# Heap Overflow

> Heap buffer overflow: adjacent chunk smash, metadata overwrite, freelist poison setup, Windows/Linux allocator notes.

- Skill: `netvar1337/heap-overflow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/heap-overflow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/heap-overflow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/heap-overflow

---


# Heap buffer overflow

## Identify
- Copy/loop past heap buffer into next chunk/object
- Wrong capacity after realloc shrink
- Integer wrap → small alloc + big copy (pair `integer-overflow`)

## What you hit
- **Inline object fields** (vtables, function ptrs, length, pointers) — best case
- **Allocator metadata** (glibc chunks, LFH/Backend, segment heaps)
- **Guard pages** (if present) — need precise sizes

## Glibc (ptmalloc) themes
- Overwrite next chunk size/prev_size → fake free / consolidate tricks
- Modern tcache/safe-linking constraints — poison with obfuscated ptrs
- Leak via unsorted bin / fd bk before write-what-where

## Windows heap themes
- NT heap LFH vs backend vs segment heap (Win10+)
- Encode freelist pointers; variable encoding keys
- Prefer **typed object corruption** over raw freelist when LFH randomized
- Look for useful adjacent classes (C++ objects with vptr)

## Method
1. Bucket size: control alloc sizes to land victim adjacent
2. Spray/groom order; avoid free noise
3. Overflow content: padding + precise field/metadata rewrite
4. Trigger virtual call / free / unlink of corrupted object

## Pair with
`heap-exploitation`, `use-after-free`, `integer-overflow`, `exploit-dev`.