Hands-On System Programming with Linux

Test case 10

Double-free. Once a malloc family buffer is freed, one is not allowed to use that pointer at all. Attempting to free the same pointer again (without again allocating it memory via one of the malloc family APIs) is a bug: double free. It results in heap corruption; bugs like this are often exploited by attackers to cause denial-of-service (DoS) attacks or worse (privilege escalation).

Here is a simple test case:

/* test case 10 : double-free test case */static void doublefree(int cond){    char *ptr;    char name[]="Hands-on Linux Sys Prg";    int n=512;    printf("%s(): cond %d\n", __FUNCTION__, cond);    ptr = malloc(n);    if (!ptr)        FATAL("malloc failed\n");    strncpy(ptr, name, strlen(name));    free(ptr);    if (cond) {        bogus = malloc(-1UL); /* will ...