In fact, it's not even a 3-byte heap buffer overflow: it's a 1-byte overflow resulting from a 3-byte write operation. The relevant string on the heap is read pr

In fact, it's not even a 3-byte heap buffer overflow: it's a 1-byte overflow resulting from a 3-byte write operation. The relevant string on the heap is read precisely once, to insert the text into the current document, and freed once the file has finished loading (in the destructor of the Utf8_16_Read object). Therefore, the only thing that can be corrupted is the first byte in the Size field of the _HEAP_ENTRY corresponding to the subsequent object in the heap. However, some cursory research indicates that the 2 bytes of the Size field are protected (alongside the 1-byte Flags) by an XOR checksum stored in SmallTagIndex. Therefore, the worst it could ever do (unless I am missing something important) is cause an error when that subsequent object is freed. (Also, that particular write overflow is preceded by a 1-byte read overflow, but since the same buffer is reused for each block in the file, and since the bug can only occur after the first block, the read overflow will always read a byte from earlier in the same file.)