The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)
-- Hovav Shacham, Proceedings of the 14th ACM conference on Computer and communications security, 2007.