Matteo Bruni (@Mystral) commented about dlls/d3dcompiler_43/reflection.c:
} memcpy(string_data, data + string_data_offset, string_data_size);
bound_resources = HeapAlloc(GetProcessHeap(), 0, r->bound_resource_count * sizeof(*bound_resources));
bound_resources = malloc(r->bound_resource_count * sizeof(*bound_resources));
While we're at it, it seems preferable to replace this one with a calloc() so that we get overflow detection for free.