When I looking on Ida with static analyze I see that buffer pass to function/ function fill data in buffer.
How can I know if this buffer allocate in stack/ heap?
If it's address is above or equal to the stack pointer (esp/rsp), it's on the stack
otherwise, it's on the heap or was on a previous stack-frame (and now is out of scope and should not be used)
If you want to know but just looking at the address: if the address starts with
0x7f, it's on the stack.
That might not always be right though, a program can control the value of the stack pointer and can decide to change it (not likely but feasible)
If you want to find out statically, you have to inspect the call site to your function and see where the buffer argument comes from.
You may have to go back multiple layers until you either clearly see it's on the stack (if the address of a local memory area is passed in), or it comes from a call like
HeapAlloc (VirtualAlloc and HeapAlloc being Windows-specific APIs), in which case the memory is located on the heap.