FreeBSD -- libc stdio buffer overflow

Problem Description:
For line-buffered streams the __sflush() function did not
correctly update the FILE object’s write space member when the
write(2) system call returns an error.
Impact:
Depending on the nature of an application that calls libc’s
stdio functions and the presence of errors returned from the write(2)
system call (or an overridden stdio write routine) a heap buffer
overfly may occur. Such overflows may lead to data corruption or
the execution of arbitrary code at the privilege level of the calling
program.