heap overflow -> overwrite function pointer in heap read more

Original writeup (http://taqini.space/2020/04/19/UMDCTF-2020-Pwn-writeup/#Jump-Not-Found-400pt).