Description
`exception_struct` is a local stack variable, but the code passes its address to the C language as `&mut exception_struct as *mut _ as *mut c_void`. Then, the returned `MetaCallException` value is stored here:
```rust
Ok(Self {
exception_struct: Arc::new(exception_struct),
value: exception_ptr,
leak: false,
})
```
Because leak is false, the destructor will run later. But the original exception pointer points to Rust stack memory.
## Trigger
```rust
#[test]
fn exception_bad_free_safe_api() {
let original = metacall::MetaCallException::new(
"test",
"test",
"test",
1,
);
drop(original); // AddressSanitizer: bad-free
}
```
## Impact
Every time the `MetaCallException` is created, when it is dropped, it leads to a bad-free. This can be triggered through the safe public API `MetaCallException::new()`, with no `unsafe` required from the caller.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | metacall | >= 0.0.0-0 | — | RUSTSEC-2026-0156 |