In this writeup we will show how we reversed an implementation of Splay Trees, found an out of bound read, and used it to cause a double free and exploit the libc tcache to achieve code execution.
