#include <malloc.h>  

 main() {
   char *s, c; int i;
   s = (char *)malloc(10*sizeof(char));
   c=s[1];    // Read not initialized value
   s[12]=' '; // Write after block
   c=s[-2];   // Read before block
   free(s);
   for(i=0;i>=0;i++) s[i]=c;
 }