From 965df2ffd23b6962876a250161bc53de669b4dd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herm=C3=A8s=20B=C3=A9lusca-Ma=C3=AFto?=
 <hermes.belusca-maito@reactos.org>
Date: Sun, 5 Apr 2015 17:11:29 +0000
Subject: [PATCH] [CMD]: Check for cmd_realloc returned value. Adapted from
 patch by Patrick Martin, see CORE-7298.

svn path=/trunk/; revision=67065
---
 reactos/base/shell/cmd/path.c  |  6 ++++++
 reactos/base/shell/cmd/where.c | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/reactos/base/shell/cmd/path.c b/reactos/base/shell/cmd/path.c
index ab29938cd0d..3e586928608 100644
--- a/reactos/base/shell/cmd/path.c
+++ b/reactos/base/shell/cmd/path.c
@@ -59,7 +59,13 @@ INT cmd_path (LPTSTR param)
         }
         else if (dwBuffer > ENV_BUFFER_SIZE)
         {
+            LPTSTR pszOldBuffer = pszBuffer;
             pszBuffer = (LPTSTR)cmd_realloc (pszBuffer, dwBuffer * sizeof (TCHAR));
+            if (pszBuffer == NULL)
+            {
+                cmd_free(pszOldBuffer);
+                return 1;
+            }
             GetEnvironmentVariable (_T("PATH"), pszBuffer, dwBuffer);
         }
 
diff --git a/reactos/base/shell/cmd/where.c b/reactos/base/shell/cmd/where.c
index dfe4d6d2ffb..00aaf7b008b 100644
--- a/reactos/base/shell/cmd/where.c
+++ b/reactos/base/shell/cmd/where.c
@@ -152,7 +152,13 @@ SearchForExecutable (LPCTSTR pFileName, LPTSTR pFullName)
     dwBuffer = GetEnvironmentVariable (_T("PATHEXT"), pszPathExt, ENV_BUFFER_SIZE);
     if (dwBuffer > ENV_BUFFER_SIZE)
     {
+        LPTSTR pszOldPathExt = pszPathExt;
         pszPathExt = (LPTSTR)cmd_realloc (pszPathExt, dwBuffer * sizeof (TCHAR));
+        if (pszPathExt == NULL)
+        {
+            cmd_free(pszOldPathExt);
+            return FALSE;
+        }
         GetEnvironmentVariable (_T("PATHEXT"), pszPathExt, dwBuffer);
         _tcslwr(pszPathExt);
     }
@@ -184,7 +190,14 @@ SearchForExecutable (LPCTSTR pFileName, LPTSTR pFullName)
     dwBuffer = GetEnvironmentVariable (_T("PATH"), pszPath, ENV_BUFFER_SIZE);
     if (dwBuffer > ENV_BUFFER_SIZE)
     {
+        LPTSTR pszOldPath = pszPath;
         pszPath = (LPTSTR)cmd_realloc (pszPath, dwBuffer * sizeof (TCHAR));
+        if (pszPath == NULL)
+        {
+            cmd_free(pszOldPath);
+            cmd_free(pszPathExt);
+            return FALSE;
+        }
         GetEnvironmentVariable (_T("PATH"), pszPath, dwBuffer);
     }