Heap Overruns – cont.

• When an application frees memory free heap sections are merged.

• As a result, an attacker can cause arbitrary values to be written to arbitrary locations!

• The road from here to arbitrary code execution is not long (demo next week).