Borrowing chunks and returning to libc – turning the code against itself