Rating:
In short:- UAF in `show` and `remove`- use `fd` as jump table, since heap is `rwx`, jump to heap for executing shellcode
I don't remember