links corrected

Author: MohsenDehghankar

README.md

@@ -8,7 +8,7 @@
 
 In November 2017 a [use-after-free](#uaf-vulnerability) bug to linux [kernel](#kernel) was detected by [syzkaller ](#syzkaller)system. In February 2018 this was patched in some linux kernels and android versions.
 
-This fix was never included in [Android monthly security bulletins](#andoird-security-bulletins), so it was not patched in many newly released devices such as Pixel and Pixel2. 
+This fix was never included in [Android monthly security bulletins](#android-security-bulletins), so it was not patched in many newly released devices such as Pixel and Pixel2. 
 
 In September 2019 android was informed of the security implications of this bug by [Project Zero](#project-zero). Then android assigned [CVE-2019-2215](#cve-2019-2215) to this vulnerability to make it more formal and known.
 
@@ -23,7 +23,7 @@ We will use this Proof of Concept (PoC):
 
 # Triggering vulnerability
 
-We will first show you a way to trigger this vulnerability on an android emulator and make a kernel crash. Then to see how it would be dangerous, we continue using PoC to get root access in the simulated android device. Then we will analyze the kernel code to see what is the reason ([static](#static-analysis) and [dynamic analysis](dynamic-analysis)).
+We will first show you a way to trigger this vulnerability on an android emulator and make a kernel crash. Then to see how it would be dangerous, we continue using PoC to get root access in the simulated android device. Then we will analyze the kernel code to see what is the reason ([static](#static-analysis) and [dynamic analysis](#dynamic-analysis)).
 
 After analysis, we will see how we got the root access. At last we see how this vulnerability is mitigated using patches.
 
@@ -290,14 +290,6 @@ the result is 0xa0 and if we put wait.head instead of wait in command , the resu
 
 
 
-
-<p id="gdcalert4" ><span style="color: red; font-weight: bold">>>>>>  gd2md-html alert: inline drawings not supported directly from Docs. You may want to copy the inline drawing to a standalone drawing and export by reference. See <a href="https://github.com/evbacher/gd2md-html/wiki/Google-Drawings-by-reference">Google Drawings by reference</a> for details. The img URL below is a placeholder. </span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert5">Next alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>
-
-
-![drawing](https://docs.google.com/drawings/d/12345/export/png)
-
-
-
 *   second part of result
 
   <pre>
@@ -455,7 +447,7 @@ This method (like **readv** and **recvmsg**) first of all copies the iovec array
 
 We can write and read buffers by using **pipe** , pipe is a struct that gives us two file descriptors, one for reading and one for writing. Pipe has a length in bytes, when one process writes to a pipe more than its length, pipe blocks in that process and waits for another process to read from that pipe (using the read file descriptor of that pipe).
 
-[pip in linux](https://man7.org/linux/man-pages/man2/pipe2.2.html)
+[pipe in linux](https://man7.org/linux/man-pages/man2/pipe2.2.html)
 
 Kernel tries to allocate memory (for a struct) according to its size. For example when we freed the **binder_thread** struct from memory (see static analysis), and after that if we have a struct with a size similar to binder_thread, it has a good chance to be allocated at the same place as the freed binder_thread.