From c9ac9784ed78b13fef1f751b597de2c8a556e690 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=CE=B6eh=20Matt?= <5415177+ZehMatt@users.noreply.github.com>
Date: Sat, 2 Mar 2024 03:50:27 +0200
Subject: [PATCH] Fix regression from #21474 due to use-after-free bug

---
 src/openrct2/world/Banner.cpp | 4 ++--
 src/openrct2/world/Banner.h   | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/openrct2/world/Banner.cpp b/src/openrct2/world/Banner.cpp
index d85e51bc97..6ae2f8c285 100644
--- a/src/openrct2/world/Banner.cpp
+++ b/src/openrct2/world/Banner.cpp
@@ -51,9 +51,9 @@ void Banner::FormatTextTo(Formatter& ft, bool addColour) const
     if (addColour)
     {
         auto formatToken = FormatTokenFromTextColour(text_colour);
-        auto tokenText = FormatTokenToStringWithBraces(formatToken);
+        formattedTextBuffer = FormatTokenToStringWithBraces(formatToken);
         ft.Add<StringId>(STR_STRING_STRINGID);
-        ft.Add<const char*>(tokenText.data());
+        ft.Add<const char*>(formattedTextBuffer.data());
     }
 
     FormatTextTo(ft);
diff --git a/src/openrct2/world/Banner.h b/src/openrct2/world/Banner.h
index 3af61e3e74..ade42af3ab 100644
--- a/src/openrct2/world/Banner.h
+++ b/src/openrct2/world/Banner.h
@@ -36,6 +36,7 @@ struct Banner
     ObjectEntryIndex type = BANNER_NULL;
     uint8_t flags{};
     std::string text;
+    mutable std::string formattedTextBuffer;
     uint8_t colour{};
     RideId ride_index{};
     uint8_t text_colour{};