comctl32/dsa: Handle overflow in DSA_InsertItem().

Signed-off-by: Xiaoshan Sun <sunxs@is.iscas.ac.cn> Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

comctl32/dsa: Handle overflow in DSA_InsertItem().
0d57ff3d · Xiaoshan Sun · Alexandre Julliard · 430108c9 · 0d57ff3d
Commit 0d57ff3d authored Jul 24, 2016 by Xiaoshan Sun Committed by Alexandre Julliard Jul 25, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

dsa.c dlls/comctl32/dsa.c +3 -0

No files found.
--- a/dlls/comctl32/dsa.c
+++ b/dlls/comctl32/dsa.c
@@ -267,6 +267,9 @@ INT WINAPI DSA_InsertItem (HDSA hdsa, INT nIndex, LPVOID pSrc)
        nNewItems = hdsa->nMaxCount + hdsa->nGrow;
        nSize = hdsa->nItemSize * nNewItems;

+        if (nSize / hdsa->nItemSize != nNewItems)
+            return -1;
+
        lpTemp = ReAlloc (hdsa->pData, nSize);
        if (!lpTemp)
            return -1;