WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Class 09/KP 02
Class 09 · KP 02 / 25

The Heap vs. the Stack

allocated chunksizeheaderuser datafreed chunk (tcache)sizeheaderfd → next freereused by UAFUse-after-free: the pointer still works after free — read, or overwrite fd.
glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

The freedom that makes the heap useful — arbitrary object lifetimes —

is exactly what makes it dangerous. A pointer can outlive the memory it

points to.

PreviousWhy the Heap MattersNextglibc malloc (ptmalloc2): The Big Picture