Comment by int_19h

For escapes you can mutate the raw buffer with data in place, since a single escape always expands to fewer characters than the escape itself.