Skip to content

Commit a32b77c

Browse files
authored
Fix heap corruption from wmode out-of-bound writes on windows (ggml-org#6272)
* would throw error on VS2022 on GGML_FREE(wmode) * wchar_t is usually 2 bytes, but malloc wants bytes * therefore `*wmode_p++ = (wchar_t)*mode;` could write off the end of the allocation * Fixes error possibly introduced by ggml-org#6248
1 parent a0e584d commit a32b77c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ggml.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ FILE * ggml_fopen(const char * fname, const char * mode) {
465465
wchar_t * wfname = ggml_mbstowcs(fname);
466466
if (wfname) {
467467
// convert mode (ANSI)
468-
wchar_t * wmode = GGML_MALLOC(strlen(mode) + 1);
468+
wchar_t * wmode = GGML_MALLOC((strlen(mode) + 1) * sizeof(wchar_t));
469469
wchar_t * wmode_p = wmode;
470470
do {
471471
*wmode_p++ = (wchar_t)*mode;

0 commit comments

Comments
 (0)