29 lines · c
1#include <malloc/malloc.h>2#include <stdio.h>3#include <stdlib.h>4#include <string.h>5 6// Produce some names on the trace7const size_t tag_granule = 16;8static uint8_t *my_malloc(void) { return malloc(2 * tag_granule); }9static uint8_t *allocate(void) { return my_malloc(); }10 11static void my_free(void *ptr) { free(ptr); }12static void deallocate(void *ptr) { my_free(ptr); }13 14static void touch_memory(uint8_t *ptr) { ptr[7] = 1; } // invalid access15static void modify(uint8_t *ptr) { touch_memory(ptr); }16 17int main() {18 uint8_t *ptr = allocate();19 20 strncpy((char *)ptr, "Hello", 16);21 strncpy((char *)ptr + 16, "World", 16);22 23 deallocate(ptr); // before free24 25 modify(ptr); // use-after-free26 27 return 0;28}29