Index: loaders/load_it.c
===================================================================
--- loaders/load_it.c.orig
+++ loaders/load_it.c
@@ -862,6 +862,11 @@ BOOL IT_Load(BOOL curious)
 #endif
 
 				IT_ProcessEnvelope(vol);
+			
+				// Secunia SA37775
+				if (ih.volpts>= ENVPOINTS)
+					ih.volpts = ENVPOINTS-1;
+				
 				for(u=0;u<ih.volpts;u++)
 					d->volenv[u].val=(ih.volnode[u]<<2);
 
Index: loaders/load_ult.c
===================================================================
--- loaders/load_ult.c.orig
+++ loaders/load_ult.c
@@ -225,6 +225,10 @@ BOOL ULT_Load(BOOL curious)
 		for(t=0;t<of.numpat;t++)
 			of.patterns[(t*of.numchn)+u]=tracks++;
 
+	// SA37775
+	if (of.numchn>=UF_MAXCHAN)
+		of.numchn=UF_MAXCHAN - 1;
+	
 	/* read pan position table for v1.5 and higher */
 	if(mh.id[14]>='3') {
 		for(t=0;t<of.numchn;t++) of.panning[t]=_mm_read_UBYTE(modreader)<<4;