Editing Buffer overflow (section)

===Heap-based exploitation===
{{Main|Heap overflow}}

A buffer overflow occurring in the heap data area is referred to as a heap overflow and is exploitable in a manner different from that of stack-based overflows. Memory on the heap is dynamically allocated by the application at run-time and typically contains program data. Exploitation is performed by corrupting this data in specific ways to cause the application to overwrite internal structures such as linked list pointers. The canonical heap overflow technique overwrites dynamic memory allocation linkage (such as [[malloc]] meta data) and uses the resulting pointer exchange to overwrite a program function pointer.

[[Microsoft]]'s [[Graphics Device Interface|GDI+]] vulnerability in handling [[JPEG]]s is an example of the danger a heap overflow can present.<ref>{{cite web |url=http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx |title=Microsoft Technet Security Bulletin MS04-028 |website=[[Microsoft]] |access-date=2007-05-15 |archive-url=https://web.archive.org/web/20110804221311/http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx |archive-date=2011-08-04 |url-status=dead }}</ref>