	.file	"188371.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
	.align 8
.LC0:
	.string	"\nThis is a simple chunks overlapping problem"
	.align 8
.LC1:
	.string	"\nThis is also referenced as Nonadjacent Free Chunk Consolidation Attack\n"
	.align 8
.LC2:
	.string	"\nLet's start to allocate 5 chunks on the heap:"
.LC3:
	.string	"\n\nchunk p1 from %p to %p"
.LC4:
	.string	"\nchunk p2 from %p to %p"
.LC5:
	.string	"\nchunk p3 from %p to %p"
.LC6:
	.string	"\nchunk p4 from %p to %p"
.LC7:
	.string	"\nchunk p5 from %p to %p\n"
	.align 8
.LC8:
	.string	"\nLet's free the chunk p4.\nIn this case this isn't coealesced with top chunk since we have p5 bordering top chunk after p4\n"
	.align 8
.LC9:
	.string	"\nLet's trigger the vulnerability on chunk p1 that overwrites the size of the in use chunk p2\nwith the size of chunk_p2 + size of chunk_p3\n"
	.align 8
.LC10:
	.string	"\nNow during the free() operation on p2, the allocator is fooled to think that \nthe nextchunk is p4 ( since p2 + size_p2 now point to p4 ) \n"
	.align 8
.LC11:
	.string	"\nThis operation will basically create a big free chunk that wrongly includes p3\n"
	.align 8
.LC12:
	.string	"\nNow let's allocate a new chunk with a size that can be satisfied by the previously freed chunk\n"
	.align 8
.LC13:
	.string	"\nOur malloc() has been satisfied by our crafted big free chunk, now p6 and p3 are overlapping and \nwe can overwrite data in p3 by writing on chunk p6\n"
.LC14:
	.string	"\nchunk p6 from %p to %p"
.LC15:
	.string	"\nchunk p3 from %p to %p\n"
.LC16:
	.string	"\nData inside chunk p3: \n\n"
.LC17:
	.string	"%s\n"
	.align 8
.LC18:
	.string	"\nLet's write something inside p6\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 80
	mov	DWORD PTR -76[rbp], 1
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 44
	mov	esi, 1
	lea	rdi, .LC0[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 72
	mov	esi, 1
	lea	rdi, .LC1[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 46
	mov	esi, 1
	lea	rdi, .LC2[rip]
	call	fwrite@PLT
	mov	edi, 1000
	call	malloc@PLT
	mov	QWORD PTR -48[rbp], rax
	mov	edi, 1000
	call	malloc@PLT
	mov	QWORD PTR -40[rbp], rax
	mov	edi, 1000
	call	malloc@PLT
	mov	QWORD PTR -32[rbp], rax
	mov	edi, 1000
	call	malloc@PLT
	mov	QWORD PTR -24[rbp], rax
	mov	edi, 1000
	call	malloc@PLT
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -48[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -72[rbp], eax
	mov	rax, QWORD PTR -40[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -68[rbp], eax
	mov	rax, QWORD PTR -32[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -64[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -60[rbp], eax
	mov	rax, QWORD PTR -16[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -56[rbp], eax
	mov	rax, QWORD PTR -48[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	rdx, QWORD PTR -48[rbp]
	lea	rcx, [rax+rdx]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -48[rbp]
	lea	rsi, .LC3[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	rdx, QWORD PTR -40[rbp]
	lea	rcx, [rax+rdx]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -40[rbp]
	lea	rsi, .LC4[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -32[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	rdx, QWORD PTR -32[rbp]
	lea	rcx, [rax+rdx]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -32[rbp]
	lea	rsi, .LC5[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	rdx, QWORD PTR -24[rbp]
	lea	rcx, [rax+rdx]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -24[rbp]
	lea	rsi, .LC6[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -16[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	rdx, QWORD PTR -16[rbp]
	lea	rcx, [rax+rdx]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -16[rbp]
	lea	rsi, .LC7[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edx, DWORD PTR -72[rbp]
	mov	rax, QWORD PTR -48[rbp]
	mov	esi, 65
	mov	rdi, rax
	call	memset@PLT
	mov	edx, DWORD PTR -68[rbp]
	mov	rax, QWORD PTR -40[rbp]
	mov	esi, 66
	mov	rdi, rax
	call	memset@PLT
	mov	edx, DWORD PTR -64[rbp]
	mov	rax, QWORD PTR -32[rbp]
	mov	esi, 67
	mov	rdi, rax
	call	memset@PLT
	mov	edx, DWORD PTR -60[rbp]
	mov	rax, QWORD PTR -24[rbp]
	mov	esi, 68
	mov	rdi, rax
	call	memset@PLT
	mov	edx, DWORD PTR -56[rbp]
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 69
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 122
	mov	esi, 1
	lea	rdi, .LC8[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 138
	mov	esi, 1
	lea	rdi, .LC9[rip]
	call	fwrite@PLT
	mov	edx, DWORD PTR -68[rbp]
	mov	eax, DWORD PTR -64[rbp]
	add	edx, eax
	mov	eax, DWORD PTR -76[rbp]
	add	edx, eax
	mov	ecx, DWORD PTR -72[rbp]
	mov	rax, QWORD PTR -48[rbp]
	add	rax, rcx
	add	edx, 16
	mov	DWORD PTR [rax], edx
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 139
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 80
	mov	esi, 1
	lea	rdi, .LC11[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 96
	mov	esi, 1
	lea	rdi, .LC12[rip]
	call	fwrite@PLT
	mov	edi, 2000
	call	malloc@PLT
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -52[rbp], eax
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 150
	mov	esi, 1
	lea	rdi, .LC13[rip]
	call	fwrite@PLT
	mov	edx, DWORD PTR -52[rbp]
	mov	rax, QWORD PTR -8[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC14[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edx, DWORD PTR -64[rbp]
	mov	rax, QWORD PTR -32[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -32[rbp]
	lea	rsi, .LC15[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 25
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -32[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 33
	mov	esi, 1
	lea	rdi, .LC18[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	edx, 1500
	mov	esi, 70
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 25
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -32[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"188371.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"\012This is a simple chunks overlapping problem\000"
	.align	2
.LC1:
	.ascii	"\012This is also referenced as Nonadjacent Free Chu"
	.ascii	"nk Consolidation Attack\012\000"
	.align	2
.LC2:
	.ascii	"\012Let's start to allocate 5 chunks on the heap:\000"
	.align	2
.LC3:
	.ascii	"\012\012chunk p1 from %p to %p\000"
	.align	2
.LC4:
	.ascii	"\012chunk p2 from %p to %p\000"
	.align	2
.LC5:
	.ascii	"\012chunk p3 from %p to %p\000"
	.align	2
.LC6:
	.ascii	"\012chunk p4 from %p to %p\000"
	.align	2
.LC7:
	.ascii	"\012chunk p5 from %p to %p\012\000"
	.align	2
.LC8:
	.ascii	"\012Let's free the chunk p4.\012In this case this i"
	.ascii	"sn't coealesced with top chunk since we have p5 bor"
	.ascii	"dering top chunk after p4\012\000"
	.align	2
.LC9:
	.ascii	"\012Let's trigger the vulnerability on chunk p1 tha"
	.ascii	"t overwrites the size of the in use chunk p2\012wit"
	.ascii	"h the size of chunk_p2 + size of chunk_p3\012\000"
	.align	2
.LC10:
	.ascii	"\012Now during the free() operation on p2, the allo"
	.ascii	"cator is fooled to think that \012the nextchunk is "
	.ascii	"p4 ( since p2 + size_p2 now point to p4 ) \012\000"
	.align	2
.LC11:
	.ascii	"\012This operation will basically create a big free"
	.ascii	" chunk that wrongly includes p3\012\000"
	.align	2
.LC12:
	.ascii	"\012Now let's allocate a new chunk with a size that"
	.ascii	" can be satisfied by the previously freed chunk\012"
	.ascii	"\000"
	.align	2
.LC13:
	.ascii	"\012Our malloc() has been satisfied by our crafted "
	.ascii	"big free chunk, now p6 and p3 are overlapping and \012"
	.ascii	"we can overwrite data in p3 by writing on chunk p6\012"
	.ascii	"\000"
	.align	2
.LC14:
	.ascii	"\012chunk p6 from %p to %p\000"
	.align	2
.LC15:
	.ascii	"\012chunk p3 from %p to %p\012\000"
	.align	2
.LC16:
	.ascii	"\012Data inside chunk p3: \012\012\000"
	.align	2
.LC17:
	.ascii	"%s\012\000"
	.align	2
.LC18:
	.ascii	"\012Let's write something inside p6\012\000"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #60
	mov	r3, #1
	str	r3, [fp, #-64]
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #44
	mov	r1, #1
	ldr	r0, .L3+4
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #72
	mov	r1, #1
	ldr	r0, .L3+8
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #46
	mov	r1, #1
	ldr	r0, .L3+12
	bl	fwrite
	mov	r0, #1000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-60]
	mov	r0, #1000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-56]
	mov	r0, #1000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-52]
	mov	r0, #1000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-48]
	mov	r0, #1000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-44]
	ldr	r0, [fp, #-60]
	bl	malloc_usable_size
	str	r0, [fp, #-40]
	ldr	r0, [fp, #-56]
	bl	malloc_usable_size
	str	r0, [fp, #-36]
	ldr	r0, [fp, #-52]
	bl	malloc_usable_size
	str	r0, [fp, #-32]
	ldr	r0, [fp, #-48]
	bl	malloc_usable_size
	str	r0, [fp, #-28]
	ldr	r0, [fp, #-44]
	bl	malloc_usable_size
	str	r0, [fp, #-24]
	ldr	r3, .L3
	ldr	r4, [r3]
	ldr	r0, [fp, #-60]
	bl	malloc_usable_size
	mov	r2, r0
	ldr	r3, [fp, #-60]
	add	r3, r3, r2
	ldr	r2, [fp, #-60]
	ldr	r1, .L3+16
	mov	r0, r4
	bl	fprintf
	ldr	r3, .L3
	ldr	r4, [r3]
	ldr	r0, [fp, #-56]
	bl	malloc_usable_size
	mov	r2, r0
	ldr	r3, [fp, #-56]
	add	r3, r3, r2
	ldr	r2, [fp, #-56]
	ldr	r1, .L3+20
	mov	r0, r4
	bl	fprintf
	ldr	r3, .L3
	ldr	r4, [r3]
	ldr	r0, [fp, #-52]
	bl	malloc_usable_size
	mov	r2, r0
	ldr	r3, [fp, #-52]
	add	r3, r3, r2
	ldr	r2, [fp, #-52]
	ldr	r1, .L3+24
	mov	r0, r4
	bl	fprintf
	ldr	r3, .L3
	ldr	r4, [r3]
	ldr	r0, [fp, #-48]
	bl	malloc_usable_size
	mov	r2, r0
	ldr	r3, [fp, #-48]
	add	r3, r3, r2
	ldr	r2, [fp, #-48]
	ldr	r1, .L3+28
	mov	r0, r4
	bl	fprintf
	ldr	r3, .L3
	ldr	r4, [r3]
	ldr	r0, [fp, #-44]
	bl	malloc_usable_size
	mov	r2, r0
	ldr	r3, [fp, #-44]
	add	r3, r3, r2
	ldr	r2, [fp, #-44]
	ldr	r1, .L3+32
	mov	r0, r4
	bl	fprintf
	ldr	r2, [fp, #-40]
	mov	r1, #65
	ldr	r0, [fp, #-60]
	bl	memset
	ldr	r2, [fp, #-36]
	mov	r1, #66
	ldr	r0, [fp, #-56]
	bl	memset
	ldr	r2, [fp, #-32]
	mov	r1, #67
	ldr	r0, [fp, #-52]
	bl	memset
	ldr	r2, [fp, #-28]
	mov	r1, #68
	ldr	r0, [fp, #-48]
	bl	memset
	ldr	r2, [fp, #-24]
	mov	r1, #69
	ldr	r0, [fp, #-44]
	bl	memset
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #122
	mov	r1, #1
	ldr	r0, .L3+36
	bl	fwrite
	ldr	r0, [fp, #-48]
	bl	free
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #138
	mov	r1, #1
	ldr	r0, .L3+40
	bl	fwrite
	ldr	r2, [fp, #-36]
	ldr	r3, [fp, #-32]
	add	r2, r2, r3
	ldr	r3, [fp, #-64]
	add	r2, r2, r3
	ldr	r1, [fp, #-60]
	ldr	r3, [fp, #-40]
	add	r3, r1, r3
	add	r2, r2, #8
	str	r2, [r3]
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #139
	mov	r1, #1
	ldr	r0, .L3+44
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #80
	mov	r1, #1
	ldr	r0, .L3+48
	bl	fwrite
	ldr	r0, [fp, #-56]
	bl	free
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #96
	mov	r1, #1
	ldr	r0, .L3+52
	bl	fwrite
	mov	r0, #2000
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-20]
	ldr	r0, [fp, #-20]
	bl	malloc_usable_size
	str	r0, [fp, #-16]
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #150
	mov	r1, #1
	ldr	r0, .L3+56
	bl	fwrite
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r2, [fp, #-20]
	ldr	r3, [fp, #-16]
	add	r3, r2, r3
	ldr	r2, [fp, #-20]
	ldr	r1, .L3+60
	bl	fprintf
	ldr	r3, .L3
	ldr	r0, [r3]
	ldr	r2, [fp, #-52]
	ldr	r3, [fp, #-32]
	add	r3, r2, r3
	ldr	r2, [fp, #-52]
	ldr	r1, .L3+64
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #25
	mov	r1, #1
	ldr	r0, .L3+68
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-52]
	ldr	r1, .L3+72
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #33
	mov	r1, #1
	ldr	r0, .L3+76
	bl	fwrite
	ldr	r2, .L3+80
	mov	r1, #70
	ldr	r0, [fp, #-20]
	bl	memset
	ldr	r3, .L3
	ldr	r3, [r3]
	mov	r2, #25
	mov	r1, #1
	ldr	r0, .L3+68
	bl	fwrite
	ldr	r3, .L3
	ldr	r3, [r3]
	ldr	r2, [fp, #-52]
	ldr	r1, .L3+72
	mov	r0, r3
	bl	fprintf
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L4:
	.align	2
.L3:
	.word	stderr
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	1500
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
