Rating:
Overwrite the array pointer with stack overflow, which make it possible to write to an arbitrary address.
I disabled `__stack_chk_fail` and leaked libc base and changed the GOT address of `free` to `system`.
[writeup](https://ptr-yudai.hatenablog.com/entry/2019/04/29/122753#Pwn-155-quicksort)
