WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 472/Class 09/KP 04
Class 09 · KP 04 / 25

Anatomy of a Chunk

allocated chunksizeheaderuser datafreed chunk (tcache)sizeheaderfd → next freereused by UAFUse-after-free: the pointer still works after free — read, or overwrite fd.
glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.
Key Takeaway

The size field and its flags are inline metadata — corrupting them is a primitive.

Previousglibc malloc (ptmalloc2): The Big PictureNextAllocated vs. Free Chunk Layout