...
| Wiki Markup |
|---|
This example from Kernighan &and Ritchie \[[Kernighan 88|AA. C References#Kernighan 88]\] illustrates both the incorrect and correct techniques for deleting items from a linked list. The incorrect solution, clearly marked as wrong in the book, is bad because {{p}} is freed before the {{p->next}} is executed, so {{p->next}} reads memory that has already been freed. |
...
Compliant Solution
Kernighan & and Ritchie also show the correct solution. To correct this error, a reference to p->next is stored in q before freeing p.
...
In this example, buff is written to after it has been freed. These vulnerabilities can be relatively easily exploited to run arbitrary code with the permissions of the vulnerable process and are seldom this obvious. Typically, allocations and frees are far removed, making it difficult to recognize and diagnose these problems.
...