Problem

1. Allocate object
p = new COptionElement();
// 2. Free object
delete p;
Attacker reallocates p as
a new type
// 3. Use freed object
p->Foo();
// 2. Zero object, but don’t free
ZeroMemory(p, sizeof(T));
// 3. Garbage collection phase
frees all objects with no references
(stack, registers, heap)
Tactic Applies to First shipped
Eliminate entire classes of vulnerabilities Edge on Windows 10 and backported to IE9+ on Windows Vista+ July, 2015 (Windows 10 RTM)