A short one, because the bug is short. A parser read a 16-bit length from the wire and used it to size a copy into a buffer it had already allocated based on a different field. The two were assumed to agree. They were not required to.
The mismatch
The allocation used header.count * sizeof(entry). The copy loop ran until header.length bytes were consumed. Send a small count with a large length and the write walks straight off the end of the allocation, one attacker-chosen entry at a time.
The takeaway
If a size comes from input, it is not a size — it is a claim. The number of bytes you are willing to write is a property of your allocation, never of the attacker’s header. Compute the bound yourself, clamp to it, and treat any disagreement as hostile.