Question $15$

In our example use$-$after$-$free attack on Fast bins, we allocated and then freed $10$ size $\backslash (0\backslash$times $20\backslash )$ chunks as shown here:

In our lecture, we overwrite the forward pointer of the first chunk in fast bins.

The attack is still feasible with certain small changes, if we overwrite the forward pointer of the second chunk in fast bins.

$(2)$

The attack is still feasible with certain small changes, if we overwrite the forward pointer of the third chunk in fast bins.

The attack is still feasible with certain small changes, if besides these $10$ allocations and frees, we also allocated $5$ chunks of $\backslash (0\backslash$times $300\backslash )$ bytes and freed them.

$(4)$

The attack is still feasible with certain small changes, if besides these $10$ allocations and frees, we also allocated $7$ chunks of $\backslash (0\backslash$times $300\backslash )$ bytes and freed them.

The attack is still feasible with certain small changes, if besides these $10$ allocations and frees, we also we allocated $10$ chunks of $\backslash (0\backslash$times $300\backslash )$ bytes and freed them.