For a heap overflow to occur and arbitrary code to be executed, the function
free() performs the step :
hdr->next->next->prev = hdr->next->prev
I understand that the address of
hdr->next->next->prev is calculated as
hdr->next->next + 4 . Pretty clear.
Now, this value will be overwritten by the address hdr->next->prev which is controlled by the attacker and which contains the shell code possibly in the heap itself(assuming it is executable)
The target address i.e. the value in
hdr->next->next in a vanilla heap overflow should be the address in the stack that stores the return address after
free() has completed its job.
Q1. How does an attacker determine the Exact address of the return pointer of
free() on the stack ?
Q2. The whole reason this occurs is because the pointer adds 4 to the
hdr->next->next value to write the
prev pointer. Has this been fixed or is it still one of the reasons for current heap overflows. (The reason why I'm asking this is, I am aware of other heap exploitations such as double free and so on, just want to make sure if the primitive reason was fixed)