pwn7 enlarged_calc (ENLARGED Calculator)

pwn_spbctf

Task: x86-64 calculator pwn (NON-PIE, canary, NX) that loads flag.txt onto the heap; option B sets aggregate boundaries but only validates count<=start or end<0, allowing an unbounded NEGATIVE start. Solution: groom heap with 8 zeros so realloc moves the numbers buffer past the flag chunk, then leak each OOB int below the buffer via cumulative-sum differencing Sum(pos,0)-Sum(pos+1,0) to reassemble the flag in one connection.