Skip to content

Commit ee32d48

Browse files
TheFlipbookcebtenzzre
authored andcommitted
Fix heap corruption from wmode out-of-bound writes on windows (ggml-org#6272)
* would throw error on VS2022 on GGML_FREE(wmode) * wchar_t is usually 2 bytes, but malloc wants bytes * therefore `*wmode_p++ = (wchar_t)*mode;` could write off the end of the allocation * Fixes error possibly introduced by ggml-org#6248 (cherry picked from commit a32b77c) Signed-off-by: Jared Van Bortel <[email protected]>
1 parent da1a4ba commit ee32d48

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

ggml.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -469,7 +469,7 @@ FILE * ggml_fopen(const char * fname, const char * mode) {
469469
wchar_t * wfname = ggml_mbstowcs(fname);
470470
if (wfname) {
471471
// convert mode (ANSI)
472-
wchar_t * wmode = GGML_MALLOC(strlen(mode) + 1);
472+
wchar_t * wmode = GGML_MALLOC((strlen(mode) + 1) * sizeof(wchar_t));
473473
wchar_t * wmode_p = wmode;
474474
do {
475475
*wmode_p++ = (wchar_t)*mode;

0 commit comments

Comments
 (0)