  Pushdown systems (PDSs) are a natural model for sequential programs, but they
can fail to accurately represent the way an assembly stack actually operates.
Indeed, one may want to access the part of the memory that is below the current
stack or base pointer, hence the need for a model that keeps track of this part
of the memory.
  To this end, we introduce pushdown systems with an upper stack (UPDSs), an
extension of PDSs where symbols popped from the stack are not destroyed but
instead remain just above its top, and may be overwritten by later push rules.
We prove that the sets of successors post* and predecessors pre* of a regular
set of configurations of such a system are not always regular, but that post*
is context-sensitive, so that we can decide whether a single configuration is
forward reachable or not.
  In order to under-approximate pre* in a regular fashion, we consider a
bounded-phase analysis of UPDSs, where a phase is a part of a run during which
either push or pop rules are forbidden. We then present a method to
over-approximate post* that relies on regular abstractions of runs of UPDSs.
Finally, we show how these approximations can be used to detect stack overflows
and stack pointer manipulations with malicious intent.
