Question about first_fit.c example about how2heap HOT 11 CLOSED

This file doesn't demonstrate an attack, but shows the nature of glibc's allocator.
glibc uses a first-fit algorithm to select a free chunk.
If a chunk is free and large enough, malloc will select this chunk.
This can be exploited in a use-after-free situation.
Allocating 2 buffers. They can be large, don't have to be fastbin.
1st malloc(512): 0x557a17c7c260
2nd malloc(256): 0x557a17c7c470
we could continue mallocing here...
now let's put a string at a that we can read later "this is A!"
first allocation 0x557a17c7c260 points to this is A!
Freeing the first one...
We don't need to free anything again. As long as we allocate less than 512, it will end up at 0x557a17c7c260
So, let's allocate 500 bytes
3rd malloc(500): 0x557a17c7c580
And put a different string here, "this is C!"
3rd allocation 0x557a17c7c580 points to this is C!
first allocation 0x557a17c7c260 points to 
If we reuse the first allocation, it now holds the data from the third allocation.

/* When "x" is from chunksize().  */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When "x" is a user-provided size.  */
# define usize2tidx(x) csize2tidx (request2size (x))

#define request2size(req)                                         \
(((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE)  ?             \
MINSIZE :                                                      \
((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)

/* The smallest possible chunk */
#define MIN_CHUNK_SIZE        (offsetof(struct malloc_chunk, fd_nextsize))

/* The smallest size we can malloc is an aligned minimal chunk */
#define MINSIZE  \
  (unsigned long)(((MIN_CHUNK_SIZE+MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK))

#define MALLOC_ALIGNMENT (2 * SIZE_SZ < __alignof__ (long double) \
			  ? __alignof__ (long double) : 2 * SIZE_SZ)

req = 505
size = (505 + 8 + 0xf) & ~0xf  = 528
tidx = (528 - 0x20 +0x10 - 1) / 0x10 = 31

req = 520
size = (520 + 8 + 0xf) & ~0xf  = 528
tidx = (528 - 0x20 +0x10 - 1) / 0x10 = 31