Fix crash in nk_buffer_realloc and forbid the use of realloc

In short: the default implementation of nk_allocator (aka nk_malloc)
is fundamentally broken, and should have used realloc instead of malloc.
This led to the strange workaround in nk_buffer_realloc that would
crash whenever you use custom allocator with correct realloc assumption.
We cannot change nk_malloc at this point, as people could have
implemented their own allocators based on it, but we can ensure that
Nuklear itself will never try to reallocate memory.

Fixes: #768

Author: sleeptightAnsiC

demo/sdl3_renderer/nuklear_sdl3_renderer.h

@@ -112,16 +112,7 @@ NK_INTERN void *
 nk_sdl_alloc(nk_handle user, void *old, nk_size size)
 {
     NK_UNUSED(user);
-    /* FIXME: nk_sdl_alloc should use SDL_realloc here, not SDL_malloc
-     * but this could cause a double-free due to bug within Nuklear, see:
-     * https://github.com/Immediate-Mode-UI/Nuklear/issues/768
-     * */
-#if 0
     return SDL_realloc(old, size);
-#else
-    NK_UNUSED(old);
-    return SDL_malloc(size);
-#endif
 }
 
 NK_INTERN void

nuklear.h

@@ -8498,7 +8498,16 @@ NK_LIB void*
 nk_malloc(nk_handle unused, void *old,nk_size size)
 {
     NK_UNUSED(unused);
-    NK_UNUSED(old);
+    /*
+     * Due to historical reasons, Nuklear always calls alloc(user,old,size)
+     * with the "old" pointer always being NULL. For full explanation, see:
+     * https://github.com/Immediate-Mode-UI/Nuklear/issues/768
+     *
+     * Note that this limitation is only meant for Nuklear's internal code.
+     * If you're wondering what to pass into nk_allocator's "alloc" field,
+     * you can still pass realloc there and it will work just fine.
+     */
+    NK_ASSERT(!old && "Nuklear's internal code must never reallocate existing memory !");
     return malloc(size);
 }
 NK_LIB void
@@ -8591,15 +8600,13 @@ nk_buffer_realloc(struct nk_buffer *b, nk_size capacity, nk_size *size)
         return 0;
 
     buffer_size = b->memory.size;
-    temp = b->pool.alloc(b->pool.userdata, b->memory.ptr, capacity);
+    temp = b->pool.alloc(b->pool.userdata, 0, capacity);
     NK_ASSERT(temp);
     if (!temp) return 0;
 
     *size = capacity;
-    if (temp != b->memory.ptr) {
-        NK_MEMCPY(temp, b->memory.ptr, buffer_size);
-        b->pool.free(b->pool.userdata, b->memory.ptr);
-    }
+    NK_MEMCPY(temp, b->memory.ptr, buffer_size);
+    b->pool.free(b->pool.userdata, b->memory.ptr);
 
     if (b->size == buffer_size) {
         /* no back buffer so just set correct size */
@@ -30736,6 +30743,8 @@ nk_tooltipfv(struct nk_context *ctx, const char *fmt, va_list args)
 ///   - [y]: Minor version with non-breaking API and library changes
 ///   - [z]: Patch version with no direct changes to the API
 ///
+/// - 2026/01/27 (4.13.1) - Fix crash inside of nk_buffer_realloc and
+///                         forbid the use of realloc in the whole library (internally only)
 /// - 2025/11/15 (4.13.0) - Fix: nk_property not updating 'win->edit.active'
 ///                         Add new updated demo: sdl3_renderer
 /// - 2025/10/08 (4.12.8) - Fix nk_widget_text to use NK_TEXT_ALIGN_LEFT by default,

src/CHANGELOG

@@ -7,6 +7,8 @@
 ///   - [y]: Minor version with non-breaking API and library changes
 ///   - [z]: Patch version with no direct changes to the API
 ///
+/// - 2026/01/27 (4.13.1) - Fix crash inside of nk_buffer_realloc and
+///                         forbid the use of realloc in the whole library (internally only)
 /// - 2025/11/15 (4.13.0) - Fix: nk_property not updating 'win->edit.active'
 ///                         Add new updated demo: sdl3_renderer
 /// - 2025/10/08 (4.12.8) - Fix nk_widget_text to use NK_TEXT_ALIGN_LEFT by default,

src/nuklear_buffer.c

@@ -11,7 +11,16 @@ NK_LIB void*
 nk_malloc(nk_handle unused, void *old,nk_size size)
 {
     NK_UNUSED(unused);
-    NK_UNUSED(old);
+    /*
+     * Due to historical reasons, Nuklear always calls alloc(user,old,size)
+     * with the "old" pointer always being NULL. For full explanation, see:
+     * https://github.com/Immediate-Mode-UI/Nuklear/issues/768
+     *
+     * Note that this limitation is only meant for Nuklear's internal code.
+     * If you're wondering what to pass into nk_allocator's "alloc" field,
+     * you can still pass realloc there and it will work just fine.
+     */
+    NK_ASSERT(!old && "Nuklear's internal code must never reallocate existing memory !");
     return malloc(size);
 }
 NK_LIB void
@@ -104,15 +113,13 @@ nk_buffer_realloc(struct nk_buffer *b, nk_size capacity, nk_size *size)
         return 0;
 
     buffer_size = b->memory.size;
-    temp = b->pool.alloc(b->pool.userdata, b->memory.ptr, capacity);
+    temp = b->pool.alloc(b->pool.userdata, 0, capacity);
     NK_ASSERT(temp);
     if (!temp) return 0;
 
     *size = capacity;
-    if (temp != b->memory.ptr) {
-        NK_MEMCPY(temp, b->memory.ptr, buffer_size);
-        b->pool.free(b->pool.userdata, b->memory.ptr);
-    }
+    NK_MEMCPY(temp, b->memory.ptr, buffer_size);
+    b->pool.free(b->pool.userdata, b->memory.ptr);
 
     if (b->size == buffer_size) {
         /* no back buffer so just set correct size */