| 83 | // [1]: https://arxiv.org/pdf/1903.00503.pdf |
| 84 | |
| 85 | static void double_free1() { |
| 86 | void* p[256]; |
| 87 | //uintptr_t buf[256]; |
| 88 | |
| 89 | p[0] = mi_malloc(622616); |
| 90 | p[1] = mi_malloc(655362); |
| 91 | p[2] = mi_malloc(786432); |
| 92 | mi_free(p[2]); |
| 93 | // [VULN] Double free |
| 94 | mi_free(p[2]); |
| 95 | p[3] = mi_malloc(786456); |
| 96 | // [BUG] Found overlap |
| 97 | // p[3]=0x429b2ea2000 (size=917504), p[1]=0x429b2e42000 (size=786432) |
| 98 | fprintf(stderr, "p3: %p-%p, p1: %p-%p, p2: %p\n", p[3], (uint8_t*)(p[3]) + 786456, p[1], (uint8_t*)(p[1]) + 655362, p[2]); |
| 99 | } |
| 100 | |
| 101 | static void double_free2() { |
| 102 | void* p[256]; |