Most programs are loaded into RAM when they run. Oftentimes, a program may need to temporarily pause and call another program to perform a specific function. Information about the current state of the suspended program, such as the values of any variables and the address in RAM of the instruction to execute next instruction when the subprogram, must be stored in RAM. The address for finding the next instruction when the subprogram has finished its task is written to an area of RAM called the stack. The other information is written into an adjoining area of RAM called a buffer a buffer overflow occurs when too much data is sent to the buffer, so that the address pointed to in the stack. In a buffer overflow attack, the input is designed so that Since the buffer has been filled with data sent by the attacker, this location contains commands that enable the attacker to take control of the system. Figure 7-6 (on page 256) depicts the steps in a buffer overflow attack.