Use-after-free: object lifetime and controlled reuse

Mechanism

A use-after-free occurs when a reference survives the end of an allocation lifetime. Its exploitability depends on whether the allocator reuses the same region for controlled data and whether the stale consumer interprets that region as an object, pointer table, or length field. A stale read is distinct from a stale write or indirect call.

Practical method

Build a lifetime timeline covering allocation, ownership transfer, release, and stale use. Track addresses with a debugger. Attempt a same-size replacement object and verify actual reuse before interpreting its fields. Identify the first operation on the stale object and the constraints it imposes on replacement bytes.

allocate A -> retain alias -> free A -> allocate B -> use alias
                                  same address is necessary for this reuse plan

Interpreting evidence

Show that the stale consumer reads the replacement object, not merely freed bytes. Allocator size classes and thread-local caches influence reuse, so record requested sizes, thread, and allocation sequence.

Pitfalls and limits

An address sanitizer deliberately changes allocator behavior. Reference counts can extend lifetimes unexpectedly. Modern allocators encode free-list pointers; corrupting a pointer is not automatically sufficient for allocation control.