Simple Linux kernel memory corruption bug can lead to complete system compromise(googleprojectzero.blogspot.com)

    int main()
    {
        int *p = malloc(sizeof(*p));
        *(volatile int *)p = 20;

        printf("p=%d\n", *p);
        *p = 30; /* this is gone from the -O2 compiled code */
        free(p);
        return 0;
    }

    push   $0x4
    call   460 <malloc@plt>
    movl   $0x14,(%eax) # Assignment of 20
    mov    %eax,%esi
    pop    %eax
    lea    -0x1930(%ebx),%eax
    pop    %edx
    pushl  (%esi) # push the 20
    push   %eax
    call   440 <printf@plt>
    mov    %esi,(%esp) # load address to pass to free(), no assignment between printf() and free()
    call   450 <free@plt>

    for (i = 0; i < 1000; i++) {
        struct foobar *ptr = malloc(sizeof(struct foobar));
        ptr->this = a[i];
        ptr->that = b[i];
        if (ptr->this > 0) {
            do_stuff(ptr);
        }
        free(ptr);
    }