Buffer overflow/Logic error in wiHelper.cpp when parsing szFile
Author: superzmyCreated Mar 19, 2026Updated Aug 19, 2026
Labelsbug
In wiHelper.cpp at line 1422, the code assumes szFile is terminated with double null characters (\0\0) or contains multiple null-separated strings, but SaveFile does not always provide this format.
cpp const wchar_t* p = szFile; std::wstring directory = p; p += directory.length() + 1; // <--- Potential out-of-bounds access Issue: Since SaveFile only outputs the path without a trailing double null terminator, p points to an invalid memory location after the increment. This causes file saving to fail or crash.
Source: turanszkij/WickedEngine