When parsing inline nodes, some pieces of text are kept in the parent block's content buffer and referenced from inline children as non-allocated cmark_chunk pointing directly into the parent's buffer. If the parent is freed, these pointers become invalid. This can lead to memory corruption. for example when moving inline nodes to another tree and deleting the old parent.

I'd suggest to copy all text data to inline children (i. e. use chunk_clone instead of chunk_dup). Then we could also think about removing the content field for block nodes.