南京大学：《软件安全 Software Security》课程教学资源（PPT课件讲稿）Use-after-free

Use-after-free vulnerabilities object B f0: function_ptr1 p=(struct A*) function_ptr2 malloc(16); IP free(p); char_array q=(struct B*) malloc(16); p->integer1 value; q->function_ptr1(); f1: P Pointer to A f2: Q Pointer to B 9

Use-after-free vulnerabilities 9

Use-after-free vulnerabilities object B f0: function_ptr1 p=(struct A*) function_ptr2 malloc(16); free(p); char_array q=(struct B*) IP malloc(16): p->integer1 value; q->function_ptr1(): f1: attacker P Pointer to A code: 2: Q Pointer to B 10

Use-after-free vulnerabilities 10

Use-after-free vulnerabilities object B f0: function ptr1 p=(struct A*) function_ptr2 malloc(16): free(p): char_array q=(struct B*) malloc(16); p->integer1 value; q->function_ptr1(): f1: attacker P Pointer to A code: f2: Q Pointer to B 11

Use-after-free vulnerabilities 11