Heap Lab · Step 1 of 5 · Benign input
SAFE auth->auth = 0x00000000
Memory x/12gx 0x555555559290

        
gdb session
Heap layout · chunk A → chunk B strcpy writes left → right · base 0x555555559290
Chunk A struct auth · 56 B
metadata 16 B
name[32] 32 B · strcpy target
auth 8 B
Chunk B strdup("owner") · 40 B
metadata 16 B
service 24 B
metadata name[32] auth flag service overflowed
The vulnerable source heap-two.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

struct auth {
    char name[32];
    int auth;
};

struct auth *auth;
char *service;

int main(int argc, char **argv) {
    auth = malloc(sizeof(*auth));
    memset(auth, 0, sizeof(*auth));
    service = strdup("owner");

    if (strcmp(argv[1], "auth") == 0) {
        strcpy(auth->name, argv[2]);   /* no bounds check */
    }
    if (auth->auth) {
        printf("you have logged in already!\n");
    }
    return 0;
}
Phoenix heap-two → CVE-2025-43300
Phoenix heap-twoCVE-2025-43300 (ImageIO)
Vulnerable callstrcpy(auth->name, argv[2])DNG SamplesPerPixel loop
Attacker-controlled lengthargv[2] lengthSamplesPerPixel vs SOF3
Buffer sizename[32]per-component sample buffer
What gets corruptedAdjacent auth flagAdjacent heap object / vtable
OutcomeAuthentication bypassSandbox RCE
ClassLinear OOB heap write (CWE-787)