParser.cpp
@@ -350,10 +350,13 @@ nsDirIndexParser::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* aStream,
                                   uint64_t aSourceOffset, uint32_t aCount) {
   if (aCount < 1) return NS_OK;
 
-  int32_t len = mBuf.Length();
+  uint32_t len = mBuf.Length();
 
   // Ensure that our mBuf has capacity to hold the data we're about to
   // read.
+  // Before adjusting the capacity, guard against any potential overflow
+  // resulting from the addition of aCount with len. See Bug 1823551.
+  NS_ENSURE_TRUE((UINT32_MAX - aCount) >= len, NS_ERROR_FAILURE);
   if (!mBuf.SetLength(len + aCount, fallible)) return NS_ERROR_OUT_OF_MEMORY;
 
   // Now read the data into our buffer.