My partner Found this UAF bug!But we don’t know how to write exploit.pic.twitter.com/URUNyYYCzz
-
Yep,it points to which is freed.
then you need to make a new allocation of the same size happen- with a bit of luck it will get the same place. Then if the new object is one 8 digit phonenumber then two pointers and the old object was 4 pointers then what you put as phonenumber will be used as pointers.