Module: wine Branch: stable Commit: 8f7e06418c06ed41754f9a0b37585ead64cd2ded URL: http://source.winehq.org/git/wine.git/?a=commit;h=8f7e06418c06ed41754f9a0b37... Author: Xiaoshan Sun <sunxs(a)is.iscas.ac.cn> Date: Sun Jul 24 14:44:40 2016 +0300 comctl32/dsa: Handle overflow in DSA_InsertItem(). Signed-off-by: Xiaoshan Sun <sunxs(a)is.iscas.ac.cn> Signed-off-by: Nikolay Sivov <nsivov(a)codeweavers.com> Signed-off-by: Alexandre Julliard <julliard(a)winehq.org> (cherry picked from commit 0d57ff3d1f63f7486733f8619f3916867ebd26c5) Signed-off-by: Michael Stefaniuc <mstefani(a)winehq.org> --- dlls/comctl32/dsa.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dlls/comctl32/dsa.c b/dlls/comctl32/dsa.c index a73a54a..d5e8234 100644 --- a/dlls/comctl32/dsa.c +++ b/dlls/comctl32/dsa.c @@ -267,6 +267,9 @@ INT WINAPI DSA_InsertItem (HDSA hdsa, INT nIndex, LPVOID pSrc) nNewItems = hdsa->nMaxCount + hdsa->nGrow; nSize = hdsa->nItemSize * nNewItems; + if (nSize / hdsa->nItemSize != nNewItems) + return -1; + lpTemp = ReAlloc (hdsa->pData, nSize); if (!lpTemp) return -1;