[pornel]

It looks like a bug indeed.

Rust is freeing the string when the function ends, since to_ptr doesn't extended its lifetime.

C seems to be getting freed memory.

AFAIK the right way is to use mem::forget to "leak" memory when giving it to C, and later have C free it by calling a Rust function that casts it back to the original type.