| /* Write the address of a free'd pointer into a buffer | |
| using snprintf() then free it again. */ | |
| #include <stdlib.h> | |
| #include <stdio.h> | |
| #define BUFSZ 1000 | |
| char buffer[BUFSZ]; | |
| void f() | |
| { | |
| char *ptr; | |
| sscanf(buffer, "%p", &ptr); | |
| free(ptr); | |
| return; | |
| } | |
| int main() | |
| { | |
| char *string; | |
| string = malloc(10000); | |
| free(string); | |
| snprintf(buffer, BUFSZ, "%p", string); | |
| f(); | |
| return 0; | |
| } |