Sticking Point: Make sure that you always have to allocate the intended data(in my case, dummy_node) in the UAF field by adjusting heap(adding “pad”).

The exploit I wrote during the competition(unfinished):
https://gist.github.com/potetisensei/a274cbe1491239fc4a34

The exploit I’ve just written:
https://gist.github.com/potetisensei/585faf74c0ad459eca17