Ah, good point. From: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/ https://sploitfun.wordpress.com/2015/02/10/understanding-gli...

Ah, good point. From: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/ https://sploitfun.wordpress.com/2015/02/10/understanding-gli... Last 3 bits of this field contains flag information. PREV_INUSE (P) – This bit is set when previous chunk is allocated. IS_MMAPPED (M) – This bit is set when chunk is mmap’d. NON_MAIN_ARENA (N) – This bit is set when this chunk belongs to a thread arena. It certainly doesn't look like those could be used against ASLR.