Question $13$

In our example use$-$after$-$free attack on Fast bins, we allocated and then freed $10$ size $\backslash (0\backslash$times $20\backslash )$ chunks as shown here:

This use$-$after$-$free attack on Fast bins will still work if we allocated and then freed $9$ size $\backslash (0\backslash$times $20\backslash )$ chunks instead of $10$ here.

$(2)$

This use$-$after$-$free attack on Fast bins will still work if we allocated and then freed $8$ size $\backslash (0\backslash$times $20\backslash )$ chunks instead of $10$ here.

$(3)$

This use$-$after$-$free attack on Fast bins will still work if we allocated and then freed $7$ size $\backslash (0\backslash$times $20\backslash )$ chunks instead of $10$ here.

$(4)$

This use$-$after$-$free attack on Fast bins will still work if we allocated and then freed $6$ size $\backslash (0\backslash$times $20\backslash )$ chunks instead of $10$ here.

We later edited the first free chunk in fast bins and overwrite its pointers.

If we overwrite the pointers on the first free chunk in fast bins and let it point to malloc GOT entry, which will not transitively point to a chunk that has a forward pointer of $0,$ this use$-$after$-$free attack on Fast bins will still work

$(6)$

If we allocated and freed $10$ size $\backslash (0\backslash$times $300\backslash )$ chunks instead of $\backslash (0\backslash$times $20\backslash )$ chunks here, we can perform use$-$after$-$free attack on Fast bins.

If we allocated and freed $8$ size $\backslash (0\backslash$times $300\backslash )$ chunks instead of $\backslash (0\backslash$times $20\backslash )$ chunks here, nothing will be put in TCache bins.