参考资料 http://netsec.ccert.edu.cn/wp-content/uploads/2015/10/2015-1029-yangkun-Gold-Mining-CTF.pdf (长亭内存 PWN 总结) 栈触发 堆触发 unlink off-by-one Null Byte Off-by-one