Double Free in Fiber (Go)

A double free error occurs when a program releases the same memory allocation twice without reassigning the pointer. In the context of Fiber, a Go web framework, this vulnerability typically emerges in handler code that manually manages memory or reuses HTTP response objects across requests.

Fiber itself is built on Go's net/http and does not perform garbage collection errors, but applications that allocate buffers or streams using Go's make and then pass them to Fiber handlers without proper lifecycle tracking can trigger double free conditions. A common pattern involves reusing a response buffer in a middleware chain and failing to reset its reference count before sending it back to the client.

For example, consider a handler that reads request data into a byte slice, wraps it in a Fiber ctx.Response().Body(), and then reuses the same buffer in a later middleware for logging or caching. If the buffer is not explicitly set to nil after use, and the handler attempts to free it again during cleanup, the runtime will log a double free panic.

func handler(ctx *fiber.Ctx) error {
    // Allocate a buffer for request body
    buf := make([]byte, 1024)
    if _, err := ctx.Body().Read(buf); err != nil {
        return err
    }
    // Wrap in Fiber response body
    resp := fiber.NewBytes(buf)
    ctx.Response().SetBody(resp)

    // Middleware attempts to reuse the same buffer
    logMiddleware := func(next fiber.Handler) fiber.Handler {
        return func(c *fiber.Ctx) error {
            // Attempt to read again — unsafe!
            _, _ = c.Body().Read(buf)
            return next(c)
        }
    }
    app.Use(logMiddleware)
    return ctx.SendString("ok")
}

If the log middleware reads from the same buf after it has already been consumed by the response, and the application later calls runtime.Free or uses a defer block that frees buf, the Go runtime may detect a double free and terminate the process. This is exacerbated when the buffer is allocated on the stack and its address is passed to Fiber's internal structures that retain ownership.

Additionally, Fiber's streaming responses use a sliding window mechanism where chunks are sent incrementally. If a handler yields control of the response body to a downstream handler or a generator function without resetting the buffer pointer, and the generator later attempts to write to the same slice, the original allocation may be freed while still in use, leading to undefined behavior or a double free upon final release.

Real-world incidents tied to this pattern have been observed in internal services using Fiber with high-throughput logging pipelines. The Go runtime’s memory sanitizers have flagged these cases with errors like runtime: double free or invalid memory address, often linked to third-party middleware that incorrectly manages response lifecycles.

Understanding these patterns is critical when designing APIs that handle large payloads or long-lived connections. The double free risk is not inherent to Fiber but stems from improper memory ownership semantics in application code.

To prevent double free errors in Fiber applications, developers must ensure that any memory buffer is owned by exactly one component at any given time. Once a buffer is passed to a handler or middleware, it should not be accessed again unless explicitly reallocated.

A correct implementation involves resetting the buffer to nil after use, ensuring no further references exist:

func handler(ctx *fiber.Ctx) error {
    buf := make([]byte, 1024)
    if _, err := ctx.Body().Read(buf); err != nil {
        return err
    }
    resp := fiber.NewBytes(buf)
    ctx.Response().SetBody(resp)

    // Reset buf to nil before passing to middleware
    buf = nil
    logMiddleware := func(next fiber.Handler) fiber.Handler {
        return func(c *fiber.Ctx) error {
            if buf != nil {
                // Only read if buffer still exists
                _, _ = c.Body().Read(buf)
            }
            return next(c)
        }
    }
    app.Use(logMiddleware)
    return ctx.SendString("ok")
}

Alternatively, use Fiber's stream interface with proper lifecycle handling:

func handler(ctx *fiber.Ctx) error {
    stream := ctx.Body()
    if _, err := stream.WriteTo(ctx.Response().Body()); err != nil {
        return err
    }
    // No manual buffer management — Go handles lifetime
    return nil
}

Another robust pattern is to avoid reusing slices across middleware layers. Instead, allocate a new buffer per request or use context-specific keys to store per-request state:

type ctxKey struct{}
var BufferKey = &ctxKey{}

func handler(ctx *fiber.Ctx) error {
    buf := make([]byte, 1024)
    ctx.Set(BufferKey{}, buf)
    return ctx.Next()
}

func loggingMiddleware(next fiber.Handler) fiber.Handler {
    return func(c *fiber.Ctx) error {
        buf, ok := c.Get(BufferKey{}).([]byte)
        if ok && buf != nil {
            // Safe to read only if buffer exists
            _, _ = c.Body().Read(buf)
        }
        return next(c)
    }
}

Additionally, enable Go's memory sanitizer in development:

go build -gcflags "debug=all"; race

This flags data races and double frees during testing, helping identify unsafe buffer reuse before deployment.