Tags: pwn heap
Rating:
## tl;dr
+ Overflow the char candle counter stored in the wax structure and trigger uaf.+ Use the uaf to trigger double free and get shell.
I don't remember