Repository navigation
ffi reuses mutated temporary string buffer without restoring its contents #65050
Description
Activity
The minimal repro is partially correct above. It should not return a pointer, but the observed byte by value.
repro.c#include <stddef.h> #include <string.h> char overwrite(char* str, int byte, size_t count) { memset(str, byte, count); return str[0]; }
repro.jsimport { DynamicLibrary, suffix, toString } from 'node:ffi'; const lib = new DynamicLibrary(`./repro.${suffix}`); const overwrite = lib.getFunction('overwrite', { arguments: ['string', 'i32', 'u64'], return: 'char', }); console.log(String.fromCharCode(overwrite('hello', 0x79, 1n))); // "y" console.log(String.fromCharCode(overwrite('hello', 0, 0n))); // "y"; expected "h" lib.close();
This was observed during implementation in #65051 (comment)
- added a commit that references this issue
on Aug 14, 2026 - added 2 commits that reference this issue
on Aug 25, 2026
Version
main
Platform
Subsystem
ffi
What steps will reproduce the bug?
repro.crepro.jsRun commands
How often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
each call should populate temporary storage from the supplied JavaScript string, so reusing
"hello"should produce"hello".What do you see instead?
the second call receives
"yello"because the cached temporary buffer retains the native mutation from the first call.Additional information
No response