From ca2f40bd9aae49676c363a09430d44ad25102cf6 Mon Sep 17 00:00:00 2001
From: Aric Stewart <aric@codeweavers.com>
Date: Tue, 15 Jan 2002 20:43:05 +0000
Subject: [PATCH] Catch maximum number of times and return out of memory error.

---
 dlls/comctl32/comctl32undoc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dlls/comctl32/comctl32undoc.c b/dlls/comctl32/comctl32undoc.c
index 0415000a124..6342170b123 100644
--- a/dlls/comctl32/comctl32undoc.c
+++ b/dlls/comctl32/comctl32undoc.c
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <stdlib.h> /* atoi */
 #include <ctype.h>
+#include <limits.h>
 
 #include "commctrl.h"
 #include "objbase.h"
@@ -109,6 +110,9 @@ DPA_LoadStream (HDPA *phDpa, DPALOADPROC loadProc, IStream *pStream, LPARAM lPar
 	errCode = E_FAIL;
     }
 
+    if (streamData.dwItems > (UINT_MAX / 2 / sizeof(VOID*))) /* 536870911 */
+        return E_OUTOFMEMORY;
+
     /* create the dpa */
     hDpa = DPA_Create (streamData.dwItems);
     if (!hDpa)
-- 
GitLab