diff --git a/src/bin/psql/command.c b/src/bin/psql/command.c
index 953ebdf761d..2e55c900aa1 100644
--- a/src/bin/psql/command.c
+++ b/src/bin/psql/command.c
@@ -238,7 +238,9 @@ HandleSlashCmds(PsqlScanState scan_state,
 	 * If we are in "restricted" mode, the only allowable backslash command is
 	 * \unrestrict (to exit restricted mode).
 	 */
-	if (restricted && strcmp(cmd, "unrestrict") != 0)
+	if (cmd == NULL)
+		status = PSQL_CMD_ERROR;
+	else if (restricted && strcmp(cmd, "unrestrict") != 0)
 	{
 		pg_log_error("backslash commands are restricted; only \\unrestrict is allowed");
 		status = PSQL_CMD_ERROR;
diff --git a/src/bin/psql/psqlscanslash.l b/src/bin/psql/psqlscanslash.l
index c739a754cf2..27782eedcad 100644
--- a/src/bin/psql/psqlscanslash.l
+++ b/src/bin/psql/psqlscanslash.l
@@ -481,7 +481,7 @@ other			.
  * has been consumed through the leading backslash.
  *
  * The return value is a malloc'd copy of the command name, as parsed off
- * from the input.
+ * from the input, or NULL on out-of-memory.
  */
 char *
 psql_scan_slash_command(PsqlScanState state)
@@ -512,7 +512,7 @@ psql_scan_slash_command(PsqlScanState state)
 	/* And lex. */
 	yylex(NULL, state->scanner);
 
-	/* There are no possible errors in this lex state... */
+	/* There are no possible syntax errors in this lex state... */
 
 	/*
 	 * In case the caller returns to using the regular SQL lexer, reselect the
@@ -520,6 +520,17 @@ psql_scan_slash_command(PsqlScanState state)
 	 */
 	psql_scan_reselect_sql_lexer(state);
 
+	/*
+	 * yylex() appends command-name text to mybuf, so a buffer enlargement
+	 * failure during lexing can leave mybuf broken even if initialization
+	 * succeeded.
+	 */
+	if (PQExpBufferDataBroken(mybuf))
+	{
+		pg_log_error("out of memory");
+		return NULL;
+	}
+
 	return mybuf.data;
 }