32-bit ret2libc: Arguments Live on the Stack (cdecl)

On x86 (32-bit), a called function reads its arguments from the stack, just

above the saved return address. We forge a fake call frame:

{ Layout after overflow: [padding][&system][&exit][&"/bin/sh"].

When the vulnerable function returns, it "returns into" system,

which finds "/bin/sh" exactly where a normal caller would have left it.}