This has some interesting stuff about buffer overflows towards the bottom.