add example where auth flag is placed in memory before password buffer so it cannot be overwritten but the return address of the stack frame can be overwritten.