The Geometry of Innocent Flesh on the Bone: Return-into-libc Without Function Calls (on the x86)