Forbidden fruits create many jams From Mailer-Daemon Sun Oct 01 19:06:50 2006 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1Guaox-0008D5-8e for mharc-bug-gnu-arch@gnu.org; Sun, 01 Oct 2006 19:06:49 -0400 Received…
After some basic math calculations (not presented here since they are more or less trivial), one can prove that the only chunk they can overwrite is the chunk pointed by 'src'. Then, cli_calloc() can be forced to allocate such a chunk…