Index: dir.c
===================================================================
--- dir.c	(revision 41257)
+++ dir.c	(working copy)
@@ -885,7 +886,7 @@
                     goto Cleanup;
         }
 
-        BufferU.MaximumLength = (USHORT)nBufferLength * sizeof(WCHAR);
+        BufferU.MaximumLength = min(nBufferLength * sizeof(WCHAR), USHRT_MAX);
         BufferU.Buffer = RtlAllocateHeap (RtlGetProcessHeap (),
                                           0,
                                           BufferU.MaximumLength);
@@ -895,7 +896,7 @@
             goto Cleanup;
         }
 
-        Buffer.MaximumLength = (USHORT)nBufferLength;
+        Buffer.MaximumLength = min(nBufferLength, USHRT_MAX);
         Buffer.Buffer = lpBuffer;
 
         RetValue = SearchPathW (NULL == lpPath ? NULL : PathU.Buffer,