From 3c7938163c43c3f1bb4e9e757a3624f4e4a548f9 Mon Sep 17 00:00:00 2001 From: dimgigov Date: Mon, 8 Jun 2026 20:10:30 +0300 Subject: [PATCH] fix(runtime): detach StringBuilder buffer on build to prevent use-after-free bux_sb_build returned sb->buf and then bux_sb_free freed it, causing dangling pointers in all callers of StringBuilder_Build followed by StringBuilder_Free (e.g. JsonParser_ParseString, Fmt). Fix: bux_sb_build now detaches the buffer (sets sb->buf = NULL) before returning it, so bux_sb_free only frees the sb struct. This transfers buffer ownership to the caller. --- rt/runtime.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rt/runtime.c b/rt/runtime.c index 1257294..68d34bd 100644 --- a/rt/runtime.c +++ b/rt/runtime.c @@ -351,12 +351,14 @@ void bux_sb_append_char(BuxStringBuilder* sb, char c) { const char* bux_sb_build(BuxStringBuilder* sb) { if (!sb) return ""; - return sb->buf; + const char* buf = sb->buf; + sb->buf = NULL; // detach — ownership transferred to caller + return buf; } void bux_sb_free(BuxStringBuilder* sb) { if (!sb) return; - bux_free(sb->buf); + bux_free(sb->buf); // safe: NULL if bux_sb_build already detached bux_free(sb); }