Finding security holes on purpose, before an attacker does.

A 64-byte buffer, and code that reads input without checking its length. Above the buffer sit values the program needs to return safely.

The buffer is full. Any further bytes overwrite memory that belongs to something else, and the language gives no warning.

The canary is a random value checked before the function returns. If it has changed, the program stops: a crash instead of a takeover. This check is one of the main defences.

The saved return address is now overwritten. Without the canary check, the program would jump to the wrong place when this function returns.

The last step matters most: reproduce the bug, reduce it to the smallest input that triggers it, and write it up so others can learn from it and fix it.