Excellent whitepaper/tutorial on Heap/BSS-based overflows, including very thorough explanation of what heap-based overflows are, several methods of exploitation, demonstrations, and some possible solutions/fixes.
5e75e6302f280fc0e1ee1bb212add9cca029460e216a013a8e73773a4ed48d27