fastbin-loop.c

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int main() {
  uintptr_t *p1 = malloc(0);
  uintptr_t *p2 = malloc(0);

  free(p2);

  // UAF
  *p2 = (uintptr_t)p2 - 0x10;

  uintptr_t *p3 = malloc(0);

  fprintf(stderr, "Fastbin loop: %p,%p,%p\n", p3, malloc(0), malloc(0));

  return 0;
}