I understand the first part, "There is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate

I understand the first part, "There is a parameter passed in as part of a function call that basically says “here’s where you can find the function to validate the signature", but I'm having trouble understanding the second part, "The attacker was able to point that to a function they wrote instead of using the real one". In other words I (relatively) understand the 'what', but I don't understand how was the attacker able to do the redirect?