Breaking One Time Pad with CCA
It's actually fairly straight-forward; the attacker knows $m_0$, $m_1$, and the challenge ciphertext $c = m_r \oplus s$, for an unknown bit $r$ and an unknown string $s$; his job is to recover $r$.

One thing he can try is selecting an arbitrary ciphertext $c'$ (which needs to be distinct from the challenge ciphertext, but can be anything else of the same length), and ask for it to be decrypted.  The decryption is $m' = c' \oplus s$; he can then recover $m_r = c' \oplus m' \oplus c$; he can then compare $m_r$ to $m_0$ and $m_1$ to deduce $r$.