Do some bounds checking on iOrder.

diff --git a/dlls/comctl32/header.c b/dlls/comctl32/header.c
index 356f312..e185ad4 100644
--- a/dlls/comctl32/header.c
+++ b/dlls/comctl32/header.c
@@ -930,6 +930,10 @@
         nItem = infoPtr->uNumItem;
 
     iOrder = (phdi->mask & HDI_ORDER) ? phdi->iOrder : nItem;
+    if (iOrder < 0)
+        iOrder = 0;
+    else if (infoPtr->uNumItem < iOrder)
+        iOrder = infoPtr->uNumItem;
 
     if (infoPtr->uNumItem == 0) {
         infoPtr->items = Alloc (sizeof (HEADER_ITEM));