#include <stdio.h>
#include <stdlib.h>

/*
    PoC on tcache's internals regarding fast chunks (0x20 - 0x80).
*/
int main(void) {

    void* a = malloc(0x20);
    void* b = malloc(0x20);
    void* c = malloc(0x20);
    void* d = malloc(0x20);
    void* e = malloc(0x20);
    void* f = malloc(0x20);
    void* g = malloc(0x20);
    void* h = malloc(0x20);
    void* i = malloc(0x20);
    void* j = malloc(0x20);
    void* k = malloc(0x20);

    /* Fill in the tcache for size 0x20. */
    free(a);
    free(b);
    free(c);
    free(d);
    free(e);
    free(f);
    free(g);
    /* Place the rest in the corresponding fastbin list. */
    free(h);
    free(i);
    free(j);
    free(k);

    /* Allocate the chunks out of the tcache->entries[idx]. */
    malloc(0x20);
    malloc(0x20);
    malloc(0x20);
    malloc(0x20);
    malloc(0x20);
    malloc(0x20);
    malloc(0x20);
    /*
        Retrieve chunk from fastbin.
        The rest of the chunks (h, i, j, k) will be allocated
        out of their fastbin and will be placed back into tcache->entries[idx].
    */
    malloc(0x20);

    puts("Done!");

    /*
        Yes, I know. I should've free'd the latest allocations
        but that would require me to write down the rest of the
        alphabet. Sue me.
    */
    return 0;
}