The writes for a spray are pre exploit, you are going through an allocator to get the space you're writing to. Put another way, its the apps job to write the sp

The writes for a spray are pre exploit, you are going through an allocator to get the space you're writing to. Put another way, its the apps job to write the spray into "free space". Sprays are pretty crashy but the heap setup is not usually the problem, its that the pointer you want to control "missed" the sprayed area.