Tags: pwn 

Rating: 5.0

Use realloc(ptr,0) to get double free. Do fastbin corruption and overwrite realloc_hook.