Exploiting a remote heap overflow with a custom TCP stack

https://www.synacktiv.com/en/publications/exploiting-a-remote-heap-overflow-with-a-custom-tcp-stack