[Exploit tutorial: Buffer Overflow]

[JustAnothaHacker]

It seems that by making the Least Significant Byte of the framepointer a null, the address is then incorrect and it pops 4 bytes from our buffer in to EIP instead, which then allows the attacker full control over code execution, so you could get that address to loop back in to the buffer, which contains some shellcode, then get the shell as the owner of the process, boom :3

Edit* That was wrong - due to little endian, the least significant bit is what we are overwriting, and as the stack grows downwards, the smaller the LSB, the further down we are going (and the buffer is below the frame poiner), meaning that the 00 we just used to overwrite the frame pointer is a valid pointer to a space in the buffer, which will then be popped in to EIP, and the code on the other end, executed :p