diff --git a/string/obsolete/nsString.cpp b/string/obsolete/nsString.cpp
index 5e4e4c7f42f5..6c018e193378 100644
--- a/string/obsolete/nsString.cpp
+++ b/string/obsolete/nsString.cpp
@@ -464,19 +464,24 @@ nsCString::CompressWhitespace( PRBool aEliminateLeading,PRBool aEliminateTrailin
  * @return  float rep of string value
  */
 float nsCString::ToFloat(PRInt32* aErrorCode) const {
-  char buf[100];
-  if (mLength > PRInt32(sizeof(buf)-1)) {
-    *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
-    return 0.0f;
+  float res = 0.0f;
+  if (mLength > 0) {
+    char *conv_stopped;
+    const char *str = get();
+    res = (float)strtod(str, &conv_stopped);
+    if (conv_stopped == str+mLength) {
+      *aErrorCode = (PRInt32) NS_OK;
+    }
+    else {
+      /* Not all the string was scanned */
+      *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
+    }
   }
-  char *cp = strncpy(buf, get(), sizeof(buf) - 1);
-  buf[sizeof(buf)-1] = '\0';
-  float f = (float) PR_strtod(cp, &cp);
-  if (*cp != 0) {
+  else {
+    /* The string was too short (0 characters) */
     *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
   }
-  *aErrorCode = (PRInt32) NS_OK;
-  return f;
+  return res;
 }
 
 /**
diff --git a/string/obsolete/nsString2.cpp b/string/obsolete/nsString2.cpp
index 8a6043a0a988..a696fe432f23 100644
--- a/string/obsolete/nsString2.cpp
+++ b/string/obsolete/nsString2.cpp
@@ -536,18 +536,25 @@ char* nsString::ToCString(char* aBuf, PRUint32 aBufLength,PRUint32 anOffset) con
  * @return  float rep of string value
  */
 float nsString::ToFloat(PRInt32* aErrorCode) const {
+  float res = 0.0f;
   char buf[100];
-  if (mLength > PRInt32(sizeof(buf)-1)) {
-    *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
-    return 0.0f;
+  if (mLength > 0 && mLength < sizeof(buf)) {
+    char *conv_stopped;
+    const char *str = ToCString(buf, sizeof(buf));
+    res = (float)strtod(str, &conv_stopped);
+    if (*conv_stopped == '\0') {
+      *aErrorCode = (PRInt32) NS_OK;
+    }
+    else {
+      /* Not all the string was scanned */
+      *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
+    }
   }
-  char* cp = ToCString(buf, sizeof(buf));
-  float f = (float) PR_strtod(cp, &cp);
-  if (*cp != 0) {
+  else {
+    /* The string was too short (0 characters) or too long (sizeof(buf)) */
     *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
   }
-  *aErrorCode = (PRInt32) NS_OK;
-  return f;
+  return res;
 }
 
 
diff --git a/xpcom/string/obsolete/nsString.cpp b/xpcom/string/obsolete/nsString.cpp
index 5e4e4c7f42f5..6c018e193378 100644
--- a/xpcom/string/obsolete/nsString.cpp
+++ b/xpcom/string/obsolete/nsString.cpp
@@ -464,19 +464,24 @@ nsCString::CompressWhitespace( PRBool aEliminateLeading,PRBool aEliminateTrailin
  * @return  float rep of string value
  */
 float nsCString::ToFloat(PRInt32* aErrorCode) const {
-  char buf[100];
-  if (mLength > PRInt32(sizeof(buf)-1)) {
-    *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
-    return 0.0f;
+  float res = 0.0f;
+  if (mLength > 0) {
+    char *conv_stopped;
+    const char *str = get();
+    res = (float)strtod(str, &conv_stopped);
+    if (conv_stopped == str+mLength) {
+      *aErrorCode = (PRInt32) NS_OK;
+    }
+    else {
+      /* Not all the string was scanned */
+      *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
+    }
   }
-  char *cp = strncpy(buf, get(), sizeof(buf) - 1);
-  buf[sizeof(buf)-1] = '\0';
-  float f = (float) PR_strtod(cp, &cp);
-  if (*cp != 0) {
+  else {
+    /* The string was too short (0 characters) */
     *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
   }
-  *aErrorCode = (PRInt32) NS_OK;
-  return f;
+  return res;
 }
 
 /**
diff --git a/xpcom/string/obsolete/nsString2.cpp b/xpcom/string/obsolete/nsString2.cpp
index 8a6043a0a988..a696fe432f23 100644
--- a/xpcom/string/obsolete/nsString2.cpp
+++ b/xpcom/string/obsolete/nsString2.cpp
@@ -536,18 +536,25 @@ char* nsString::ToCString(char* aBuf, PRUint32 aBufLength,PRUint32 anOffset) con
  * @return  float rep of string value
  */
 float nsString::ToFloat(PRInt32* aErrorCode) const {
+  float res = 0.0f;
   char buf[100];
-  if (mLength > PRInt32(sizeof(buf)-1)) {
-    *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
-    return 0.0f;
+  if (mLength > 0 && mLength < sizeof(buf)) {
+    char *conv_stopped;
+    const char *str = ToCString(buf, sizeof(buf));
+    res = (float)strtod(str, &conv_stopped);
+    if (*conv_stopped == '\0') {
+      *aErrorCode = (PRInt32) NS_OK;
+    }
+    else {
+      /* Not all the string was scanned */
+      *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
+    }
   }
-  char* cp = ToCString(buf, sizeof(buf));
-  float f = (float) PR_strtod(cp, &cp);
-  if (*cp != 0) {
+  else {
+    /* The string was too short (0 characters) or too long (sizeof(buf)) */
     *aErrorCode = (PRInt32) NS_ERROR_ILLEGAL_VALUE;
   }
-  *aErrorCode = (PRInt32) NS_OK;
-  return f;
+  return res;
 }