The application again the bug, passed 1 as the elem parameter which doubled the memory being allocated. When it overflowed (became negative), the value was passed into GlobalAlloc16 which then failed.
GlobalAlloc16 takes a DWORD parameter, so the value isn't going to be truncated.
Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=53092
Original patch by github user cracyc for winevdm.