From: Anton Baskanov <baskanov(a)gmail.com> --- dlls/dplayx/dplayx_messages.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dlls/dplayx/dplayx_messages.c b/dlls/dplayx/dplayx_messages.c index 26f2dc4e8e9..6f71f04440d 100644 --- a/dlls/dplayx/dplayx_messages.c +++ b/dlls/dplayx/dplayx_messages.c @@ -510,6 +510,8 @@ static HRESULT DP_MSG_ReadSuperPackedPlayer( char *data, DWORD *inoutOffset, DWO if( playerInfo->playerCount ) { + if( UINT_MAX / sizeof( DPID ) < playerInfo->playerCount ) + return DPERR_GENERIC; if( maxSize - offset < playerInfo->playerCount * sizeof( DPID ) ) return DPERR_GENERIC; playerInfo->playerIds = (DPID *) &data[ offset ]; @@ -532,6 +534,8 @@ static HRESULT DP_MSG_ReadSuperPackedPlayer( char *data, DWORD *inoutOffset, DWO if( playerInfo->shortcutCount ) { + if( UINT_MAX / sizeof( DPID ) < playerInfo->shortcutCount ) + return DPERR_GENERIC; if( maxSize - offset < playerInfo->shortcutCount * sizeof( DPID ) ) return DPERR_GENERIC; playerInfo->shortcutIds = (DPID *) &data[ offset ]; -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/6659