Basically if an fstream bytewise write using `stream->putc()` fails due 
to an error (e.g. a transient disk failure or ENOSPCE), the operation 
ends up writing the char into the backing buffer anyway and multiple 
such operations could eventually result in writing arbitrary bytes 
beyond the backing buffer.  Note that a typical stream write (i.e. 
stream << "foo" ) is not affected by this.

Requisites for an attack:

1. Ability to invoke a write failure by, e.g. chaining a different 
vulnerability that allows such access
2. Finding a target suid application or service that calls 
`stream->putc()` in a user-controlled path
3. Ability to already control the execution frequency of 
`stream->putc()` to cause a buffer overflow.

There are no suid applications that use this pattern AFAIK, so I don't 
think there's a local attack vector here at all, only a network one 
through a service.  There's no confidentiality compromise either AFAICT, 
there's only a minor risk of data corruption and a small incremental 
(given the already compromised ability to invoke a storage failure) risk 
of DoS due to invoking a crash in the target service that meets all of 
the above criteria.