Excellent whitepaper/tutorial on Heap/BSS-based overflows, including very thorough explanation of what heap-based overflows are, several methods of exploitation, demonstrations, and some possible solutions/fixes.
You can download it from the following link: https://packetstormsecurity.com/files/download/13877/w00w00-heap-overflows.txt
Source: https://packetstormsecurity.com/files/13877/w00w00-on-Heap-Overflows.html