From c039c51d778367e9aa15db18d185e9d627706b46 Mon Sep 17 00:00:00 2001
From: Zotyamester <szatmary.zoltan1222@gmail.com>
Date: Tue, 7 Jan 2020 16:53:38 +0000
Subject: [PATCH] Mail: fix memory leak on realloc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes #9873

Change-Id: I274fc61359c34ada1088994f65f3d3c762297176
Reviewed-on: https://review.haiku-os.org/c/haiku/+/2069
Reviewed-by: Jérôme Duval <jerome.duval@gmail.com>
---
 src/apps/mail/Content.cpp | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/src/apps/mail/Content.cpp b/src/apps/mail/Content.cpp
index d990e2eb77..07998a992b 100644
--- a/src/apps/mail/Content.cpp
+++ b/src/apps/mail/Content.cpp
@@ -1039,12 +1039,20 @@ TTextView::KeyDown(const char *key, int32 count)
 						end++;
 					Select(start, end);
 					if (fYankBuffer) {
-						fYankBuffer = (char *)realloc(fYankBuffer,
+						char *result = (char *)realloc(fYankBuffer,
 									 strlen(fYankBuffer) + (end - start) + 1);
+						if (result == NULL) {
+							free(fYankBuffer);
+							fYankBuffer = NULL;
+							break;
+						}
+						fYankBuffer = result;
 						GetText(start, end - start,
 							    &fYankBuffer[strlen(fYankBuffer)]);
 					} else {
 						fYankBuffer = (char *)malloc(end - start + 1);
+						if (fYankBuffer == NULL)
+							break;
 						GetText(start, end - start, fYankBuffer);
 					}
 					Delete();
@@ -2469,8 +2477,9 @@ TTextView::Reader::Run(void *_this)
 				eol += 2;	// CR+LF belong to the line
 				size_t length = eol - header;
 
-		 		buffer = (char *)realloc(buffer, length + 1);
-		 		if (buffer == NULL)
+				free(buffer);
+				buffer = (char *)malloc(buffer, length + 1);
+				if (buffer == NULL)
 		 			goto done;
 
 		 		memcpy(buffer, header, length);
@@ -3092,17 +3101,14 @@ TTextView::AddQuote(int32 start, int32 finish)
 			// add quote to this line
 			int32 lineLength = index - lastLine + 1;
 
-			char* newTarget = (char *)realloc(target,
+			char* result = (char *)realloc(target,
 				targetLength + lineLength + quoteLength);
-			if (newTarget == NULL) {
-				// free the old buffer
+			if (result == NULL) {
 				free(target);
-				target = NULL;
 				free(text);
 				return;
-			} else {
-				target = newTarget;
 			}
+			target = result;
 
 			// copy the quote sign
 			memcpy(&target[targetLength], QUOTE, quoteLength);