Double Free Corruption

Tricking malloc into returning a nearly-arbitrary pointer by abusing the fastbin freelist.