An analysis, based on glibc 2.43+, of how a single chunk shared between two different threads' tcaches ends up overlapping two allocations of different sizes after one thread exits.

A walkthrough of exploiting Rust binaries by abusing panic hooks, showing how a simple panic can lead all the way to a shell.