	.file	"925359.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
	.align 8
.LC0:
	.string	"This technique only works with disabled tcache-option for glibc, see build_glibc.sh for build instructions.\n"
	.align 8
.LC1:
	.string	"\nThis is a simple chunks overlapping problem\n\n"
	.align 8
.LC2:
	.string	"Let's start to allocate 3 chunks on the heap\n"
	.align 8
.LC3:
	.string	"The 3 chunks have been allocated here:\np1=%p\np2=%p\np3=%p\n"
.LC4:
	.string	"\nNow let's free the chunk p2\n"
	.align 8
.LC5:
	.string	"The chunk p2 is now in the unsorted bin ready to serve possible\nnew malloc() of its size\n"
	.align 8
.LC6:
	.string	"Now let's simulate an overflow that can overwrite the size of the\nchunk freed p2.\n"
	.align 8
.LC7:
	.string	"For a toy program, the value of the last 3 bits is unimportant; however, it is best to maintain the stability of the heap.\n"
	.align 8
.LC8:
	.string	"To achieve this stability we will mark the least signifigant bit as 1 (prev_inuse), to assure that p1 is not mistaken for a free chunk.\n"
	.align 8
.LC9:
	.string	"We are going to set the size of chunk p2 to to %d, which gives us\na region size of %d\n"
	.align 8
.LC10:
	.string	"\nNow let's allocate another chunk with a size equal to the data\nsize of the chunk p2 injected size\n"
	.align 8
.LC11:
	.string	"This malloc will be served from the previously freed chunk that\nis parked in the unsorted bin which size has been modified by us\n"
	.align 8
.LC12:
	.string	"\np4 has been allocated at %p and ends at %p\n"
	.align 8
.LC13:
	.string	"p3 starts at %p and ends at %p\n"
	.align 8
.LC14:
	.string	"p4 should overlap with p3, in this case p4 includes all p3.\n"
	.align 8
.LC15:
	.string	"\nNow everything copied inside chunk p4 can overwrites data on\nchunk p3, and data written to chunk p3 can overwrite data\nstored in the p4 chunk.\n\n"
	.align 8
.LC16:
	.string	"Let's run through an example. Right now, we have:\n"
.LC17:
	.string	"p4 = %s\n"
.LC18:
	.string	"p3 = %s\n"
	.align 8
.LC19:
	.string	"\nIf we memset(p4, '4', %d), we have:\n"
	.align 8
.LC20:
	.string	"\nAnd if we then memset(p3, '3', 80), we have:\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	QWORD PTR -64[rbp], rsi
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 108
	mov	esi, 1
	lea	rdi, .LC0[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 46
	mov	esi, 1
	lea	rdi, .LC1[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 45
	mov	esi, 1
	lea	rdi, .LC2[rip]
	call	fwrite@PLT
	mov	edi, 248
	call	malloc@PLT
	mov	QWORD PTR -32[rbp], rax
	mov	edi, 248
	call	malloc@PLT
	mov	QWORD PTR -24[rbp], rax
	mov	edi, 120
	call	malloc@PLT
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rsi, QWORD PTR -16[rbp]
	mov	rcx, QWORD PTR -24[rbp]
	mov	rdx, QWORD PTR -32[rbp]
	mov	r8, rsi
	lea	rsi, .LC3[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -32[rbp]
	mov	edx, 248
	mov	esi, 49
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, 248
	mov	esi, 50
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -16[rbp]
	mov	edx, 120
	mov	esi, 51
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 29
	mov	esi, 1
	lea	rdi, .LC4[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 89
	mov	esi, 1
	lea	rdi, .LC5[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 82
	mov	esi, 1
	lea	rdi, .LC6[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 123
	mov	esi, 1
	lea	rdi, .LC7[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 136
	mov	esi, 1
	lea	rdi, .LC8[rip]
	call	fwrite@PLT
	mov	DWORD PTR -40[rbp], 385
	mov	DWORD PTR -36[rbp], 376
	mov	rax, QWORD PTR stderr[rip]
	mov	ecx, DWORD PTR -36[rbp]
	mov	edx, DWORD PTR -40[rbp]
	lea	rsi, .LC9[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -24[rbp]
	lea	rdx, -8[rax]
	mov	eax, DWORD PTR -40[rbp]
	cdqe
	mov	QWORD PTR [rdx], rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 99
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 129
	mov	esi, 1
	lea	rdi, .LC11[rip]
	call	fwrite@PLT
	mov	eax, DWORD PTR -36[rbp]
	cdqe
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -8[rbp], rax
	mov	eax, DWORD PTR -36[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -8[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC12[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -16[rbp]
	lea	rcx, 120[rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -16[rbp]
	lea	rsi, .LC13[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 60
	mov	esi, 1
	lea	rdi, .LC14[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 145
	mov	esi, 1
	lea	rdi, .LC15[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 50
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -16[rbp]
	lea	rsi, .LC18[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, DWORD PTR -36[rbp]
	lea	rsi, .LC19[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, DWORD PTR -36[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -8[rbp]
	mov	esi, 52
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -16[rbp]
	lea	rsi, .LC18[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 46
	mov	esi, 1
	lea	rdi, .LC20[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -16[rbp]
	mov	edx, 80
	mov	esi, 51
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -16[rbp]
	lea	rsi, .LC18[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"925359.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"This technique only works with disabled tcache-opti"
	.ascii	"on for glibc, see build_glibc.sh for build instruct"
	.ascii	"ions.\012\000"
	.align	2
.LC1:
	.ascii	"\012This is a simple chunks overlapping problem\012"
	.ascii	"\012\000"
	.align	2
.LC2:
	.ascii	"Let's start to allocate 3 chunks on the heap\012\000"
	.align	2
.LC3:
	.ascii	"The 3 chunks have been allocated here:\012p1=%p\012"
	.ascii	"p2=%p\012p3=%p\012\000"
	.align	2
.LC4:
	.ascii	"\012Now let's free the chunk p2\012\000"
	.align	2
.LC5:
	.ascii	"The chunk p2 is now in the unsorted bin ready to se"
	.ascii	"rve possible\012new malloc() of its size\012\000"
	.align	2
.LC6:
	.ascii	"Now let's simulate an overflow that can overwrite t"
	.ascii	"he size of the\012chunk freed p2.\012\000"
	.align	2
.LC7:
	.ascii	"For a toy program, the value of the last 3 bits is "
	.ascii	"unimportant; however, it is best to maintain the st"
	.ascii	"ability of the heap.\012\000"
	.align	2
.LC8:
	.ascii	"To achieve this stability we will mark the least si"
	.ascii	"gnifigant bit as 1 (prev_inuse), to assure that p1 "
	.ascii	"is not mistaken for a free chunk.\012\000"
	.align	2
.LC9:
	.ascii	"We are going to set the size of chunk p2 to to %d, "
	.ascii	"which gives us\012a region size of %d\012\000"
	.align	2
.LC10:
	.ascii	"\012Now let's allocate another chunk with a size eq"
	.ascii	"ual to the data\012size of the chunk p2 injected si"
	.ascii	"ze\012\000"
	.align	2
.LC11:
	.ascii	"This malloc will be served from the previously free"
	.ascii	"d chunk that\012is parked in the unsorted bin which"
	.ascii	" size has been modified by us\012\000"
	.align	2
.LC12:
	.ascii	"\012p4 has been allocated at %p and ends at %p\012\000"
	.align	2
.LC13:
	.ascii	"p3 starts at %p and ends at %p\012\000"
	.align	2
.LC14:
	.ascii	"p4 should overlap with p3, in this case p4 includes"
	.ascii	" all p3.\012\000"
	.align	2
.LC15:
	.ascii	"\012Now everything copied inside chunk p4 can overw"
	.ascii	"rites data on\012chunk p3, and data written to chun"
	.ascii	"k p3 can overwrite data\012stored in the p4 chunk.\012"
	.ascii	"\012\000"
	.align	2
.LC16:
	.ascii	"Let's run through an example. Right now, we have:\012"
	.ascii	"\000"
	.align	2
.LC17:
	.ascii	"p4 = %s\012\000"
	.align	2
.LC18:
	.ascii	"p3 = %s\012\000"
	.align	2
.LC19:
	.ascii	"\012If we memset(p4, '4', %d), we have:\012\000"
	.align	2
.LC20:
	.ascii	"\012And if we then memset(p3, '3', 80), we have:\012"
	.ascii	"\000"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #108
	mov	r1, #1
	ldr	r0, .L3+4
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #46
	mov	r1, #1
	ldr	r0, .L3+8
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #45
	mov	r1, #1
	ldr	r0, .L3+12
	bl	fwrite
	mov	r0, #248
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-28]
	mov	r0, #248
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-24]
	mov	r0, #120
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-20]
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r3, [fp, #-20]
	str	r3, [sp]
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-28]
	ldr	r1, .L3+16
	bl	fprintf
	mov	r2, #248
	mov	r1, #49
	ldr	r0, [fp, #-28]
	bl	memset
	mov	r2, #248
	mov	r1, #50
	ldr	r0, [fp, #-24]
	bl	memset
	mov	r2, #120
	mov	r1, #51
	ldr	r0, [fp, #-20]
	bl	memset
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #29
	mov	r1, #1
	ldr	r0, .L3+20
	bl	fwrite
	ldr	r0, [fp, #-24]
	bl	free
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #89
	mov	r1, #1
	ldr	r0, .L3+24
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #82
	mov	r1, #1
	ldr	r0, .L3+28
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #123
	mov	r1, #1
	ldr	r0, .L3+32
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #136
	mov	r1, #1
	ldr	r0, .L3+36
	bl	fwrite
	ldr	r3, .L3+40
	str	r3, [fp, #-16]
	mov	r3, #376
	str	r3, [fp, #-12]
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r3, [fp, #-12]
	ldr	r2, [fp, #-16]
	ldr	r1, .L3+44
	bl	fprintf
	ldr	r3, [fp, #-24]
	sub	r3, r3, #4
	ldr	r2, [fp, #-16]
	str	r2, [r3]
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #99
	mov	r1, #1
	ldr	r0, .L3+48
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #129
	mov	r1, #1
	ldr	r0, .L3+52
	bl	fwrite
	ldr	r3, [fp, #-12]
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-8]
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r3, [fp, #-12]
	ldr	r2, [fp, #-8]
	add	r3, r2, r3
	ldr	r2, [fp, #-8]
	ldr	r1, .L3+56
	bl	fprintf
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r3, [fp, #-20]
	add	r3, r3, #120
	ldr	r2, [fp, #-20]
	ldr	r1, .L3+60
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #60
	mov	r1, #1
	ldr	r0, .L3+64
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #145
	mov	r1, #1
	ldr	r0, .L3+68
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #50
	mov	r1, #1
	ldr	r0, .L3+72
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L3+76
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-20]
	ldr	r1, .L3+80
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-12]
	ldr	r1, .L3+84
	mov	r0, r3
	bl	fprintf
	ldr	r3, [fp, #-12]
	mov	r2, r3
	mov	r1, #52
	ldr	r0, [fp, #-8]
	bl	memset
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L3+76
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-20]
	ldr	r1, .L3+80
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #46
	mov	r1, #1
	ldr	r0, .L3+88
	bl	fwrite
	mov	r2, #80
	mov	r1, #51
	ldr	r0, [fp, #-20]
	bl	memset
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L3+76
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-20]
	ldr	r1, .L3+80
	mov	r0, r3
	bl	fprintf
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L4:
	.align	2
.L3:
	.word	stderr
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	385
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
