02/04: [WIN32K:NTUSER] Handle realloc failure in IntRemoveMenuItem. CORE-14222

[Thomas Faber]

https://git.reactos.org/?p=reactos.git;a=commitdiff;h=de455c4d50e6ba3b1d6b28...

commit de455c4d50e6ba3b1d6b2897618feadb54a5e37f
Author:     Thomas Faber [e-mail]
AuthorDate: Thu Feb 1 11:06:50 2018 +0100
Commit:     Thomas Faber [e-mail]
CommitDate: Sun Feb 18 11:27:29 2018 +0100

[WIN32K:NTUSER] Handle realloc failure in IntRemoveMenuItem. CORE-14222
---
 win32ss/user/ntuser/menu.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/win32ss/user/ntuser/menu.c b/win32ss/user/ntuser/menu.c
index 8432f3a83f..5ecffbb8e3 100644
--- a/win32ss/user/ntuser/menu.c
+++ b/win32ss/user/ntuser/menu.c
@@ -598,6 +598,7 @@ BOOL FASTCALL
 IntRemoveMenuItem( PMENU pMenu, UINT nPos, UINT wFlags, BOOL bRecurse )
 {
     PITEM item;
+    PITEM newItems;

TRACE("(menu=%p pos=%04x flags=%04x)\n",pMenu, nPos, wFlags);
     if (!(item = MENU_FindItem( &pMenu, &nPos, wFlags ))) return FALSE;
@@ -617,13 +618,17 @@ IntRemoveMenuItem( PMENU pMenu, UINT nPos, UINT wFlags, BOOL bRecurse )
     }
     else
     {
-	while(nPos < pMenu->cItems)
-	{
-	    *item = *(item+1);
-	    item++;
-	    nPos++;
-	}
-	pMenu->rgItems = DesktopHeapReAlloc(pMenu->head.rpdesk, pMenu->rgItems, pMenu->cItems * sizeof(ITEM));
+        while (nPos < pMenu->cItems)
+        {
+            *item = *(item+1);
+            item++;
+            nPos++;
+        }
+        newItems = DesktopHeapReAlloc(pMenu->head.rpdesk, pMenu->rgItems, pMenu->cItems * sizeof(ITEM));
+        if (newItems)
+        {
+            pMenu->rgItems = newItems;
+        }
     }
     return TRUE;
 }