forked from rpms/glibc
12 lines
355 B
C
12 lines
355 B
C
main()
|
|
{
|
|
int *a,*b,*c,*d,*e;
|
|
b=malloc(8);
|
|
c=malloc(10); /* Essential so we don't coalesce */
|
|
free(b);
|
|
free(b); /* this should die */
|
|
d=malloc(8); /* we'll get the old b block */
|
|
e=malloc(8); /* the double free flaw means we get the old b block again! */
|
|
if (d==e) { printf("FAIL: Exploitable double free behaviour\n"); }
|
|
}
|