From 2fd5912834cea9175f8c02c6f88ab779b88b55e6 Mon Sep 17 00:00:00 2001
From: Giovanni <561184+wargio@users.noreply.github.com>
Date: Tue, 14 Apr 2026 16:55:09 +0800
Subject: [PATCH] Fix ownership of RzConsCanvas when used by RzAGraph (#6231)

---
 librz/cons/canvas.c     | 3 +--
 librz/core/heap_glibc.c | 6 ++++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/librz/cons/canvas.c b/librz/cons/canvas.c
index cf0e43001a..d98313a93b 100644
--- a/librz/cons/canvas.c
+++ b/librz/cons/canvas.c
@@ -148,8 +148,7 @@ RZ_API void rz_cons_canvas_free(RzConsCanvas *c) {
 		return;
 	}
 	if (c->b) {
-		int y;
-		for (y = 0; y < c->h; y++) {
+		for (int y = 0; y < c->h; y++) {
 			free(c->b[y]);
 		}
 		free(c->b);
diff --git a/librz/core/heap_glibc.c b/librz/core/heap_glibc.c
index 203541283d..587e3f0801 100644
--- a/librz/core/heap_glibc.c
+++ b/librz/core/heap_glibc.c
@@ -2520,6 +2520,8 @@ RZ_IPI RzCmdStatus rz_cmd_heap_chunks_print_handler(RzCore *core, int argc, cons
 		rz_config_hold_free(hc);
 		return RZ_CMD_STATUS_ERROR;
 	}
+	// RzConsCanvas is now owned by RzAGraph
+	can = NULL;
 	RzANode *top = RZ_EMPTY, *chunk_node = RZ_EMPTY, *prev_node = RZ_EMPTY;
 	char *top_title = NULL, *top_data = NULL, *node_title = NULL, *node_data = NULL;
 	bool first_node = true;
@@ -2536,8 +2538,8 @@ RZ_IPI RzCmdStatus rz_cmd_heap_chunks_print_handler(RzCore *core, int argc, cons
 		PRINTF_YA("0x%" PFMT64x, (ut64)m_state);
 		rz_cons_newline();
 	} else if (mode == RZ_OUTPUT_MODE_LONG_JSON) {
-		can->linemode = rz_config_get_i(core->config, "graph.linemode");
-		can->color = rz_config_get_i(core->config, "scr.color");
+		g->can->linemode = rz_config_get_i(core->config, "graph.linemode");
+		g->can->color = rz_config_get_i(core->config, "scr.color");
 		core->cons->use_utf8 = rz_config_get_i(core->config, "scr.utf8");
 		g->layout = rz_config_get_i(core->config, "graph.layout");
 		rz_agraph_set_title(g, "Heap Layout");