Double Free Corruption Tricking malloc into returning a nearly-arbitrary pointer by abusing the fastbin freelist.