17.tcache_dup

Source

 1 #include <stdio.h>
 2 #include <stdlib.h>
 3 
 4 int main()
 5 {
 6     fprintf(stderr, "This file demonstrates a simple double-free attack with tcache.\n");
 7 
 8     fprintf(stderr, "Allocating buffer.\n");
 9     int *a = malloc(8);
10 
11     fprintf(stderr, "malloc(8): %p\n", a);
12     fprintf(stderr, "Freeing twice...\n");
13     free(a);
14     free(a);
15 
16     fprintf(stderr, "Now the free list has [ %p, %p ].\n", a, a);
17     fprintf(stderr, "Next allocated buffers will be same: [ %p, %p ].\n", malloc(8), malloc(8));
18 
19     return 0;
20 }

operation result