UAF Timeline
- Steps 1—2 are the bug; steps 3—4 are the exploit.
- The attacker's chunk in step 3 must match the freed chunk's size class so the allocator hands back the same memory.
Key Takeaway
Reallocate the freed chunk, fill it with your data, then let the stale pointer act on it.