Heartbleed was a great example of both buffer underflow and why you never trust user input. Basically, a heartbeat is something the SSL/TLS protocol uses to check if the connection is still active, and it involved sending both a piece of data for the server to send back to prove the integrity of the connection and an integer specifying how many bytes the data is. The OpenSSL library had a bug where it would blindly trust the length value that was sent, so if you sent a huge length value and only a bit of data, it would accidentally read and send not only the target data but also whatever follows it in the program's memory, which could include sensitive information.