poc2.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <jemalloc/jemalloc.h>

#define assert(expr) if(!(expr)){printf("assert error.\n");}

int g_fd;
void print_my_jemalloc_data(void *opaque, const char *buf){
	write(g_fd,buf,strlen(buf));
}



int main(){
	/*
	int fd = open("heap_stats.out",O_CREAT|O_WRONLY,0666);
	g_fd = fd;
	malloc_stats_print(print_my_jemalloc_data,NULL,NULL);
	*/

	
	// [PRE-CONDITION]
	// sz : any size
	// [BUG] double free
	// [POST-CONDITION]
	// malloc(sz) == malloc(sz)
	int sz = 0x100;
	void* p = malloc(sz);
	//printf("0x%p\n", malloc(sz));
	printf("0x%p\n", p+0x200);
	free(p+0x200);
	printf("0x%p\n", malloc(sz));
	// [BUG] free ’p’ again
	// this is allowed due to lack of security checks
	//free(p);
	//free(p);
	//assert(malloc(sz) == malloc(sz));
	//printf("0x%p\n", malloc(sz));
	//printf("0x%p\n", malloc(sz));
	//printf("0x%p\n", malloc(sz));
	return 0;
}