The C runtime library for manipulating strings is notorious for allowing buffer overruns. For example, the strcpy function copies one string to another, and you get access to this through the <cstring> header, which is included by the <iostream> header. You may be tempted to write something like this:
char pHello[5]; // enough space for 5 characters strcpy(pHello, "hello");
The problem is that strcpy will copy all the character up to, and including the terminating NULL character and so you will be copying six characters into an array with space for only five. You could be taking a string from the user input (say, from a text box on a web page) and think that the array you have allocated is big enough, but a malicious ...
