From 0d57ff3d1f63f7486733f8619f3916867ebd26c5 Mon Sep 17 00:00:00 2001
From: Xiaoshan Sun <sunxs@is.iscas.ac.cn>
Date: Sun, 24 Jul 2016 14:44:40 +0300
Subject: [PATCH] comctl32/dsa: Handle overflow in DSA_InsertItem().

Signed-off-by: Xiaoshan Sun <sunxs@is.iscas.ac.cn>
Signed-off-by: Nikolay Sivov <nsivov@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/comctl32/dsa.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dlls/comctl32/dsa.c b/dlls/comctl32/dsa.c
index a73a54ad742..d5e82343fbd 100644
--- a/dlls/comctl32/dsa.c
+++ b/dlls/comctl32/dsa.c
@@ -267,6 +267,9 @@ INT WINAPI DSA_InsertItem (HDSA hdsa, INT nIndex, LPVOID pSrc)
         nNewItems = hdsa->nMaxCount + hdsa->nGrow;
         nSize = hdsa->nItemSize * nNewItems;
 
+        if (nSize / hdsa->nItemSize != nNewItems)
+            return -1;
+
         lpTemp = ReAlloc (hdsa->pData, nSize);
         if (!lpTemp)
             return -1;