Exploits
| Access area | Overwrite area | Free | Fake chunk |
|---|
| Stack | Heap | Top chunk | F - size | F - bk | A - prev_size | A - size | Double Free | Free(Stack area) | Stack area | Heap area |
|---|
| First fit |
| O |
|
|
|
|
|
|
|
|
|
|---|
| Fastbin dup |
| O |
|
|
|
|
| O |
|
|
|
|---|
| Fastbindupinto stack | O |
|
|
|
| O |
| O |
| O
(size) |
|
|---|
| Poison null byte |
| O |
| O
(1byte) |
|
|
|
|
|
| O
(prev_size) |
|---|
| Overlapping chunks | O |
|
| O |
|
|
|
|
|
|
|
|---|
| Overlapping chunks 2 | O |
|
| O |
|
|
|
|
|
|
|
|---|
| House of einherjar |
| O |
|
|
| O | O |
|
| O
(Free chunk) |
|
|---|
| The House of Force | O |
| O |
|
|
|
|
|
|
|
|
|---|
| The House of Lore | O |
|
|
| O |
|
|
|
| O
(Free chunk) |
|
|---|
| The House of Spirit | O |
|
|
|
|
|
|
| O | O
(size, size of top chunk) |
|
|---|
| Unsorted bin attack | O |
|
|
| O |
|
|
|
|
|
|
|---|
| Unsafe unlink | O |
|
|
|
| O | O |
|
|
| O
(Free chunk) |
|---|
|