notice in figure c above, when an argument larger than 11 bytes is supplied on the command line codice_3 overwrites local stack data, the saved frame pointer, and most importantly, the return address. when codice_3 returns it pops the return address off the stack and jumps to that address (i.e. starts executing instructions from that address). thus, the attacker has overwritten the return address with a pointer to the stack buffer codice_6, which now contains attacker-supplied data. in an actual stack buffer overflow exploit the string of "a"'s would instead be shellcode suitable to the platform and desired function. if this program had special privileges (e.g. the suid bit set to run as the superuser), then the attacker could use this vulnerability to gain superuser privileges on the affected machine.