My partner Found this UAF bug!But we don’t know how to write exploit.pic.twitter.com/URUNyYYCzz
looks more like dereferencing an invalid pointer- or is that invalid because what it points to is freed? Then you need to create an allocation of the same size-but not the same object- so it will be used wrong.
-
-
Yep,it points to which is freed.
-
then you need to make a new allocation of the same size happen- with a bit of luck it will get the same place. Then if the new object is one 8 digit phonenumber then two pointers and the old object was 4 pointers then what you put as phonenumber will be used as pointers.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.