A Famous Security Bug

  A "famous security bug":

void f( void )
{ char buffer[ MAX ];
  /* . . . */
  memset( buffer, 0, sizeof( buffer )); }

  . Can you see what the bug is?

  (I have already read the answer; I post it as a pastime.)