Integer overflow during TCP stream processing leads to heap overflow. Heap overflow in stream4 filter.
vulners.com/securityvulns/securityvulns:doc:4397
vulners.com/securityvulns/securityvulns:doc:4402