A Minimal UAF in C

struct obj { void (*action)(void); char name[24]; };

struct obj *p = malloc(sizeof(*p));  // allocate
p->action = legit_handler;
free(p);                             // freed, but p still used below...

/* attacker forces an allocation of the SAME size */
char *q = malloc(sizeof(struct obj));
read(0, q, sizeof(struct obj));      // attacker controls those bytes

p->action();   // USE-AFTER-FREE: calls attacker-controlled pointer

• q lands on the just-freed chunk (tcache LIFO), so writing q overwrites p->action.
• Calling p->action() now jumps wherever the attacker chose.
• Fix: set p = NULL immediately after free, and never reuse freed pointers.