Change problem name by overwriting `voting_ballot` with one null byte. Then we can leak heap address, and we can make fake chunk. Leak libc address, make `__malloc_hook ` to one gadget (a.k.a magic gadget). Finally, change state to 1 and call `malloc`