This constructor exposes a pointer to the streambuf data member _buf before that data member has been initialized. This is incorrect.

ostream supports a 2-phase initialization for cases like this where the streambuf isn't ready yet at the time of construction. You initialize the std::ostream with no arguments and call ostream::init(std::streambuf*) afterwards.

https://github.com/10gen/mongo/blob/5c9e37eba9bb5705624d83a7e6f36414341c338c/src/mongo/util/signal_handlers_synchronous.cpp#L169

Broken:

 MallocFreeOStream() : std::ostream(&_buf) {}

Fixed:

MallocFreeOStream() {
    init(&_buf);
}