UAF

off-by-one

off-by-none