Namesayer (mc2) — heap overflow via strcpy

spbctf

Task: menu-based heap allocator with a namesayer chunk and an executor chunk that is later fed to system(); wedding() performs an unbounded strcpy from a stack buffer into namesayer+0x10. Solution: arrange the allocator so the namesayer sits between the initial and a new executor, overflow 32 bytes forward into the next executor's data, and have system() execute cat${IFS}/flag.txt (whitespace-free so scanf/strcpy don't truncate).