Index: sdk/lib/3rdparty/freetype/src/smooth/ftgrays.c
===================================================================
--- sdk/lib/3rdparty/freetype/src/smooth/ftgrays.c	(revision 72648)
+++ sdk/lib/3rdparty/freetype/src/smooth/ftgrays.c	(working copy)
@@ -1932,12 +1932,19 @@
         TCoord  bottom, top, middle;
         int     error;
 
-
         /* memory management */
         {
           size_t  ycount = (size_t)( band->max - band->min );
           size_t  cell_start;
 
+          /* check memory boundaries*/
+#ifdef __REACTOS__
+          if (ycount >= (FT_MAX(FT_RENDER_POOL_SIZE, 2048) / sizeof(ycount)))
+          {
+              free(buffer);
+              return 1;
+          }
+#endif
 
           cell_start = ( ycount * sizeof ( PCell ) + sizeof ( TCell ) - 1 ) /
                        sizeof ( TCell );