Heap overflow vulnerabilities are exactly the same as buffer overflow vulnerabilities, except that they target variables that are allocated using malloc, HeapAlloc, or similar APIs. In this case, these variables are located in a pre-allocated space in memory that is called heap.
The heap doesn't include a return address or the address of EBP. However, all of the variables that are allocated (and the free spaces in the heap as well) are all connected via a linked list structure. After each data block, there's a pointer to where the previous item in the list and the next item are. Once the memory is freed, the free or HeapFree APIs follow these links and write the next item's address in the previous item's next entry, and the previous item's address in the next item's previous entry. The code will look something like this:
By overflowing this variable, the attacker can overwrite FLink...