The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86)