title: understanding of double free attack
body: <p>I got a small piece of code from here <a href="https://github.com/shellphish/how2heap/blob/master/fastbin_dup.c" rel="nofollow">https://github.com/shellphish/how2heap/blob/master/fastbin_dup.c</a></p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  
  int main()
  {
      printf("This file demonstrates a simple double-free attack with fastbins.\n");
  
      printf("Allocating 3 buffers.\n");
      int *a = malloc(8);
      int *b = malloc(8);
      int *c = malloc(8);
  
      printf("1st malloc(8): %p\n", a);
      printf("2nd malloc(8): %p\n", b);
      printf("3rd malloc(8): %p\n", c);
  
      printf("Freeing the first one...\n");
      free(a);
  
      printf("If we free %p again, things will crash because %p is at the top of the free list.\n", a, a);
      // free(a);
  
      printf("So, instead, we'll free %p.\n", b);
      free(b);
  
      printf("Now, we can free %p again, since it's not the head of the free list.\n", a);
      free(a);
  
      printf("Now the free list has [ %p, %p, %p ]. If we malloc 3 times, we'll get %p twice!\n", a, b, a, a);
      printf("1st malloc(8): %p\n", malloc(8));
      printf("2nd malloc(8): %p\n", malloc(8));
      printf("3rd malloc(8): %p\n", malloc(8));
  }
  </code></pre>
  
  <ol>
  <li>Why can I not free A twice in a row?</li>
  <li>Why can I free A again after freeing B?</li>
  <li>Why get I back the same chunk twice if I malloc again?</li>
  </ol>
  
  <p>Thanks!</p>