From 7267bfbfceefb2129236781fbfd068732a46e4e2 Mon Sep 17 00:00:00 2001
From: Amir Al-Mohamad <244610357+amir-al-mohamad@users.noreply.github.com>
Date: Thu, 1 Oct 2026 01:22:19 +0300
Subject: [PATCH] Fix use-after-free in BaseObjects destructor

~BaseObjects() called clear() on the derived class's String buffers after
they had already been destroyed; with GCC -O2 they still hold the freed
pointer, so String::remove() wrote into freed memory.
---
 src/core/Utils/ObjectWriter.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/core/Utils/ObjectWriter.h b/src/core/Utils/ObjectWriter.h
index dbf48db2..982f41b6 100644
--- a/src/core/Utils/ObjectWriter.h
+++ b/src/core/Utils/ObjectWriter.h
@@ -278,7 +278,9 @@ class BaseObjects : public Printable
 
 public:
     BaseObjects() {}
-    ~BaseObjects() { clear(); }
+    // Don't clear() here: the derived class's Strings are already destroyed
+    // at this point and remove() would write into freed memory.
+    ~BaseObjects() {}
     void init(String *buffers, size_t size)
     {
         this->buffers = buffers;