Linux Heap Exploitation Intro Series: Set you free() – part 1

This post analyzes a vulnerability in APNG Optimizer (apngopt) where a crafted PNG chunk length causes an unsigned integer overflow and subsequent underflow, resulting in an oversized fread into a zero/very-small allocation and a heap overflow. The author details the root cause in read_chunk(), demonstrates how to craft APNG frames to trigger the crash, and outlines exploit-development steps (heap layout control, fastchunk alignment) with debugging tools, with a promise to continue to full exploit construction in a follow-up.