The Corroded Crown
A classic heap use-after-free (UAF) menu challenge. The destroy (free) handler frees a chunk but never clears the dangling pointer, and neither the inscribe (edit) nor inspect (view) handlers check the "in-use" flag. This gives us both UAF read and UAF write. fd, which points into main_arena.
PDF not displaying? Download it instead.
Something wrong with this page?
Wrong details, a stolen writeup, or something that should not be published here — tell a moderator. This does not go to the author.