wer2

Gambling loops put into most mobile games, especially when targeting children.

Oh no, when they deserialized the int/pointer they used it like the original structure (which now points to freed memory). They meant to serialize the data structure across, but only sent the memory address.

Mine was very much like that, but they also deleted the pointer after sending it, but before receiving it for good measure.

The C++ code went something like this:

1. Conver pointer to int
2. Serialize the int over IPC to self using Linux Message Queues
3. Delete/free the pointer
4. Read the int from the queue
5. Convert to pointer
6. “Use” the pointer