Simple BOF vulnerability is in the **vote** routine.
If vote to **"oshima"**, we can overwrite chunk pointer and vote number.
So, we can continuously write everywhere with arbitary 1byte.
I use one_gadget and overwrite **__malloc_hook**.