malloc and buffer over-read vulnerability

gistfile1.txt

$ uname -a
Linux vm-ubuntu64 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:39:31 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

$ gcc test_malloc.c

$ ./a.out
[+] allocate chunks: a = malloc(32), b = malloc(256), c = malloc(32)
a = 0x832010, b = 0x832040, c = 0x832150
*a = 41414141, *b = 42424242, *c = 45524548
[+] free the mid chunk: free(b)
a = 0x832010, b = 0x832040, c = 0x832150
*a = 41414141, *b = 6a284778, *c = 45524548
[+] allocate a new chunk: b = malloc(64)
a = 0x832010, b = 0x832040, c = 0x832150
*a = 41414141, *b = 44444444, *c = 45524548
[+] emurate buffer over-read from the new chunk
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDBBBBBBBB�xG(jexG(jeBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB�0HERE_IS_SECRET_KEY!CCCCCCCCCCCC�

$ ldd a.out
        linux-vdso.so.1 =>  (0x00007fff2e9fe000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff8e869f000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff8e8a67000)

$ readlink -e /lib/x86_64-linux-gnu/libc.so.6
/lib/x86_64-linux-gnu/libc-2.15.so

test_malloc.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main()
{
    char *a, *b, *c;

    puts("[+] allocate chunks: a = malloc(32), b = malloc(256), c = malloc(32)");
    a = malloc(32);
    b = malloc(256);
    c = malloc(32);
    memset(a, 'A', 32);
    memset(b, 'B', 256);
    memset(c, 'C', 32);
    strcpy(c, "HERE_IS_SECRET_KEY!");
    printf("a = %p, b = %p, c = %p\n", a, b, c);
    printf("*a = %08x, *b = %08x, *c = %08x\n", *(int *)a, *(int *)b, *(int *)c);

    puts("[+] free the mid chunk: free(b)");
    free(b);
    printf("a = %p, b = %p, c = %p\n", a, b, c);
    printf("*a = %08x, *b = %08x, *c = %08x\n", *(int *)a, *(int *)b, *(int *)c);

    puts("[+] allocate a new chunk: b = malloc(64)");
    b = malloc(64);
    memset(b, 'D', 64);
    printf("a = %p, b = %p, c = %p\n", a, b, c);
    printf("*a = %08x, *b = %08x, *c = %08x\n", *(int *)a, *(int *)b, *(int *)c);

    puts("[+] emurate buffer over-read from the new chunk");
    write(0, b, 65535);

    free(b);
    free(c);
    free(a);
    return 0;
}