15 lines
399 B
C
15 lines
399 B
C
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
|
|
int main()
|
|
{
|
|
int *a,*b,*c,*d,*e;
|
|
b=malloc(8);
|
|
c=malloc(10); /* Essential so we don't coalesce */
|
|
free(b);
|
|
free(b); /* this should die */
|
|
d=malloc(8); /* we'll get the old b block */
|
|
e=malloc(8); /* the double free flaw means we get the old b block again! */
|
|
if (d==e) { printf("FAIL: Exploitable double free behaviour\n"); }
|
|
}
|