diff --git a/dlls/comctl32/comctl32undoc.c b/dlls/comctl32/comctl32undoc.c index 0415000a1243b938b5502a9c95fce0afaefceecc..6342170b1239409cb8384679d3bc02f1144ce840 100644 --- a/dlls/comctl32/comctl32undoc.c +++ b/dlls/comctl32/comctl32undoc.c @@ -19,6 +19,7 @@ #include <string.h> #include <stdlib.h> /* atoi */ #include <ctype.h> +#include <limits.h> #include "commctrl.h" #include "objbase.h" @@ -109,6 +110,9 @@ DPA_LoadStream (HDPA *phDpa, DPALOADPROC loadProc, IStream *pStream, LPARAM lPar errCode = E_FAIL; } + if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */ + return E_OUTOFMEMORY; + /* create the dpa */ hDpa = DPA_Create (streamData.dwItems); if (!hDpa)