Integer overflow in Lists_MakeMask() leads to buffer overflow.
vulners.com/securityvulns/securityvulns:doc:7710