heap_fastbin.c

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
 
#define CHUNK_OFFSET  (2 * sizeof(size_t))
#define printFastbinList(addr)  printBinList(addr, NULL)
 
void* chunk2mem(void* ptr) {
	return ptr + CHUNK_OFFSET;
}
 
void* mem2chunk(void* ptr) {
	return ptr - CHUNK_OFFSET;
}
 
void printChunkAddress(void* ptr, char* name) {
	printf("%s:\tchunk 0x%08lx\n", name, mem2chunk(ptr));
}
 
void printBinList(long* ptr, long* abort) {
	int i = 10;
 
	ptr = mem2chunk(ptr);
 
	if(abort)
		abort = mem2chunk(abort);
 
	printf("bin list: ");
	printf("0x%08lx -> ", ptr);
 
	while(1) {
		if(i-- <= 0) {
			printf("...");
			break;
		}
		// get the address of the next chunk
		ptr = chunk2mem(ptr);
		ptr = (long*) *ptr;
 
		if(ptr == abort) {
			printf("0x%08lx", ptr);
			break;
		}
 
		printf("0x%08lx -> ", ptr);
		fflush(stdout);
	}
	puts("");
}
 
int main(void) {
	size_t size = 0xf;
 
	long* ptr;
	long* tmp;
	int i;
 
	// #1: allocating chunks
	long* x = malloc(size);
	printChunkAddress(x, "x");
 
	long* a = malloc(size);
	long* b = malloc(size);
	long* c = malloc(size);
	printChunkAddress(a, "a");
	printChunkAddress(b, "b");
	printChunkAddress(c, "c");
 
	// #2: freeing a, b, c
	free(a);
	free(b);
	free(c);
 
	puts("\n--8<-- the fastbin before the double-free");
	printFastbinList(c);
 
	// #3: freeing b again
	free(b);
 
	puts("\n--8<-- the fastbin after the double-free");
	printFastbinList(c);
 
	// #4: reallocating b
	b = malloc(size);
 
	// #5: inserting x into the list
	*b = (long) mem2chunk(x);
	*x = (long) mem2chunk(a);
 
	puts("\n--8<-- the manipulated fastbin");
	printFastbinList(c);
 
	// #6: allocating chunks from the manipulated fastbin
	puts("\n--8<-- chunks returned by malloc");
 
	for(i=0; i < 5; i++) {
		ptr = malloc(size);
		printChunkAddress(ptr, "ptr");
	}
 
	exit(0);
}

.zshrc

function ppid_of() {
	grep ^PPid /proc/$1/status | awk '{print $2}'
}
 
function is_ssh_login() {
	pid=$$
 
	while [ $pid != 1 ]; do
		if `grep -q sshd /proc/$pid/cmdline` ; then
			return 0
		fi
		pid=`ppid_of $pid`
	done
 
	return -1
}

.zshrc

## see console_codes(4) for number<->color relations
# red foreground
root_color=31
# green foreground
user_color=32
# blue foreground
cwd_color=34
 
 
if [ `id -u` == 0 ]; then
	hostname_color=$root_color
else
	hostname_color=$user_color
fi
 
if is_ssh_login ; then
	# background color = foreground color
	hostname_color=`expr $hostname_color + 10`
fi
 
PROMPT=`echo "%{\033[01;${hostname_color}m%}%n@%m%{\033[00m%}:%b%{\033[01;${cwd_color}m%}%~%{\033[00m%} %# "`