{"id":77,"date":"2026-11-01T09:00:57","date_gmt":"2026-10-31T22:00:57","guid":{"rendered":"https:\/\/davidshoon.com\/?p=77"},"modified":"2026-11-01T09:00:57","modified_gmt":"2026-10-31T22:00:57","slug":"use-after-free-in-c","status":"publish","type":"post","link":"https:\/\/davidshoon.com\/?p=77","title":{"rendered":"Use-after-free in C++"},"content":{"rendered":"\n<pre class=\"wp-block-code\"><code>#include &lt;stdio.h>\n#include &lt;stdlib.h>\n#include &lt;string.h>\n\nclass A\n{\npublic:\n\tvirtual void func();\n};\n\nclass B : public A\n{\npublic:\n\tvirtual void func() override;\n};\n\nvoid A::func()\n{\n\tprintf(\"Hello world\\n\");\n}\n\nvoid B::func()\n{\n\tprintf(\"How did I get here?\\n\");\n}\n\n\nint main()\n{\n\tA *a = new A();\n\n\ta->func();\n\n\tdelete a; \/\/ use-after-free... free here, and use 'a' again later on\n\n\tB *b = new B();\n\n\tb->func(); \/\/ test our function, it should be the new one.\n\n\ta->func(); \/\/ now use-after-free -- this should be the same new function.\n\n\t\/\/ As you can see, you don't even need a write primitive, since (in this case) it automatically\n\t\/\/ changes the vtable (virtual function pointer) for you.\n\t\n}\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-77","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/77","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=77"}],"version-history":[{"count":1,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/77\/revisions"}],"predecessor-version":[{"id":78,"href":"https:\/\/davidshoon.com\/index.php?rest_route=\/wp\/v2\/posts\/77\/revisions\/78"}],"wp:attachment":[{"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=77"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=77"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/davidshoon.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=77"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}