Reminds me of "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)" [1]

[1]: https://hovav.net/ucsd/dist/geometry.pdf