Analysis: Tcache under glibc 2.27 && Bypass double free
Tcache Struct
To begin with，InGlibc 2.29， Tcache bin controlled by tcache_entry and tcache_perthread_struct:
tcache_entry
Glibc2.29Added Key，Which can help us finds out about Double Free
typedef struct tcache_entry
{
struct tcache_entry *next;
...