[PATCH 6/6] dplayx: Prevent multiplication overflow in DP_MSG_ReadSuperPackedPlayer().

[Anton Baskanov]

From: Anton Baskanov

---
 dlls/dplayx/dplayx_messages.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dlls/dplayx/dplayx_messages.c b/dlls/dplayx/dplayx_messages.c
index 26f2dc4e8e9..6f71f04440d 100644
--- a/dlls/dplayx/dplayx_messages.c
+++ b/dlls/dplayx/dplayx_messages.c
@@ -510,6 +510,8 @@ static HRESULT DP_MSG_ReadSuperPackedPlayer( char *data, DWORD *inoutOffset, DWO

if( playerInfo->playerCount )
   {
+    if( UINT_MAX / sizeof( DPID ) < playerInfo->playerCount )
+      return DPERR_GENERIC;
     if( maxSize - offset < playerInfo->playerCount * sizeof( DPID ) )
       return DPERR_GENERIC;
     playerInfo->playerIds = (DPID *) &data[ offset ];
@@ -532,6 +534,8 @@ static HRESULT DP_MSG_ReadSuperPackedPlayer( char *data, DWORD *inoutOffset, DWO

if( playerInfo->shortcutCount )
   {
+    if( UINT_MAX / sizeof( DPID ) < playerInfo->shortcutCount )
+      return DPERR_GENERIC;
     if( maxSize - offset < playerInfo->shortcutCount * sizeof( DPID ) )
       return DPERR_GENERIC;
     playerInfo->shortcutIds = (DPID *) &data[ offset ];