diff --git a/dlls/comctl32/comctl32undoc.c b/dlls/comctl32/comctl32undoc.c
index 0415000a1243b938b5502a9c95fce0afaefceecc..6342170b1239409cb8384679d3bc02f1144ce840 100644
--- a/dlls/comctl32/comctl32undoc.c
+++ b/dlls/comctl32/comctl32undoc.c
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <stdlib.h> /* atoi */
 #include <ctype.h>
+#include <limits.h>
 
 #include "commctrl.h"
 #include "objbase.h"
@@ -109,6 +110,9 @@ DPA_LoadStream (HDPA *phDpa, DPALOADPROC loadProc, IStream *pStream, LPARAM lPar
 	errCode = E_FAIL;
     }
 
+    if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */
+        return E_OUTOFMEMORY;
+
     /* create the dpa */
     hDpa = DPA_Create (streamData.dwItems);
     if (!hDpa)