I guess this bucle is trying to reuse the freed memory. Would be nice to debug which size is exactly necessary to reuse the freed object, so exploitation will be more reliable I guess :)