It depends on the buffer overflow under question.
char *buffer_start;
char *buffer_pos;
char *buffer_end;
void write_data(size_t offset, int c)
{
if (buffer_pos + offset >= buffer_end)
abort();
buffer_pos += offset;
*buffer_pos = c;
buffer_pos++;
}
In the above scenario, one can write to lower addresses by specifying an offset that overflows. This in turn causes a buffer overflow to lower addresses.
As a reminder, to fix the buffer overflow you would write the check as follows:
if (offset >= buffer_end - buffer_pos)
abort();