fixed prompt malloc vulnerability