#include <stdio.h>
#include <stdlib.h>
#include <string.h>
class A
{
public:
virtual void func();
};
class B : public A
{
public:
virtual void func() override;
};
void A::func()
{
printf("Hello world\n");
}
void B::func()
{
printf("How did I get here?\n");
}
int main()
{
A *a = new A();
a->func();
delete a; // use-after-free... free here, and use 'a' again later on
B *b = new B();
b->func(); // test our function, it should be the new one.
a->func(); // now use-after-free -- this should be the same new function.
// As you can see, you don't even need a write primitive, since (in this case) it automatically
// changes the vtable (virtual function pointer) for you.
}
Leave a Reply