https://www.qualys.com/2017/06/19/stack-clash/stack-clash.tx... might help understand the exploitation method.