blob: a3d7f7020c0b1cc27e7babe54932983b442e3865 [file] [log] [blame]
/* Use after free with jumps */
#include <stdlib.h>
#include <setjmp.h>
#include <string.h>
jmp_buf b;
void f(void *ptr)
{
free(ptr);
longjmp(b, 1);
}
int main()
{
char *ptr;
ptr = malloc(100);
if (setjmp(b) != 0)
{
strcpy(ptr, "String");
return 0;
}
f(ptr);
}