Freeing the same heap allocation twice, corrupting allocator metadata for control of execution.
Teahann Knowledge Base