Use-after-free: using freed memory

After free(p), p still points (dangling). If the allocator reassigns that chunk to another object, using p reads/writes the new object.

Exploiting it

The classic pattern: free an object with a virtual function (vtable/function pointer), reallocate a buffer of the same size filled with your data, then the old object is "used" and calls the pointer you now control.

free(obj);
spray(size_of_obj, controlled_bytes);  // fill the freed chunk
obj->method();  // jump to the address you wrote

Defence

Null pointers after free. Use smart pointers/ownership (Rust removes this by construction). Quarantine allocators with delayed reuse, ASAN in testing, and mitigations like pointer authentication (ARM) or CFI reduce impact.