https://git.reactos.org/?p=reactos.git;a=commitdiff;h=de455c4d50e6ba3b1d6b2897618feadb54a5e37f
commit de455c4d50e6ba3b1d6b2897618feadb54a5e37f Author: Thomas Faber <[email protected]> AuthorDate: Thu Feb 1 11:06:50 2018 +0100 Commit: Thomas Faber <[email protected]> CommitDate: Sun Feb 18 11:27:29 2018 +0100 [WIN32K:NTUSER] Handle realloc failure in IntRemoveMenuItem. CORE-14222 --- win32ss/user/ntuser/menu.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c index 8432f3a83f..5ecffbb8e3 100644 --- a/win32ss/user/ntuser/menu.c +++ b/win32ss/user/ntuser/menu.c @@ -598,6 +598,7 @@ BOOL FASTCALL IntRemoveMenuItem( PMENU pMenu, UINT nPos, UINT wFlags, BOOL bRecurse ) { PITEM item; + PITEM newItems; TRACE("(menu=%p pos=%04x flags=%04x)\n",pMenu, nPos, wFlags); if (!(item = MENU_FindItem( &pMenu, &nPos, wFlags ))) return FALSE; @@ -617,13 +618,17 @@ IntRemoveMenuItem( PMENU pMenu, UINT nPos, UINT wFlags, BOOL bRecurse ) } else { - while(nPos < pMenu->cItems) - { - *item = *(item+1); - item++; - nPos++; - } - pMenu->rgItems = DesktopHeapReAlloc(pMenu->head.rpdesk, pMenu->rgItems, pMenu->cItems * sizeof(ITEM)); + while (nPos < pMenu->cItems) + { + *item = *(item+1); + item++; + nPos++; + } + newItems = DesktopHeapReAlloc(pMenu->head.rpdesk, pMenu->rgItems, pMenu->cItems * sizeof(ITEM)); + if (newItems) + { + pMenu->rgItems = newItems; + } } return TRUE; }
